Tencent Security Xuanwu Lab Daily News

• Unpacking the Latest macOS Backdoor Unleashed by Cracked Apps:
https://securityonline.info/unpacking-the-latest-macos-backdoor-unleashed-by-cracked-apps/

   ・ macOS用户受到了一场复杂的恶意软件攻击，该攻击利用了盗版应用程序的漏洞，展现出了恶意行为者在网络空间中不断演变的威胁。 – SecTodayBot

• Learning Binary Ninja For Reverse Engineering and Scripting:
http://console-cowboys.blogspot.com/2024/01/learning-binary-ninja-for-reverse.html

   ・ 使用Binary Ninja的逆向工程教程 – SecTodayBot

• MajorDoMo Command Injection:
https://packetstormsecurity.com/files/176669

   ・ MajorDoMo在0662e5e版本之前存在命令注入漏洞，并提供了利用该漏洞的Metasploit模块。 – SecTodayBot

• GAP-Burp-Extension: find more potential parameters and potential links:
https://securityonline.info/gap-burp-extension-find-more-potential-parameters-and-potential-links/

   ・ GAP-Burp-Extension是一个用于模糊测试的新工具，能够发现潜在的参数和链接，为安全测试提供帮助。 – SecTodayBot

• Domain Escalation – Backup Operator:
https://pentestlab.blog/2024/01/22/domain-escalation-backup-operator/

   ・ 介绍了Windows中Backup Operators组和SeBackupPrivilege权限的潜在安全风险 – SecTodayBot

• CVE-2023-5716 Alert: Critical Flaw in ASUS Armoury Crate Exposed:
https://securityonline.info/cve-2023-5716-alert-critical-flaw-in-asus-armoury-crate-exposed/

   ・ ASUS Armoury Crate软件存在严重漏洞CVE-2023-5716，攻击者可以利用此漏洞远程访问或修改系统中的任意文件。 – SecTodayBot

• Coldriver threat group targets high-ranking officials to obtain credentials:
https://www.malwarebytes.com/blog/news/2024/01/coldriver-threat-group-targets-high-ranking-officials-to-obtain-credentials

   ・ 揭示了一个名为Coldriver的黑客组织，文章对该黑客组织的策略、社会工程技术和恶意软件进行了详细分析，并介绍了Google TAG创建的YARA规则来发现Spica后门。 – SecTodayBot

• PixieFAIL – 9 UEFI Flaws Expose Computers To Remote Attacks:
https://gbhackers.com/pixiefail-uefi-flaws/

   ・ PixieFAIL - 9 UEFI漏洞，详细分析了漏洞的根本原因，包括影响的网络协议栈和引导过程。 – SecTodayBot

• Cracked software beats gold: new macOS backdoor stealing cryptowallets:
https://securelist.com/new-macos-backdoor-crypto-stealer/111778/

   ・ 恶意软件利用新的方法感染 macOS 系统，加密脚本和隐藏活动，包括恶意软件分析和内部工作机制的研究。 – SecTodayBot

• Ivanti Connect Secure Unauthenticated Remote Code Execution:
https://packetstormsecurity.com/files/176668

   ・ 利用Metasploit模块来利用Ivanti Connect Secure和Ivanti Policy Secure的认证绕过和命令注入漏洞，实现未经身份验证的远程代码执行。 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab