每日安全动态推送(4-7)

Tencent Security Xuanwu Lab Daily News

• New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks:
https://thehackernews.com/2024/04/new-http2-vulnerability-exposes-web.html

   ・ HTTP/2 协议中的 CONTINUATION frame 可被利用进行拒绝服务（DoS）攻击，研究人员发现多个 HTTP/2 实现存在漏洞 – SecTodayBot

• Sorry, you have been blocked:
https://go.theregister.com/feed/www.theregister.com/2024/04/05/hotel_checkin_terminal_bug/

   ・ 酒店自助办理终端存在漏洞，可能泄露客房钥匙码，研究人员发现并披露该问题，提出潜在的危害和可能的利用方式 – SecTodayBot

• Bing ad for NordVPN leads to SecTopRAT:
https://www.malwarebytes.com/blog/threat-intelligence/2024/04/bing-ad-for-nordvpn-leads-to-sectoprat

   ・ 本文报道了最近针对流行VPN软件NordVPN的恶意广告活动，涉及滥用搜索广告以及在受害者计算机上安装远程访问特洛伊木马。恶意广告冒充NordVPN，诱导用户下载虚假应用程序，并以官方供应商身份数字签名恶意安装程序，其中包含远程访问特洛伊木马 – SecTodayBot

• OSTE-Web-Log-Analyzer: automate the process of analyzing web server logs:
https://securityonline.info/oste-web-log-analyzer-automate-the-process-of-analyzing-web-server-logs/

   ・ Python Web Log Analyzer是一款用于自动分析web服务器日志的强大工具，具有检测和识别各种网络攻击的功能，包括攻击检测、速率限制监控、自动扫描器检测和用户代理分析 – SecTodayBot

• Google Public DNS’s approach to fight against cache poisoning attacks:
http://security.googleblog.com/2024/03/google-public-dnss-approach-to-fight.html

   ・ 本文主要介绍了DNS缓存投毒攻击以及谷歌公共DNS采取的安全措施来应对这些攻击。 – SecTodayBot

• AI-as-a-Service Providers Vulnerable to PrivEsc and Cross-Tenant Attacks:
https://thehackernews.com/2024/04/ai-as-service-providers-vulnerable-to.html

   ・ 人工智能即服务提供商存在严重风险，攻击者可能获取对其他客户模型的特权访问，文章详细分析了此漏洞的根本原因和潜在影响，并提出了解决问题的建议。 – SecTodayBot

• CVE-2024-3273: D-Link NAS Vulnerability Threatens 92,000 Devices:
https://securityonline.info/cve-2024-3273-d-link-nas-vulnerability-threatens-92000-devices/

   ・ D-Link NAS devices are threatened by a serious vulnerability (CVE-2024-3273), allowing attackers to execute commands remotely and potentially steal sensitive data or disrupt operations.  – SecTodayBot

• Don’t Trust the Cache: Exposing Web Cache Poisoning and Deception vulnerabilities:
https://anasbetis023.medium.com/dont-trust-the-cache-exposing-web-cache-poisoning-and-deception-vulnerabilities-3a829f221f52

   ・ 介绍了网页缓存中的漏洞和攻击技术，详细分析了Web缓存中的毒化和欺骗漏洞 – SecTodayBot

• OPC-UA Deep Dive Series (Part 10): Security Tips for Asset Owners:
https://hubs.li/Q02rVGGq0

   ・ OPC UA协议安全研究成果的总结，包括发现并报告大量漏洞/CVE、开发独特的攻击技术和发布开源工具，同时提出了评估部署安全性的最佳实践。  – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(4-7)