[每日信息流] 2023-08-26

[chainreactorbot]

每日安全资讯（2023-08-26）

• Sec-News 安全文摘
  • [ ] 深入浅出Joern（三）Joern和Neo4j常用语法大全
  • [ ] 盲判断目标的fastjson版本
• Security Boulevard
  • [ ] BSides Cheltenham 2023 – Cristian Cornea – Bypassing Anti-Virus Using BadUSB
  • [ ] Kroll Employee SIM-Swapped for Crypto Investor Data
  • [ ] Daniel Stori’s ‘Python Robots’
  • [ ] Perceptions, SaaS Identities and AI
  • [ ] API Abuse – Lessons from the Duolingo Data Scraping Attack
  • [ ] NIST CSF 2.0: The Journey so Far and What’s Ahead
  • [ ] Versa Networks Adds Generative AI to SASE Platform
  • [ ] Scammers Target Online Markets with Telekopye Phishing Toolkit
  • [ ] Cybersecurity Insights with Contrast CISO David Lindner | 8/25
  • [ ] BSides Cheltenham 2023 – Welcome And Announcements By BSides Cheltenham Orga
• Recent Commits to cve:main
  • [ ] Update Fri Aug 25 10:54:51 UTC 2023
• SecWiki News
  • [ ] SecWiki News 2023-08-25 Review
• 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  • [ ] SOAR+NDR，安全威胁检测与自动化处置解决方案
  • [ ] 奇安信发布Q-GPT安全机器人和大模型卫士
  • [ ] 归源 · 智变｜第十二届KCon大会后记（附公开PPT下载链接）
  • [ ] XReward2023||干货不间断，日程第二波速查收~
  • [ ] 在安全芯片的加持下，Android数据加密越来越难被窃取
• Zgao's blog
  • [ ] Windows 远程下载文件和上线msf命令汇总
• Sploitus.com Exploits RSS Feed
  • [ ] Groupoffice 3.4.21 Directory Traversal exploit
  • [ ] Global Domains International 2.0 HTML Injection exploit
  • [ ] Grawlix CMS 1.1.1 Cross Site Scripting exploit
  • [ ] G And G Corporate CMS 1.0 SQL Injection exploit
  • [ ] Gusto Recipes Management 1.5.1 Insecure Settings exploit
  • [ ] Business Directory Script 3.2 SQL Injection exploit
  • [ ] GetSimple CMS 3.3.2 Cross Site Scripting exploit
  • [ ] Gravigra CMS 1.0 SQL Injection exploit
  • [ ] Exploit for CVE-2023-38831 exploit
  • [ ] Exploit for Path Traversal in Stagil Stagil Navigation exploit
• Files ≈ Packet Storm
  • [ ] Ubuntu Security Notice USN-6307-1
  • [ ] Ubuntu Security Notice USN-6306-1
  • [ ] Debian Security Advisory 5482-1
  • [ ] Business Directory Script 3.2 SQL Injection
  • [ ] Gusto Recipes Management 1.5.1 Insecure Settings
  • [ ] Groupoffice 3.4.21 Directory Traversal
  • [ ] Grawlix CMS 1.1.1 Cross Site Scripting
  • [ ] Gravigra CMS 1.0 SQL Injection
  • [ ] Global Domains International 2.0 HTML Injection
  • [ ] GetSimple CMS 3.3.2 Cross Site Scripting
  • [ ] G And G Corporate CMS 1.0 SQL Injection
• obaby@mars
  • [ ] 由srv引发的智障bug
• MaskRay
  • [ ] Clang -Wunused-command-line-argument
• unSafe.sh - 不安全
  • [ ] Ubuntu 桌面有逾 600 万用户
  • [ ] 《星际公民(Star Citizen)》筹款突破六亿美元
  • [ ] 网页直接标注：工具比较与使用技巧
  • [ ] The Good, the Bad and the Ugly in Cybersecurity – Week 34
  • [ ] Real World Cryptography Conference 2023 – Part II
  • [ ] An Arcade Game So Rare I Know of Two Others; reverse engineering a custom to a JAMMA standard
  • [ ] The parallels of AI and open source in software development
• 安全客-有思想的安全新媒体
  • [ ] 官方认证来袭！云上数据安全治理最佳实践
• Tenable Blog
  • [ ] Cybersecurity Snapshot: CISOs Value Prevention Over Response, While CISA Urges Cyber Teams To Prep for Quantum Attacks
• NVISO Labs
  • [ ] A Beginner’s Guide to Adversary Emulation with Caldera
• Dancho Danchev's Blog
  • [ ] Who's Behind the Conti Ransomware Gang?
