每日安全资讯（2023-09-28）
- SecWiki News
- Security Boulevard
- Webinar Highlights – Mastering the new SEC Regs
- Step on It: What to Know About TISAX Compliance in the Automotive Market
- Protecting Critical Infrastructure From Ransomware with LogRhythm NDR
- Google LibWebP Arbitrary Code Execution Vulnerability (CVE-2023-5129) Notification
- Cyber Week 2023 & The Israel National Cyber Directorate Presents – Scaling up Cyber Capacity Building: The Sectoral Approach to Critical Infrastructure Protection
- ZenRAT Targets Windows Users with Fake Bitwarden Site
- Meet the Ona: Stefan Popa
- RATs, rootkits, and ransomware (oh my!)
- Unlock 2023’s Top Benefits of Security as a Service!
- Randall Munroe’s XKCD ‘Lying’
- Tenable Blog
- HackerOne Hacker Activity
- Files ≈ Packet Storm
- Microsoft Error Reporting Local Privilege Elevation
- Everlasting ROBOT: The Marvin Attack
- Ubuntu Security Notice USN-6399-1
- Ubuntu Security Notice USN-6398-1
- Ubuntu Security Notice USN-6387-2
- Ubuntu Security Notice USN-6397-1
- Ubuntu Security Notice USN-6396-1
- Red Hat Security Advisory 2023-5353-01
- Red Hat Security Advisory 2023-5362-01
- Red Hat Security Advisory 2023-5361-01
- Red Hat Security Advisory 2023-5360-01
- Red Hat Security Advisory 2023-5363-01
- Ubuntu Security Notice USN-6361-2
- Sploitus.com Exploits RSS Feed
- Microsoft Error Reporting Local Privilege Elevation exploit
- Microsoft Error Reporting Local Privilege Elevation Exploit exploit
- Exploit for OS Command Injection in Imagemagick exploit
- Exploit for Improper Authentication in Fit2Cloud Jumpserver exploit
- Exploit for Command Injection in Cisco Telepresence Video Communication Server exploit
- Exploit for Vulnerability in Apple Macos exploit
- Exploit for Cross-site Scripting in Roundcube Webmail exploit
- Exploit for CVE-2023-42222 exploit
- Sec-News 安全文摘
- paper - Last paper
- Google Online Security Blog
- obaby@mars
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- Recent Commits to cve:main
- unSafe.sh - 不安全
- GPU.zip: Hackers can now steal your passwords through your GPU (pixel-by-pixel)
- 行政处罚决定书查询
- Pegasus spyware and how it exploited a WebP vulnerability
-
[Sonoma in the Spotlight What’s New and What’s Missing in macOS 14](https://buaq.net/go-178078.html) - jumpserver最新re-auth复现（伪随机经典案例）
- Xenomorph hunts cryptocurrency logins on Android
- A Deep Dive into Brute Ratel C4 payloads – Part 2
- You can now use WebGPU in Cloudflare Workers
- Perception Point
- Forcepoint
- Securelist
- BREAKDEV
- SAP Blogs
- A Supplier Portal for SAP S/4HANA Cloud in No-Code with Integration to SAP BTP Event Mesh
- SAP Inside Track 2023 – Bangalore – August 19 !!
- SAP Enable Now Learning Journey
- SAP Enable Now – People Solution for successful Digital Transformation
- SF Time Off – Compensatory Off – Complete Automated Process using MDF and Integration Center
- Third party Sales process in SAP S/4 HANA system
- Dancho Danchev’s Blog
- Malwarebytes Labs
- GuidePoint Security
- SentinelOne
-
[Sonoma in the Spotlight What’s New and What’s Missing in macOS 14](https://www.sentinelone.com/blog/sonoma-in-the-spotlight-whats-new-and-whats-missing-in-macos-14/)
-
- Reverse Engineering
- Hexacorn
- blog.avast.com EN
- Intigriti
- FreeBuf网络安全行业门户
- KitPloit - PenTest & Hacking Tools
- Black Hills Information Security
- Checkmarx.com
- 安全牛
-
[安全牛研究 2023年国产欺骗式防御技术应用及代表性厂商分析](https://www.aqniu.com/industry/100001.html) - 索尼公司回应勒索攻击传言：正紧急展开调查
- Fortinet 2023上半年全球威胁态势研究报告：勒索软件检测成下降趋势，针对性攻击持续升温
- 新型勒索“Megazord”肆虐 三家美国企业数据可随意下载
- 重要通知丨JumpServer漏洞通知及修复方案（JS-2023.09.27）
-
- 奇客Solidot–传递最新科技情报
- 网易手游因审核合规要求移除无根门
- 网信办公布首批备案的应用商店，苹果应用商店未包含在内
