[每日信息流] 2023-04-05

[Tyaoo]

每日安全资讯（2023-04-05）

• SAP Blogs
  • [ ] SAP Billing and Revenue Innovation Management and Utilities – Case 1: Maintenance contract using rating
  • [ ] What’s New in SAP HANA 2.0 SPS 07
  • [ ] Running an SFTP Server on SAP Kyma
  • [ ] Increasing the GDP of the Internet with Streamlined, Integrated Cloud-Based Solutions
  • [ ] New version of RAP Generator available
• SecWiki News
  • [ ] SecWiki News 2023-04-04 Review
• 先知安全技术社区
  • [ ] house of orange & no free
  • [ ] 从CVE-2022-22947学习用java-object-searcher构造哥斯拉马
• 安全脉搏
  • [ ] 绕过认证的五种方式
  • [ ] 【漏洞预警】WordPress Elementor Pro插件访问控制漏洞
  • [ ] SSTI之细说jinja2的常用构造及利用思路
  • [ ] Execute-Assembly攻守之道
• NVISO Labs
  • [ ] An Innocent Picture? How the rise of AI makes it easier to abuse photos online.
• Sploitus.com Exploits RSS Feed
  • [ ] Exploit for Use After Free in Libexpat Project Libexpat exploit
  • [ ] Exploit for CVE-2023-42896 exploit
  • [ ] Exploit for Code Injection in Apache Commons Text exploit
  • [ ] Exploit for CVE-2023-23752 exploit
• FortyNorth Security Blog
  • [ ] Obfuscating C2 Traffic with Google Cloud Functions
• 安全客-有思想的安全新媒体
  • [ ] CVE-2023-21839 WebLogic Server RCE分析
  • [ ] 冠军！青藤云安全攻防实力在“磐石行动”攻防演练中再获认可
  • [ ] AI图像生成服Midjourne以滥用为由暂停免费试用
• SpiderLabs Blog from Trustwave
  • [ ] Rilide: A New Malicious Browser Extension for Stealing Cryptocurrencies
  • [ ] Deobfuscating the Recent Emotet Epoch 4 Macro
• Verne in GitHub
  • [ ] 记录一下 Clientexec 中配置 SMTP 时的一些问题
  • [ ] 介绍一下新推出的 EV Hosting 网络共享托管服务
• Security Boulevard
  • [ ] Understanding Identity and Access Management (IAM)
  • [ ] FBI Seizes Bot Shop ‘Genesis Market’ Amid Arrests Targeting Operators, Suppliers
  • [ ] AppSec Decoded: Scoping + data gathering in threat modeling
  • [ ] USENIX Security ’22 – Pietro Borrello, Andreas Kogler, Martin Schwarzl, Moritz Lipp, Daniel Gruss, Michael Schwarz – ‘ÆPIC Leak: Architecturally Leaking Uninitialized Data From The Microarchitecture’
  • [ ] Containing Compromised EC2 Credentials Without (Hopefully) Breaking Things
  • [ ] TikTok Abused Kids’ Data — UK Fines it $16 Million
  • [ ] The 3CX supply chain attack was targeted — but months in the making, with eyes on broader targets
  • [ ] Robert M. Lee’s & Jeff Haas’ Little Bobby Comic – ‘WEEK 423’
• Twitter @Nicolas Krassas
  • [ ] A fresh look at user enumeration in Microsoft Teams https://www.reddit.com/r/netsec/comments/12bhz86/a_fresh_look_at_user_enumeration_in_microsoft/
  • [ ] Proxyjacking - How attackers are monetizing internet bandwidth post exploitation https://www.reddit.com/r/netsec/comments/12bikr1/proxyjacking_how_att...
  • [ ] How Bubbles Are Blown https://blog.dshr.org/2023/04/how-bubbles-are-blown.html
  • [ ] ALPHV ransomware exploits Veritas Backup Exec bugs for initial access https://www.bleepingcomputer.com/news/security/alphv-ransomware-exploits-veritas...
  • [ ] New Rorschach ransomware is the fastest encryptor seen so far https://www.bleepingcomputer.com/news/security/new-rorschach-ransomware-is-the-fastest-e...
  • [ ] The microcode and hardware in the 8086 processor that perform string operations http://www.righto.com/2023/04/8086-microcode-string-operations.html
  • [ ] Australia takes its turn to kick TikTok off government kit https://go.theregister.com/feed/www.theregister.com/2023/04/04/australia_tiktok_ban/
  • [ ] TikTok Fined £12.7m For UK Data Protection Law Breaches https://packetstormsecurity.com/news/view/34492/TikTok-Fined-12.7m-For-UK-Data-Protection-Law...