• Hexacorn
  • [ ] Lolbins for connoisseurs…
• SentinelOne
  • [ ] The Good, the Bad and the Ugly in Cybersecurity – Week 34
• Forcepoint
  • [ ] ChatGPT on Economic Potential: How Four Industries Can Benefit from Generative AI
• Malwarebytes Labs
  • [ ] Teenage members of Lapsus$ ransomware gang convicted
  • [ ] Update now! Google Chrome's first weekly update has arrived
  • [ ] Smart lightbulb and app vulnerability puts your Wi-Fi password at risk
• SAP Blogs
  • [ ] See you at Google Cloud Next ’23
  • [ ] Fiori PO Approver app Forward button customization from ECC backend
  • [ ] SAP S/4HANA Credit Management – New Information Category 50
  • [ ] Post automatically general ledgers adjustments method
  • [ ] A seamless SAP S/4HANA journey — navigating the necessary changes
  • [ ] Equipment F4 Search Help / Fuzzy Search/ahead search Option
  • [ ] Graphs. Another way to show SAP ERP data
  • [ ] SAP Remote Access Connectivity(SAP RAC): A Cost-Effective and Flexible Solution which simplifies seamless SAP Integration.
  • [ ] Dynamic Date Filters in SAP Service & Asset Manager
  • [ ] User Experience in SAP S/4HANA: new Microlearning available
• Securelist
  • [ ] Lockbit leak, research opportunities on tools leaked from TAs
• Reverse Engineering
  • [ ] New OpenSecurityTraining2 class "Architecture 2821: Windows Kernel Internals 2" by Cedric Halbronn (~5 hours)
  • [ ] An Arcade Game So Rare I Know of Two Others; reverse engineering a custom to a JAMMA standard
  • [ ] New OpenSecurityTraining2 class "Exploitation 4011: Windows Kernel Exploitation: Race Condition + UAF in KTM" by Cedric Halbronn (~33 hours)
  • [ ] Looking for a known YT channel that would post episodes about Social/Reverse Engineering stories.
• Hex Rays
  • [ ] Igor’s Tip of the Week #154: Synchronized views
• Application Security Blog
  • [ ] The parallels of AI and open source in software development
• daniel.haxx.se
  • [ ] CVE-2020-19909 is everything that is wrong with CVEs
• text/plain
  • [ ] Kilimanjaro – Meet the Team; To Ndarakwai Lodge
• Wallarm
  • [ ] API Abuse – Lessons from the Duolingo Data Scraping Attack
• FreeBuf网络安全行业门户
  • [ ] FreeBuf 周报 | 谷歌浏览器推出全新功能；香港实体成为恶意软件的新目标
  • [ ] 盘点蓝军（攻击方）惯用的本地提权攻击手段
  • [ ] 零日攻击利用 WinRAR 安全漏洞锁定交易者
  • [ ] 新型恶意软件能利用WIFI定位设备地理位置
  • [ ] 补丁无效！CISA称梭子鱼ESG设备现仍无法抵御黑客攻击
  • [ ] 北约网络安全防御演习：Locked Shields
  • [ ] Lapsus$ 组织一名 18 岁成员或因入侵多家知名公司被定罪
  • [ ] 全国信安标委下达4项网络安全推荐性国家标准计划的通知
• KitPloit - PenTest & Hacking Tools
  • [ ] Poastal - The Email OSINT Tool
• 奇客Solidot–传递最新科技情报