- 研究预测未来东北增温幅度最大
- 研究预测哺乳动物的生存时间还剩下 2.5 亿年
- CERN 获得至今对强力强度最精确测量
- Google Podcasts 即将关闭，YouTube Music 将加入播客功能
- Signal 总裁认为 AI 本质上是一种监控技术
- FTC 和美国 17 个州起诉亚马逊非法垄断电商市场
- 苹果为与 Google 的默认搜索交易辩护称没有有效替代
- GPU 旁路攻击暴露视觉数据
- OpenAI 估值可能最高达到 900 亿美元
- Telegram 准备拥抱小程序
- 微软释出 Windows 11 v23H2
- 绿盟科技技术博客
- 腾讯玄武实验室
- HackerNews
- 雷神众测
- 吾爱破解论坛
- 奇安信 CERT
- 丁爸 情报分析师的工具箱
- 【通知】首届全国公安机关刑事侦查新技术论坛11月在嘉兴召开
-
[【转载】数说情报 （四）TW网军打击异己手段](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651139194&idx=2&sn=ffe487e7a135c56172e270175ca652bb&chksm=f1af5b40c6d8d25698e8012402bc54b08813216ef9e1ae4c0a782ac98b1a95216ba34f40e9e4&scene=58&subscene=0#rd)
- 看雪学苑
- Windows HyperV 和它的内存管理
- 索尼系统疑似被入侵，多个团伙声称对此负责
-
[赛况播报 2023 KCTF-第11题《步步逼近》已开赛](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458520056&idx=3&sn=2db58b79dbe8b392d2fc47b4f46d9d8f&chksm=b18d397286fab0640e1f23eb82b4f7a41b0c3c0647815f3b8a7d9eb1218c7b82a159992a5266&scene=58&subscene=0#rd) - 4h入门PHP代码审计之反序列化
- 慢雾科技
-
[慢雾中秋献礼 黑暗森林主题版礼盒已上线](https://mp.weixin.qq.com/s?__biz=MzU4ODQ3NTM2OA==&mid=2247498556&idx=1&sn=300c5cbec65b3140d64429a9ea94263e&chksm=fdde85bbcaa90cad48a6270f64cb19b2c075410a4085f45a21f3b7c776561f701fc31f8ecf69&scene=58&subscene=0#rd)
-
- 代码卫士
- 三六零CERT
- 我的安全视界观
- 安全内参
- 安全牛
-
[安全牛研究 2023年国产欺骗式防御技术应用及代表性厂商分析](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651125827&idx=1&sn=236d88f8928370f53b9ace7ac52e7de7&chksm=bd1448908a63c186f722752a68517af3b0afa20c7ea887e32b1fb621ec117b10fddc069d9021&scene=58&subscene=0#rd) - 索尼公司回应勒索攻击传言：正紧急展开调查
-
- 青藤云安全
- 极客公园
-
[B 站公布《中国奇谭第二季》；中国队拿下亚运会「电竞首金」；菜鸟提交上市申请，1 年 15 亿跨境包裹 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653013578&idx=1&sn=c665c1735ad0d53d06e4540974e21ee3&chksm=7e54bbfc492332ea4eefa4ca1e3d3e020c64d474c624d77f0cd376b73c6344d8e24f31d5637e&scene=58&subscene=0#rd)
-
- 国家互联网应急中心CNCERT
- rtl-sdr.com
- 360漏洞云
- 火线安全平台
- 安全研究GoSSIP
- 数世咨询
- 我的安全梦
- 嘶吼专业版
- DataCon大数据安全分析竞赛
- 情报分析师
- 腾讯安全威胁情报中心
- 关键基础设施安全应急响应中心
- OPPO安全应急响应中心
- CNCERT国家工程研究中心
- 中国信息安全
-
[聚焦 算力网络安全架构与数据安全治理技术研讨会在京成功举办](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=1&sn=f6385ebd5edef8e0390e98a6f1fbe242&chksm=8b5962f0bc2eebe662c402b3eed4d6ebbcc3558decd402159b911c646c0e03581e66b9147cdc&scene=58&subscene=0#rd) -
[关注 工信部通报23款侵害用户权益行为的APP（SDK）](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=2&sn=57cb8a9ae69043aa6273aae96f7fa6f8&chksm=8b5962f0bc2eebe6117da20e74cd9335d6ed17bd01b262f9b0780c0f4c48f711038e98152b95&scene=58&subscene=0#rd) -
[发布 国家网信办发布第一批应用程序分发平台备案编号](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=3&sn=52d2f9bdddbb99befd6ccb2f180583af&chksm=8b5962f0bc2eebe60dd9a9decb1602ea5d1e02f2229144061e1960e6b15b789edc260eb0eeb8&scene=58&subscene=0#rd) -
[CNNVD 关于Linux kernel安全漏洞情况的通报](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=4&sn=b6a0b6675b7ad1ee2ad4f4d7b610ae95&chksm=8b5962f0bc2eebe673ac09eca109c71d0d241bfe93dbc5227eaa5493e510e23ec505e7010080&scene=58&subscene=0#rd) - 国家金融监督管理总局王蔚：推进金融数据要素开发利用和安全保护
-
[观点 协同发力严厉打击跨境诈骗](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=6&sn=a196c00c349a06dac4a1c11486091569&chksm=8b5962f0bc2eebe66c18d9496137905e8a592b878e932d2f87bdb629bcb1df61890d1a0769d0&scene=58&subscene=0#rd) -
[观点 数字化生存时代我的信息谁做主](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664194057&idx=7&sn=1a0e17d139dfa9be3e48973617a4f6e9&chksm=8b5962f0bc2eebe6ab59b57ad73ddeb74eb939a703651fc63708d4fbde527a335d04ffb64c9b&scene=58&subscene=0#rd)
-
- 默安科技
- 深信服千里目安全技术中心
- 山石网科安全技术研究院
- 微步在线
- 360数字安全
- Securityinfo.it
- D3Lab
- Google Online Security Blog
- Over Security - Cybersecurity news aggregator
- Google fixes fifth actively exploited Chrome zero-day of 2023