  • [ ] Genesis Market, one of world’s largest platforms for cyber fraud, seized by police https://therecord.media/genesis-market-takedown-cybercrime
  • [ ] IRS-authorized http://eFile.com tax return software caught serving JS malware https://www.bleepingcomputer.com/news/security/irs-authorized-efilecom-t...
  • [ ] Uber driver info stolen yet again: This time from law firm https://go.theregister.com/feed/www.theregister.com/2023/04/03/uber_drivers_info_stolen/
  • [ ] Data Breach Strikes Western Digital https://www.darkreading.com/attacks-breaches/security-breach-strikes-western-digital
  • [ ] DoJ Recovers $112M in Crypto Stolen With Romance Scams https://www.darkreading.com/attacks-breaches/doj-112m-crypto-stolen-romance-scams
  • [ ] Cryptocurrency companies backdoored in 3CX supply chain attack https://www.bleepingcomputer.com/news/security/cryptocurrency-companies-backdoored-in-3...
  • [ ] Argument Injection Cheatsheet https://www.reddit.com/r/netsec/comments/12ajte5/argument_injection_cheatsheet/
  • [ ] The Bug Bounty Radar - The latest Bug Bounty programs from various platforms https://www.reddit.com/r/netsec/comments/12asekd/the_bug_bounty_radar_the...
  • [ ] UK outsourcing services provider Capita suffered a cyber incident https://securityaffairs.com/144398/hacking/capita-suffered-cyber-incident.html
  • [ ] New macOS malware steals sensitive info, including a user's entire Keychain database https://www.malwarebytes.com/blog/news/2023/04/new-macos-malware-...
• InfoSec Write-ups - Medium
  • [ ] Become an Infosec Writeups Ambassador
  • [ ] picoCTF writeup: Introductory cryptanalysis and stenography
• 嘶吼 RoarTalk – 回归最本质的信息安全,互联网安全新媒体,4hou.com
  • [ ] 冠军！青藤云安全攻防实力在“磐石行动”攻防演练中再获认可
  • [ ] ChatGPT 在网络安全领域是把双刃剑
  • [ ] 恶意JavaScript注入活动感染了51000个网站
  • [ ] 全面预防，智护网安 Check Point中国区用户及合作伙伴大会顺利召开
• USENIX
  • [ ] “Employees Who Don’t Accept the Time Security Takes Are Not Aware Enough”: The CISO View of Human-Centred Security
  • [ ] “Millions of people are watching you”: Understanding the Digital-Safety Needs and Practices of Creators
  • [ ] “Security is not my field, I’m a stats guy”: A Qualitative Root Cause Analysis of Barriers to Adversarial Machine Learning Defenses in Industry
  • [ ] A Data-free Backdoor Injection Approach in Neural Networks
  • [ ] A Large Scale Study of the Ethereum Arbitrage Ecosystem
  • [ ] A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plots
  • [ ] Abuse Vectors: A Framework for Conceptualizing IoT-Enabled Interpersonal Abuse
  • [ ] ACon^2: Adaptive Conformal Consensus for Provable Blockchain Oracles
  • [ ] Adversarial Training for Raw-Binary Malware Classifiers
  • [ ] Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks
  • [ ] AIRS: Explanation for Deep Reinforcement Learning based Security Applications
  • [ ] An Input-Agnostic Hierarchical Deep Learning Framework for Traffic Fingerprinting
  • [ ] Araña: Discovering and Characterizing Password Guessing Attacks in Practice
  • [ ] ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks
  • [ ] ARI: Attestation of Real-time Mission Execution Integrity
  • [ ] ARMore: Pushing love back into binaries
  • [ ] Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding
  • [ ] AURC: Detecting Errors in Program Code and Documentation
  • [ ] Authenticated private information retrieval
  • [ ] AutoFR: Automated Filter Rule Generation for Adblocking
  • [ ] autofz: Automated Fuzzer Composition at Runtime
  • [ ] Automated Cookie Notice Analysis and Enforcement
  • [ ] Automated Exploitable Heap Layout Generation for Heap Overflows Through Manipulation Distance-Guided Fuzzing
  • [ ] BalanceProofs: Maintainable Vector Commitments with Fast Aggregation
  • [ ] Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages
  • [ ] Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information
  • [ ] Bleem: Packet Sequence Oriented Fuzzing for Protocol Implementations
  • [ ] BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing
  • [ ] Bug Hunters’ Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
  • [ ] BunnyHop: Exploiting the Instruction Prefetcher
  • [ ] CAPatch: Physical Adversarial Patch against Image Captioning Systems
  • [ ] Capstone: A Capability-based Foundation for Trustless Secure Memory Access