  • [ ] AMD 公布 FSR 3 细节
  • [ ] 阿里巴巴开源能理解图像的 AI 模型 Qwen-VL
  • [ ] Ubuntu 桌面有逾 600 万用户
  • [ ] 《星际公民(Star Citizen)》筹款突破六亿美元
  • [ ] Tor 项目宣布抵御 DoS 攻击的 Proof-of-Work Defense
  • [ ] 20 岁前吸烟更容易上瘾更难戒掉
  • [ ] Firefox 支持从 Chrome 导入扩展
  • [ ] 裸鼹鼠长寿基因延长了小鼠寿命
  • [ ] Meta 发布代码生成 AI 模型 Code Llama
  • [ ] 脑机接口让瘫痪者以意念“发声”
  • [ ] 微星泄露英特尔 14 代酷睿处理器性能，比上一代平均提升 3%
• HackerNews
  • [ ] 新型恶意软件能利用 WIFI 定位设备地理位置
  • [ ] 补丁无效！CISA 称梭子鱼 ESG 设备现仍无法抵御黑客攻击
  • [ ] 零日攻击利用 WinRAR 安全漏洞锁定交易者
  • [ ] 50 亿美元的隐私大战！揭秘谷歌无痕浏览的现实
  • [ ] 企业警惕：浏览器插件风险高达 51%，或引发敏感数据被窃
  • [ ] Openfire 漏洞危机：仍有 3000 多台服务器易受攻击风险
  • [ ] 黑客组织 Lazarus 利用 Zoho ManageEngine 关键漏洞部署隐形恶意软件
• 空星星的备忘录
  • [ ] 关于作者
• Seebug漏洞平台
  • [ ] 原创 Paper | 疑似 APT37 新攻击武器 Fakecheck 分析报告
• Private Feed for M09Ic
  • [ ] kpcyrd starred reproducible-containers/diffoci
  • [ ] CHYbeta forked CHYbeta/nuclei from projectdiscovery/nuclei
  • [ ] boy-hack starred TigerResearch/TigerBot
  • [ ] WangYihang starred z4yx/GoAuthing
  • [ ] WangYihang made WangYihang/IP-List-Compressor public
  • [ ] 0nise starred dnSpy/dnSpy
  • [ ] theLSA started following W01fh4cker
  • [ ] theLSA starred whami-root/SSLShell
  • [ ] theLSA starred QwenLM/Qwen-VL
  • [ ] theLSA starred TabbyML/tabby
  • [ ] theLSA starred raspberryhusky/lazfinder
  • [ ] theLSA starred wangfly-me/LoaderFly
  • [ ] theLSA starred zangcc/Aakian-FaCai
  • [ ] theLSA starred AduraK2/Intranet-Movement-Kit
  • [ ] theLSA starred api0cradle/RedTeamScripts
  • [ ] theLSA starred zjunlp/KnowLM
  • [ ] theLSA started following carstein
  • [ ] theLSA starred facebookresearch/codellama
  • [ ] theLSA starred TomKing062/CVE-2022-38694_unlock_bootloader
  • [ ] theLSA starred ECTO-1A/AppleJuice
  • [ ] theLSA starred Morizeyao/GPT2-Chinese
  • [ ] theLSA starred rossja/TinyNuke
  • [ ] theLSA starred Octoberfest7/CVE-2023-36874_BOF
  • [ ] theLSA starred W01fh4cker/VcenterKit
  • [ ] theLSA starred yuawn/Linux-Kernel-Exploitation
  • [ ] theLSA starred BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc
  • [ ] theLSA starred NVIDIA/NeMo
  • [ ] theLSA starred Wack0/bitlocker-attacks
• CT Stack 安全社区
  • [ ] 雷池：你的网站免费安全卫士
• 灾难控制 局
  • [ ] 帮好友转-基础安全招聘
• 吾爱破解论坛
  • [ ] 吾爱破解论坛无任何第三方站点，警惕冒充诈骗！
• 安全牛
  • [ ] 科技创新成“最大增量”，美亚柏科半年报必须关注这几点！
  • [ ] 美亚柏科拟成立美亚云网，拥抱万亿数字化转型产业新风口
  • [ ] 美亚柏科M001大队为成都大运会网络安全保驾护航！
  • [ ] 构建风险优先的网络安全防护新模式
  • [ ] 《信息安全技术 重要数据处理安全要求》等4项网络安全推荐性国家标准计划下达
  • [ ] 奇安信发布Q-GPT安全机器人和大模型卫士
  • [ ] 开启网络安全量化时代丨Fortinet AI 驱动型安全运营方案让价值看得见
  • [ ] 归源 · 智变｜第十二届KCon大会后记（附公开PPT下载链接）
• 君哥的体历
  • [ ] 金融行业应用广泛的生物识别技术存在哪些信息泄露风险？APP如何便利快捷地更新隐私政策？｜总第203周
