Tencent Security Xuanwu Lab Daily News
• 车联网漏洞分析与挖掘技术:
https://m.bilibili.com/video/BV15U4y1z7qK?vd_source=994e5741b72698fa42291f2582cd25c1
・ 车联网漏洞分析与挖掘技术（视频）
– Jett
• There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities:
https://research.nccgroup.com/2022/09/02/theres-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
・ NCC Group 对 Unisoc BootROM 多个漏洞的分析
– Jett
• [PDF] https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Thomas%20Roth%20-%20Solana%20JIT%20Lessons%20from%20fuzzing%20a%20smart-contract%20compiler.pdf:
https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Thomas%20Roth%20-%20Solana%20JIT%20Lessons%20from%20fuzzing%20a%20smart-contract%20compiler.pdf
・ Fuzzing 智能合约 Compiler，来自 DEF CON 30 会议
– Jett
• Practical guide for Golden SAML:
https://nodauf.dev/p/practical-guide-for-golden-saml/
・ 基于 AD FS 和 SAML 实现单点登录认证
– Jett
• Best Practices for Securing Active Directory:
https://docs.microsoft.com/en-gb/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
・ Active Directory 环境最佳安全实践
– Jett
• [Windows] Anatomy of an exploit in Windows win32k – CVE-2022-21882:
https://www.avira.com/en/blog/anatomy-of-an-exploit-in-windows-win32k-cve-2022-21882
・ Windows win32k CVE-2022-21882 漏洞的分析和利用
– Jett
• [PDF] https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf:
https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
・ Abusing Windows Error Reporting to Dump LSASS
– Jett
• [Firmware] Firmware Attack Surface Reduction (FASR):
https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/firmware-attack-surface-reduction
・ 微软通过 Firmware Attack Surface Reduction (FASR) 强化不同生产厂商设备的固件安全
– Jett
• CVE-2021-38297 – Go Web Assembly Vulnerability:
https://jfrog.com/blog/cve-2021-38297-analysis-of-a-go-web-assembly-vulnerability/
・ CVE-2021-38297 – Analysis of a Go Web Assembly vulnerability
– Jett
• [Vulnerability] Supervisor mode execution protection (SMEP) – Breaking Bits:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development/supervisor-mode-execution-protection-smep
・ Linux 内核 Supervisor mode execution protection (SMEP) 保护机制实现分析
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号： 腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(09-05)