  • [ ] CarpetFuzz: Automatic Program Option Constraint Extraction from Documentation for Fuzzing
  • [ ] Catch You and I Can: Revealing Source Voiceprint Against Voice Conversion
  • [ ] Cipherfix: Mitigating Ciphertext Side-Channel Attacks in Software
  • [ ] Controlled Data Races in Enclaves: Attacks and Detection
  • [ ] CSHER: A System for Compact Storage with HE-Retrieval
  • [ ] DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing
  • [ ] Defining "Broken": User Experiences and Remediation Tactics When Ad-Blocking or Tracking-Protection Tools Break a Website’s User Experience
  • [ ] Design of Access Control Mechanisms in Systems-on-Chip with Formal Integrity Guarantees
  • [ ] Detecting and Handling IoT Interaction Threats in Multi-Platform Multi-Control-Channel Smart Homes
  • [ ] Detecting Multi-Step IAM Attacks in AWS Environments via Model Checking
  • [ ] Did the Shark Eat the Watchdog in the NTP Pool? Deceiving the NTP Pool’s Monitoring System
  • [ ] DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing
  • [ ] Diving into Robocall Content with SnorCall
  • [ ] Don’t be Dense: Efficient Keyword PIR for Sparse Databases
  • [ ] Duoram: A Bandwidth-Efficient Distributed ORAM for 2- and 3-Party Computation
  • [ ] Educators’ Perspectives of Using (or Not Using) Online Exam Proctoring
  • [ ] ELASM: Error-Latency-Aware Scale Management for Fully Homomorphic Encryption
  • [ ] Eos: Efficient Private Delegation of zkSNARK Provers
  • [ ] Every Vote Counts: Ranking-Based Training of Federated Learning to Resist Poisoning Attacks
  • [ ] Exorcising "Wraith": Protecting LiDAR-based Object Detector in Automated Driving System from Appearing Attacks
  • [ ] Extending a Hand to Attackers: Browser Privilege Escalation Attacks via Extensions
  • [ ] Eye-Shield: Real-Time Protection of Mobile Device Screen Information from Shoulder Surfing
  • [ ] FABRID: Flexible Attestation-Based Routing for Inter-Domain Networks
  • [ ] Fact-Saboteurs: A Taxonomy of Evidence Manipulation Attacks against Fact-Verification Systems
  • [ ] Fine-grained Poisoning Attack to Local Differential Privacy Protocols for Mean and Variance Estimation
  • [ ] Formal Analysis and Patching of BLE-SC Pairing
  • [ ] Formal Analysis of Session-Handling in Secure Messaging: Lifting Security from Sessions to Conversations
  • [ ] Formal Analysis of SPDM: Security Protocol and Data Model version 1.2
  • [ ] Forming Faster Firmware Fuzzers
  • [ ] FreeEagle: Detecting Complex Neural Trojans in Data-Free Cases
  • [ ] GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation
  • [ ] Going through the motions: AR/VR keylogging from user head motions
  • [ ] HECO: Fully Homomorphic Encryption Compiler
  • [ ] Hey Kimya, Is My Smart Speaker Spying on Me? Taking Control of Sensor Privacy Through Isolation and Amnesia
  • [ ] Hidden Reality: Caution, Your Hand Gesture Inputs in the Immersive Virtual World are Visible to All!
  • [ ] Hiding in Plain Sight: An Empirical Study of Web Application Abuse in Malware
  • [ ] High Recovery with Fewer Injections: Practical Binary Volumetric Injection Attacks against Dynamic Searchable Encryption
  • [ ] HOLMES: Efficient Distribution Testing for Secure Collaborative Learning
  • [ ] ​​How Library IT Staff Navigate Privacy and Security Challenges and Responsibilities
  • [ ] How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic
  • [ ] How to Cover up Anomalous Accesses to Electronic Health Records
  • [ ] ICSPatch: Automated Vulnerability Localization and Non-Intrusive Hotpatching in Industrial Control Systems using Data Dependence Graphs
  • [ ] Improving Real-world Password Guessing Attacks via Bi-directional Transformers
  • [ ] InfinityGauntlet: Expose Smartphone Fingerprint Authentication to Brute-force Attack
  • [ ] Intender: Fuzzing Intent-Based Networking with Intent-State Transition Guidance
  • [ ] It's all in your head(set): Side-channel attacks on AR/VR systems
  • [ ] IvySyn: Automated Vulnerability Discovery in Deep Learning Frameworks
  • [ ] Jinn: Hijacking Safe Programs with Trojans
  • [ ] KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations
  • [ ] Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Sc...