• 丁爸 情报分析师的工具箱
  • [ ] 【资料】粮食战争：日本核污染水排放的后续影响
• 博客园 - 郑瀚Andrew
  • [ ] DNSLOG平台搭建及其原理分析 - 郑瀚Andrew
• 安全研究GoSSIP
  • [ ] G.O.S.S.I.P 阅读推荐 2023-08-25
• 代码卫士
  • [ ] 罗克韦尔ThinManager 多个漏洞可导致工业HMI 易遭攻击
  • [ ] 多个高危漏洞可导致思科交换机和防火墙遭 DoS 攻击
• 看雪学苑
  • [ ] 2023 KCTF即将开赛！保姆级『战队指南』奉上
  • [ ] 将 OLLVM 从 LLVM4 移植到 LLVM16
  • [ ] 售价仅2.13美元，260万多邻国用户数据在黑客论坛上泄露
  • [ ] 有意向者可投递简历哦
• 国家互联网应急中心CNCERT
  • [ ] 网络安全信息与动态周报2023年第34期（8月14日-8月20日）
• 极客公园
  • [ ] 小红书重组电商基因
  • [ ] 中盐集团：食盐储备足，不要盲目抢；传大疆车载寻融资，估值 15 亿美元；IBM 研发 AI 模拟芯片 | 极客早知道
• dotNet安全矩阵
  • [ ] 分享.NET混淆工具 - ConfuserEx
  • [ ] .NET矩阵星球优惠活动持续进行
• 情报分析师
  • [ ] 普里戈任伪造了自己的死亡吗？
  • [ ] 普里戈任的去世对俄罗斯和瓦格纳集团意味着什么？
  • [ ] 关注小号，谨防失联！
• 奇安信威胁情报中心
  • [ ] 每周高级威胁情报解读(2023.08.17~08.24)
• 黑海洋 - WIKI
  • [ ] Segment Anything-在线AI抠图工具 能抠任何图像中的任何对象
  • [ ] AI艺术二维码生成器-QR Code AI
  • [ ] STABLE DOODLE-智能AI手绘草图转真实图像工具
  • [ ] Human Generator-AI人类生成器 实时生成真实全身照
• 绿盟科技技术博客
  • [ ] 绿盟科技威胁周报（2023.08.07-2023.08.13）
• 火绒安全
  • [ ] 【火绒安全周报】警方侦破特大黑灰产案 / 一名18岁勒索组织成员或因自闭症被免罪
• 补天平台
  • [ ] 重磅发布|“全网大语言模型产品漏洞悬赏”守卫计划
  • [ ] 补天节节高升计划 | “中秋有礼”奖品升级+奖金翻倍
• 数据安全与取证
  • [ ] 如何“收缩”Exchange数据库？
• 奇安信 CERT
  • [ ] 【已复现】Windows 错误报告服务权限提升漏洞(CVE-2023-36874)安全风险通告
  • [ ] 【已复现】RARLAB WinRAR代码执行漏洞(CVE-2023-38831)安全风险通告第二次更新
• 百度安全应急响应中心
  • [ ] 龙门阵Reload！百度安全白帽之夜再袭成都
• 字节跳动技术团队
  • [ ] 字节跳动水印技术论文入选ACM多媒体顶会
• 网安杂谈
  • [ ] 介绍一款免费网站WAF：雷池 长亭出品
• 威胁猎人Threat Hunter
  • [ ] 威胁猎人联合中国信通院发布《API安全发展白皮书（2023）》，提出API安全建设新思路
• NOVASEC
  • [ ] CobaltStrike4.5 与 RedGuard 快速部署
• Securityinfo.it
  • [ ] Ransomware: aumentano le vittime di Cl0p e LockBit in Europa
• SANS Internet Storm Center, InfoCON: green
  • [ ] Python Malware Using Postgresql for C2 Communications, (Fri, Aug 25th)
  • [ ] ISC Stormcast For Friday, August 25th, 2023 https://isc.sans.edu/podcastdetail/8632, (Fri, Aug 25th)
• 0x00sec - The Home of the Hacker - Top topics
  • [ ] Rrp acces every day 50+ remote desktops
• Schneier on Security
  • [ ] Friday Squid Blogging: China’s Squid Fishing Ban Ineffective
  • [ ] Hacking Food Labeling Laws
• Forensic Focus
  • [ ] XRY 10.6.1 Release: Support For iOS 17 Beta, Wider Device Range, And Multiple App Enhancements
• IT Service Management News
  • [ ] NIST Cybersecurity Framework 2.0 in bozza
• Hakin9 – IT Security Magazine
  • [ ] The Bring Your Own Device (BYOD) Dilemma
  • [ ] Slicing the Onion: An introduction to the Onion Routing
• Instapaper: Unread
  • [ ] Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
  • [ ] Crime as a Service, come funzionano le multinazionali del crimine