- SSH keys stolen by stream of malicious PyPI and npm packages
- Fake Bitwarden sites push new ZenRAT password-stealing malware
- Dallas: Royal ransomware gang infiltrated networks weeks before striking
- RICO class-action data privacy lawsuit filed against H&R Block, Google, Meta
- Building automation giant Johnson Controls hit by ransomware attack
- Vulnerability in popular ‘libwebp’ code more widespread than expected
- Microsoft now rolling out AI-powered Paint Cocreator to Insiders
- US, Japan say ‘BlackTech’ Chinese gov’t hackers exploiting routers during attacks
- 10 new vulnerabilities disclosed by Talos, including use-after-free issue in Google Chrome
- US and Japan warn of Chinese hackers backdooring Cisco routers
- Vulnerabilità Libwebp ora guadagna la massima severità: come proteggersi dopo i cyber attacchi
- Individuata una vulnerabilità critica in libwebp già sfruttata dagli attaccanti
- Campagna di phishing ai danni di Segugio.it con falso call center
- Sicurezza informatica delle organizzazioni sanitarie: fronteggiare le sfide con un approccio socio-tecnico
- Modern GPUs vulnerable to new GPU.zip side-channel attack
- GitHub repos bombarded by info-stealing commits masked as Dependabot
- Malware-as-a-service: i ransomware sono i software più venduti
- Putin and Prigozhin went through an ‘amazing transformation,’ says former Kremlin speechwriter
- ‘Snatch’ Ransom Group Exposes Visitor IP Addresses
- Ransomed.vc, the new comet in the extortion landscape: the interview
- Tre scenari di attacco dell’intelligenza artificiale: ecco come contrastarli
- QR codes in email phishing
- DHS to host Latin American cyber summit as region faces an onslaught of digital attacks
- La nuova legge svizzera sulla privacy: gli impatti per le aziende italiane
- Risky Biz News: CISA releases HBOM framework
- Schneier on Security
- The Hacker News
- Red Cross-Themed Phishing Attacks Distributing DangerAds and AtlasAgent Backdoors
- Researchers Uncover New GPU Side-Channel Vulnerability Leaking Sensitive Data
- New Survey Uncovers How Companies Are Confronting Data Security Challenges Head-On
- New ZenRAT Malware Targeting Windows Users via Fake Password Manager Software
- Critical libwebp Vulnerability Under Active Exploitation - Gets Maximum CVSS Score
- Graham Cluley
- Unsupervised Learning
- Deeplinks
- TG Soft Software House - News
- Computer Forensics
- Your Hacking Tutorial by Zempirians
- SANS Internet Storm Center, InfoCON: green
- netsecstudents: Subreddit for students studying Network Security and its related subjects
- Deep Web
- Technical Information Security Content & Discussion
- Cisco advisory: Reports about bad Actors Hiding in Router Firmware
- How to get persistent reverse shell from Android app without visible permissions to DoS device
- NoSQL injection techniques & labs
- Getting RCE in Chrome with incorrect side effect in the JIT compiler
- Chalk - Total visibility of your software engineering lifecycle
- A Deep Dive into Brute Ratel C4 payloads – Part 2
- Krebs on Security
- Information Security
- Il Disinformatico
- Social Engineering
- Pentestmag
- 安全419
- Penetration testing Archives - MDSec
- Yoroi Warning Archive Feed
- KitPloit - PenTest Tools!
- Security Affairs
- Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices
- China-linked APT BlackTech was spotted hiding in Cisco router firmware
- Watch out! CVE-2023-5129 in libwebp library affects millions applications
- DarkBeam leaks billions of email and password combinations
- ‘Ransomed.vc’ in the Spotlight – What is Known About the Ransomware Group Targeting Sony and NTT Docomo
- Top 5 Problems Solved by Data Lineage