  • [ ] Lalaine: Measuring and Characterizing Non-Compliance of Apple Privacy Labels
  • [ ] Lessons Lost: Incident Response in the Age of Cyber Insurance and Breach Attorneys
  • [ ] Log: It’s Big, It’s Heavy, It’s Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem
  • [ ] Long Live The Honey Badger: Robust Asynchronous DPSS and its Applications
  • [ ] Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants
  • [ ] Machine-checking Multi-Round Proofs of Shuffle: Terelius-Wikstrom and Bayer-Groth
  • [ ] Measuring Up to (Reasonable) Consumer Expectations: Providing an Empirical Basis for Holding IoT Manufacturers Legally Responsible
  • [ ] Meta-Sift: How to Sift Out a Clean Subset in the Presence of Data Poisoning?
  • [ ] MINER: A Hybrid Data-Driven Approach for REST API Fuzzing
  • [ ] Minimalist: Semi-automated Debloating of PHP Web Applications through Static Analysis
  • [ ] MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research
  • [ ] MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation
  • [ ] MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries
  • [ ] Multi-Factor Key Derivation Function (MFKDF) for Fast, Flexible, Secure, & Practical Key Management
  • [ ] Multiview: Finding Blind Spots in Access-Deny Issues Diagnosis
  • [ ] NAUTILUS: Automated RESTful API Vulnerability Detection
  • [ ] Near-Ultrasound Inaudible Trojan (Nuit): Exploiting Your Speaker to Attack Your Microphone
  • [ ] Network Responses to Russia's Invasion of Ukraine in 2022: A Cautionary Tale for Internet Freedom
  • [ ] No more Reviewer #2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learning
  • [ ] No Single Silver Bullet: Measuring the Accuracy of Password Strength Meters
  • [ ] NRDelegationAttack: Complexity DDoS attack on DNS Recursive Resolvers
  • [ ] On the Security of Internet Infrastructure
  • [ ] One Size Does not Fit All: Quantifying the Risk of Malicious App Encounters for Different Android User Profiles
  • [ ] Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M
  • [ ] Panda: Security Analysis of Algorand Smart Contracts
  • [ ] Pass2Edit: A Multi-Step Generative Model for Guessing Edited Passwords
  • [ ] Password Guessing Using Random Forest
  • [ ] PELICAN: Exploiting Backdoors of Naturally Trained Deep Learning Models In Binary Code Analysis
  • [ ] Place Your Locks Well: Understanding and Detecting Lock Misuse Bugs
  • [ ] Pool-Party: Exploiting Browser Resource Pools for Web Tracking
  • [ ] Practical Asynchronous High-threshold Distributed Key Generation and Distributed Polynomial Sampling
  • [ ] Prime Match: A Privacy Preserving Inventory Matching System
  • [ ] PrivateFL: Accurate, Differentially Private Federated Learning via Personalized Data Transformation
  • [ ] PROGRAPHER: An Anomaly Detection System based on Provenance Graph Embedding
  • [ ] ProSpeCT: Provably Secure Speculation for the Constant-Time Policy
  • [ ] PROVIDENCE: a Flexible Round-by-Round Risk-Limiting Audit
  • [ ] Proxy Hunting: Understanding and Characterizing Proxy-based Upgradeable Smart Contracts in Blockchains
  • [ ] Remote Code Execution from SSTI in the Sandbox: Automatically Detecting and Exploiting Template Escape Bugs
  • [ ] Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation
  • [ ] Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Network Environments with TCP-Aware Traffic Augmentation
  • [ ] SandDriller: A Fully-Automated Approach for Testing Language-Based JavaScript Sandboxes
  • [ ] Secure Floating-Point Training
  • [ ] SHELTER: Extending Arm CCA with Isolation in User Space
  • [ ] Sherlock on Specs: Building LTE Conformance Tests through Automated Reasoning
  • [ ] Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs
  • [ ] Squirrel: A Scalable Secure Two-Party Computation Framework for Training Gradient Boosting Decision Tree
  • [ ] Subverting Website Fingerprinting Defenses with Robust Traffic Representation
  • [ ] Temporal CDN-Convex Lens: A CDN-Assisted Practical Pulsing DDoS Attack
  • [ ] The Blockchain Imitation Game
  • [ ] The Case for Learned Provenance Graph Storage Systems
  • [ ] The Gates of Time: Improving Cache Attacks with Transient Execution
  • [ ] The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders
  • [ ] The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications
  • [ ] The Role of Professional Product Reviewers in Evaluating Security and Privacy
  • [ ] Three Lessons From Threema: Analysis of a Secure Messenger
  • [ ] Title redacted due to vulnerability embargo.