  • [ ] How could someone steal your keychain’s secrets
• The Hacker News
  • [ ] Two LAPSUS$ Hackers Convicted in London Court for High-Profile Tech Firm Hacks
  • [ ] Learn How Your Business Data Can Amplify Your AI/ML Threat Detection Capabilities
  • [ ] Navigating Legacy Infrastructure: A CISO's Actionable Strategy for Success
  • [ ] China-Linked Flax Typhoon Cyber Espionage Targets Taiwan's Key Sectors
  • [ ] Urgent FBI Warning: Barracuda Email Gateways Vulnerable Despite Recent Patches
• Over Security - Cybersecurity news aggregator
  • [ ] Campagna cinese prende di mira vulnerabili apparecchi Barracuda: FBI lancia avviso di compromissione
  • [ ] KittenSec: prende di mira i membri della NATO e solleva preoccupazioni
  • [ ] Kroll Employee SIM-Swapped for Crypto Investor Data
  • [ ] Data breach at French govt agency exposes info of 10 million people
  • [ ] CISA touts ‘tremendous growth’ in vulnerability disclosure platform
  • [ ] MSI: Recent wave of Windows blue screens linked to MSI motherboards
  • [ ] ICO calls social media firms to protect people's data from scraping
  • [ ] Microsoft: Stealthy Flax Typhoon hackers use LOLBins to evade detection
  • [ ] Bankrupt crypto platforms FTX and BlockFi warn customers of data breach
  • [ ] Leaseweb is restoring ‘critical’ systems after security breach
  • [ ] The Fraud Gala: Exploring a Recent BEC Campaign
  • [ ] Kroll data breach exposes info of FTX, BlockFi, Genesis creditors
  • [ ] New malware from North Korea’s Lazarus used against healthcare industry
  • [ ] Thousands have SSNs leaked after ransomware attack on Ohio state archive org
  • [ ] Sintesi riepilogativa delle campagne malevole nella settimana del 19 – 25 Agosto 2023
  • [ ] AI e cyber threat intelligence, alleati vincenti per contrastare le cyber minacce: le soluzioni
  • [ ] EXCLUSIVE: Postel SpA cyber attack, what doesn’t convince us about their press release
  • [ ] Lockbit leak, research opportunities on tools leaked from TAs
  • [ ] Servizi finanziari e di pagamento: le opinion dell’EDPS illuminano il percorso di innovazione UE
  • [ ] Digital Services Act (DSA) al via da oggi, aziende come Meta e Google si adeguano alla UE: ecco cosa serve ora
  • [ ] Ransomware: aumentano le vittime di Cl0p e LockBit in Europa
  • [ ] Crime as a Service, come funzionano le multinazionali del crimine
  • [ ] Risky Biz News: WinRAR zero-day used to hack stock and crypto traders
• TorrentFreak
  • [ ] Telecoms Regulator Gives Google a Week to Join IPTV Piracy Fight