  • [ ] Token Spammers, Rug Pulls, and Sniper Bots: An Analysis of the Ecosystem of Tokens in Ethereum and in the Binance Smart Chain (BNB)
  • [ ] TreeSync: Authenticated Group Management for Messaging Layer Security
  • [ ] TRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks
  • [ ] Trojan Source: Invisible Vulnerabilities
  • [ ] TRust: A Compilation Framework for In-process Isolation to Protect Safe Rust against Untrusted Code
  • [ ] Tubes Among Us: Analog Attack on Automatic Speaker Identification
  • [ ] Ultimate SLH: Taking Speculative Load Hardening to the Next Level
  • [ ] Understand Users' Privacy Perception and Decision of V2X Communication in Connected Autonomous Vehicles
  • [ ] User Awareness and Behaviors Concerning Encrypted DNS Settings in Web Browsers
  • [ ] V1SCAN: Discovering 1-day Vulnerabilities in Reused C/C++ Open-source Software Components Using Code Classification Techniques
  • [ ] VeriZexe: Decentralized Private Computation with Universal Setup
  • [ ] Watch your Watch: Inferring Personality Traits from Wearable Activity Trackers
  • [ ] We Really Need to Talk About Session Tickets: A Large-Scale Analysis of Cryptographic Dangers with TLS Session Tickets
  • [ ] Work-From-Home and COVID-19: Trajectories of Endpoint Security Management in a Security Operations Center
  • [ ] X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection
  • [ ] XCheck: Verifying Integrity of 3D Printed Patient-Specific Devices via Computing Tomography
  • [ ] ZBCAN: A Zero-Byte CAN Defense System
• Trustwave Blog
  • [ ] Trustwave Named 2023 Company of the Year and Innovation Leader for Managed and Professional Security in the Americas by Frost & Sullivan
• 绿盟科技技术博客
  • [ ] 绿盟威胁情报月报-2023年3月
• Files ≈ Packet Storm
  • [ ] Ubuntu Security Notice USN-5995-1
  • [ ] Red Hat Security Advisory 2023-1559-01
  • [ ] Red Hat Security Advisory 2023-1588-01
  • [ ] Red Hat Security Advisory 2023-1556-01
  • [ ] Red Hat Security Advisory 2023-1557-01
  • [ ] Red Hat Security Advisory 2023-1586-01
  • [ ] Red Hat Security Advisory 2023-1584-01
  • [ ] Red Hat Security Advisory 2023-1554-01
  • [ ] Red Hat Security Advisory 2023-1560-01
  • [ ] Red Hat Security Advisory 2023-1547-01
• Dark Reading
  • [ ] Cybereason Secures $100M in Funding Led by SoftBank Corp.
  • [ ] Industrial Defender Launches Phoenix: OT Visibility & Security Solution for Small to Midsized Operations
  • [ ] CardinalOps Launches MITRE ATT&CK Security Layers for Measuring Detection Posture
  • [ ] F5 Safeguards Digital Services With New AI-Powered App and API Security Capabilities
  • [ ] Law Firm for Uber Loses Drivers' Data to Hackers in Yet Another Breach
  • [ ] eFile Tax Return Software Found Serving Up Malware
  • [ ] Akamai Launches Managed Security Service Updates and New Premium Offering
  • [ ] Mysterious 'Rorschach' Ransomware Doubles Known Encryption Speeds
  • [ ] 15M+ Services & Apps Remain Sitting Ducks for Known Exploits
  • [ ] What RASP Should Have Been
  • [ ] How Strategic Investors Can Help Cybersecurity Startups
  • [ ] Designing Tabletop Exercises That Actually Thwart Attacks
  • [ ] 'Proxyjacking' Cybercriminals Exploit Log4j in Emerging, Lucrative Cloud Attacks
• Blog - Praetorian
  • [ ] Screenshotting: Can You See What I See?
• Hacker Noon
  • [ ] Steampunk Meets AI: A Complete Guide to Arcane Diffusion
  • [ ] Reviving FTX: The Growing Call for FTX 2.0
  • [ ] Italy Stopping ChatGPT Is BS: Here's Why
  • [ ] From Connected Cars to Mental Health: Ivan Mishanin's Journey as a Co-Founder and Tech Leader
  • [ ] Top 6 Web3 Investments in the First Quarter of 2023
  • [ ] Profiting in Times of Crises: The Silicon Valley Bank Story
  • [ ] What’s the Difference Between path.join() and path.resolve()?
  • [ ] Why Designers Should Venture Outside Their Industry for Inspiration
  • [ ] No alterations have been made in this edition
  • [ ] The study of social hygiene
  • [ ] Make notes on random leaves of the things in Life and Thought
  • [ ] In these Essays—little, indeed, as I know them to be, compared to the magnitude of their subjects—
  • [ ] Grammarly — An Unconventional Thought Leader in Start-up Opera
  • [ ] Be a Shortstop Beagle: Learn How to Update R and RStudio to the Latest Version
  • [ ] The New Spirit by Havelock Ellis - Table of Links
  • [ ] The Task of Social Hygiene by Havelock Ellis - Table of Links
• unSafe.sh - 不安全
  • [ ] 关于shiro漏洞利用中key的修改
  • [ ] 3CX Supply Chain Cyber Attack: Analysis of Windows and macOS - Uptycs
  • [ ] IBM的2核4G免费VPS
  • [ ] PVE设置显卡直通 - 山中书
  • [ ] Google 将削减提供给员工的各种福利
  • [ ] ProxmoxVE6.2 VLAN配置_pve vlan_Halyace的博客-CSDN博客
  • [ ] 西部数据遭黑客入侵数据被盗
  • [ ] Google 将近距离文件共享带到 Windows
  • [ ] Obfuscating C2 Traffic with Google Cloud Functions
  • [ ] 抖音.快手无水印视频解析API
  • [ ] 在manjaro中开启多VLAN，配置永久静态IP，使用systemd-networkd配置_manjaro配置静态ip_SunJavaApplet的博客-CSDN博客
• Application Security Blog
  • [ ] AppSec Decoded: Scoping + data gathering in threat modeling
  • [ ] Polaris: Your no-compromise SaaS AST solution
• Microsoft Security Blog
  • [ ] Discover a new era of security with Microsoft at RSA 2023
• FreeBuf网络安全行业门户
  • [ ] 浅谈安全之应急响应 | FreeBuf甲方社群直播回顾
  • [ ] 突发！苹果“天气”宕机
  • [ ] 影响上千万网站，WordPress插件曝高危漏洞
  • [ ] WinRAR曝新威胁，黑客可直接运行PowerShell
  • [ ] 西部数据遭黑客入侵，My Cloud 服务中断
• HackerNews
  • [ ] WinRAR 曝新威胁，黑客可直接运行 PowerShell
  • [ ] 影响上千万网站，WordPress 插件曝高危漏洞
  • [ ] 揭秘俄罗斯军情机构的网络战行动
  • [ ] 多个勒索软件组织针对未更新的 IBM 文件传输软件
  • [ ] 西部数据遭黑客入侵，My Cloud 服务中断
• 梧桐雨blog
  • [ ] 使用python对图片中的文字进行提取
• 奇客Solidot–传递最新科技情报
  • [ ] Google 将削减提供给员工的各种福利
  • [ ] 西部数据遭黑客入侵数据被盗
  • [ ] Google 将近距离文件共享带到 Windows
  • [ ] 科学家完成基于时间的双缝实验
  • [ ] 报告称全球六分之一人口受到不孕不育症影响
  • [ ] 华硕宣布 Windows 掌机 ROG Ally
  • [ ] 使用 3CX 的加密货币公司被植入了后门
  • [ ] Google Drive 撤销 500 万文件数量限制
  • [ ] Twitter 将网站 Logo 改为柴犬
  • [ ] NASA 公布重返月球的宇航员名单
• 黑海洋 - WIKI
  • [ ] 关于shiro漏洞利用中key的修改
  • [ ] IBM的2核4G免费VPS