  • [ ] Rightsholders Urge U.S. Govt to Pave the Way for Pirate Site Blocking
• Krebs on Security
  • [ ] Kroll Employee SIM-Swapped for Crypto Investor Data
• Security Affairs
  • [ ] China-linked Flax Typhoon APT targets Taiwan
  • [ ] Whiffy Recon malware triangulates the position of infected systems via Wi-Fi
  • [ ] FBI: Patches for Barracuda ESG Zero-Day CVE-2023-2868 are ineffective
• Information Security
  • [ ] When shopping online, what should you look for to ensure a website is secure?
• Social Engineering
  • [ ] Looking for a channel on YT that would post stories about Social Engineering.
  • [ ] Tracked my found/kept phone. How to get it back?
• /dev/random
  • [ ] [SANS ISC] Python Malware Using Postgresql for C2 Communications
• Blackhat Library: Hacking techniques and research
  • [ ] Buffer Overflow | Intro to Binary Exploitation | HackTheBox Jeeves
  • [ ] Spotify Method? (Bot)
• Deep Web
  • [ ] Shock sites on the Tor network
• Deeplinks
  • [ ] Tornado Cash Civil Decision Limits the Reach of the Treasury Department’s Actions while Skirting a Full First Amendment Analysis
• Il Disinformatico
  • [ ] Podcast RSI - Story: Come hackerare un satellite legalmente, e perché
• The Register - Security
  • [ ] FBI: Who was going around hijacking Barracuda email boxes? China, probably
• Technical Information Security Content & Discussion
  • [ ] New OpenSecurityTraining2 class "Architecture 2821: Windows Kernel Internals 2" by Cedric Halbronn (~5 hours)
  • [ ] New OpenSecurityTraining2 class "Exploitation 4011: Windows Kernel Exploitation: Race Condition + UAF in KTM" by Cedric Halbronn (~33 hours)
  • [ ] GitHub - dwisiswant0/ipfuscator: A blazing-fast, thread-safe, straightforward and zero memory allocations tool to swiftly generate alternative IP(v4) address representations in Go.
• Computer Forensics
  • [ ] getting only file name from kape
• netsecstudents: Subreddit for students studying Network Security and its related subjects
  • [ ] Sites to practice
  • [ ] Who's studying rn? Let's team up!
• KitPloit - PenTest Tools!
  • [ ] Poastal - The Email OSINT Tool
• Security Weekly Podcast Network (Audio)
  • [ ] Tackling the Perennial Problem of Device Management, News, BlackHat Interviews - Jason Meller - ESW #329
  • [ ] Openfire, Firepower, Barracuda, CosmicBeetle, Encryption, Aaran Leyland, & More - SWN #321

[github-actions[bot]]

This issue is stale because it has been open for 30 days with no activity.

[github-actions[bot]]

This issue was closed because it has been inactive for 14 days since being marked as stale.