  • [ ] 抖音.快手无水印视频解析API
  • [ ] Linux自动磁盘挂载脚本WWW版(宝塔)
  • [ ] 微信群二维码活码生成源码（附操作教程）
  • [ ] Paopao—开源微社区源码、支持Docker（附官方教程）
  • [ ] 搞机工具箱：支持全自动刷机、卸载预装软件、无线ADB连接（持续更新）
  • [ ] 生成AI绘图prompt感助手
• 赵武的自留地
  • [ ] fofa下线的这一年我们做了什么
• 看雪学苑
  • [ ] 征题开启 | 看雪·2023 KCTF 年度赛-防守方规则揭晓（留言赢门票）
  • [ ] Realworld CTF 2023 The_cult_of_8_bit详解
  • [ ] 20天发生三起事故，三星刚用上ChatGPT就泄露了机密信息
  • [ ] 讲师招募 | 打造优质网络安全课程，成为安全教育的引领者
• 安全牛
  • [ ] 边界无限王佳宁：ADR技术将开启软件应用安全的无限想象
  • [ ] “西政大讲堂”正式开班，首期专题讲座聚焦金融安全与科技风险
  • [ ] 将AI技术嵌入数字风险防护与安全运营迫在眉睫
• 腾讯玄武实验室
  • [ ] 每日安全动态推送(4-4)
• 丁爸 情报分析师的工具箱
  • [ ] 【资料】俄罗斯网络行动对美国国家安全的威胁
  • [ ] 【通知】内部发行的《开源情报企业和智库目录》征集相关企业信息
• 代码卫士
  • [ ] 西部数据关键服务被迫中断
  • [ ] 俄罗斯全球网络战争计划被泄露
  • [ ] 美国国防部推出“黑掉五角大楼”网站
• SecPulse安全脉搏
  • [ ] 【漏洞预警】WordPress Elementor Pro插件访问控制漏洞
• 国家互联网应急中心CNCERT
  • [ ] CNVD漏洞周报2023年第13期
  • [ ] 上周关注度较高的产品安全漏洞(20230327-20230402)
  • [ ] 每周移动恶意程序传播渠道安全监测报告（2023年03月27日—2023年04月02日）
  • [ ] 每周典型移动恶意APP安全监测报告--“Android勒索类病毒”篇（2023-03-20--2023-03-26）
• 山石网科安全技术研究院
  • [ ] 劫持PHP内核函数实现后门持久化的研究
• 火线Zone
  • [ ] 白帽101招募计划正式发布！火线全面赋能社区成员能力发展
  • [ ] 山海无隔，再启新程 | 火线安全平台周年活动上线
• 字节跳动安全中心
  • [ ] 「甲方业务安全实战」干货大放送｜速领PPT及精彩回放
  • [ ] 补天十周年生日趴：十万白帽向上生长
• 关键基础设施安全应急响应中心
  • [ ] 三星引入 ChatGPT 不到 20 天，被曝发生 3 次芯片机密泄露！
  • [ ] 揭秘俄罗斯军情机构的网络战行动
  • [ ] 2022年的DDoS攻击：一次性瞄准所有在线内容
  • [ ] 存储巨头西部数据(持有SanDisk)承认被黑
• CNCERT国家工程研究中心
  • [ ] 三星引入 ChatGPT 不到 20 天，被曝发生 3 次芯片机密泄露！
  • [ ] 应用安全的盲点与热点：AI安全
  • [ ] 绝密档案：俄罗斯网络战核心支撑机构及武器库曝光
  • [ ] 2023年第一季度API安全观察：威胁态势仍在持续加剧
• 喜马拉雅安全响应平台
  • [ ] 1.5倍奖励｜XMSRC邀你一起踏春啦！
• 网安寻路人
  • [ ] 我国数据出境三条路径的风险控制要求对比
• 安全内参
  • [ ] 存储巨头西部数据遭入侵：多个内部系统被访问，My Cloud网盘服务中断
  • [ ] 受数据出境政策影响，知网暂停向多所港澳台高校提供部分服务
• 阿里安全响应中心
  • [ ] 阿里白帽大会，明年再见！
  • [ ] 第一名15万！阿里云CTF发布啦，欢迎报名
• 极客公园
  • [ ] 「0 元充电」撑不起千亿充电桩赛道
  • [ ] 传字节跳动去年营收 800 亿美元；推特蓝鸟变柴犬，狗狗币大涨；Mac 电脑销量减半，M2 芯片停产两月 | 极客早知道
• 微步在线
  • [ ] 微步获评2023年度江苏省网络安全技术支撑机构
• 星阑科技
  • [ ] 3月这几个API安全漏洞值得注意！
• 字节跳动技术团队
  • [ ] 字节跳动开源 Shmipc：基于共享内存的高性能 IPC
• 火线安全平台
  • [ ] 南方金融科技创新论坛成功举办！火线安全分享最能落地的IAST案例
  • [ ] 火线众测、洞态IAST双双斩获网安新兴赛道厂商「速查指南」星标推荐
• 三六零CERT
  • [ ] 安全日报（2023.04.04）
• 情报分析师
  • [ ] 2023美陆军学术完整课程指南（附下载）
  • [ ] 【案例】用开源情报分析图片地理位置
• 嘶吼专业版
  • [ ] ChatGPT 在网络安全领域是把双刃剑
  • [ ] 恶意JavaScript注入活动感染了51000个网站
• 虎符智库
  • [ ] 国家网信办发布新规背后:打通执法程序 实现发展与安全双轮驱动
• 深信服千里目安全技术中心
  • [ ] APT三月热点跟踪
• 信息安全国家工程研究中心
  • [ ] 清明 | 珍惜当下 网络安全 你我共筑
• 解道jdon.com
  • [ ] 用Rust很难编写出糟糕的代码
  • [ ] 使用 JeKa 实现 Java DevOps
  • [ ] 如何使用Java对文本进行情感分析和分类？
  • [ ] 大语言模型背后的原理 - arxiv
  • [ ] Vicuna：一个GPT-4开源聊天机器人
  • [ ] 数据中台的数据建模
• 渊龙Sec安全团队
  • [ ] 某恶意样本分析报告（二）
• 青藤智库
  • [ ] 【容器安全防线】Docker攻击方式与防范技术探究
• 卢昌海个人主页
  • [ ] 最新微博：2023 年 4 月 4 日
• Reorx’s Forge
  • [ ] Window Opener for Chrome
• Lenix Blog
  • [ ] 学习 Web 开发：初学者的 7 个基本步骤
  • [ ] 作为绝对初学者学习 Web 开发
  • [ ] 推特的推荐算法
  • [ ] 关于html5：脚本和样式元素的HTML“nonce”属性的目的是什么？
  • [ ] 一文搞懂 script 标签
  • [ ] 13 个前端可能用得上的 CSS技巧
  • [ ] CSS color-scheme 和夜间模式
• 火绒安全
  • [ ] 清明节期间火绒将持续为您护航
• 游魂博客
  • [ ] 流量卡合集丨长期更新丨长期神卡合集丨19-29月租丨130G-302G流量！长期流量卡选购指南
• 中国信息安全
  • [ ] 关于发布 “CNNVD漏洞奖励计划”的公告
  • [ ] 公安部：构筑网络安全等级保护、网络入侵防御等信息安全标准防火墙
  • [ ] 专题·网信产业新发展 | 筑牢网络安全基石：对我国密码产业发展的思考
  • [ ] 专家解读 | 完善网信部门行政执法程序 夯实网络强国法治基石
  • [ ] 关注 | 关于ChatGPT背后的深度合成技术，还有这些需要了解……
  • [ ] 观点 | 加强数字领域涉外法治体系建设
  • [ ] 评论 | 护苗！把对未成年人优先保护落到实处
• vivo千镜
  • [ ] 如何防止你的隐私被泄露？这份指南告诉你
• 威胁猎人Threat Hunter
  • [ ] 黑产“薅羊毛”盯上车企营销活动，如何驱逐羊毛党？
• 治部少辅
  • [ ] 解决在 Openvpn 客户端中部署的 Web 服务不可用的问题
• iNote
  • [ ] 合理使用ChatGPT的策略和注意事项
• 文艺数学君
  • [ ] 北邮人论坛十大_2023_04_04
• 游研社
  • [ ] 十年前，《模拟城市》是如何轰然倒塌的
  • [ ] 【消失的存档】广告过于吓人而被禁播的异类恐怖游戏《死魂曲》
  • [ ] Falcom米哈游跨国对谈：回合制RPG将向何处？
  • [ ] 10亿日元开发的游戏，上线一个月后迎来停服
  • [ ] 游研早报：69岁的奶奶正在学习玩《命运2》；传奇影业获得《街头霸王》影视改编权
• Bboysoul's Blog
  • [ ] 介绍一下gitea的action
• 懒得勤快的博客_互联网分享精神
  • [ ] Wondershare PDF element Pro 9.5.1学习版
  • [ ] MacOS文件查重清理工具——Duplicate File Finder Pro 7.0.8学习版
  • [ ] 安卓清理君3.6.8清理安卓手机垃圾
  • [ ] 接到电话让关闭京东金条白条？警惕！这是电信网络诈骗！
  • [ ] Android版酷我音乐 v10.3.8.1破解豪华VIP版
  • [ ] Process Lasso 12.1.0.26/ParkControl Pro 3.0.1.2 简体中文学习版
• 骁之屋
  • [ ] 抗癌之旅其六
• 王一石
  • [ ] 松鼠的隐秘仓库
• Conge
  • [ ] 2023三月读庄子 经济学 觉醒 斯多葛主义
• SHRIK3
  • [ ] Prepare a VirtualBox Image for Sharing
• Raz1ner
  • [ ] Deep Clean 深度清理垃圾软件
• 程序员的喵
  • [ ] 不想当作家的程序员写不出 Redis
• 好墨 · HaoInk
  • [ ] 事事精益求精真的有必要吗

[85ya]

有大佬复现PROGRAPHER: An Anomaly Detection System based on Provenance Graph Embedding吗，求代码orz