每日安全动态推送(8-30)

Tencent Security Xuanwu Lab Daily News

• Revisiting the Black Sunday Hack:
https://blog.codinghorror.com/revisiting-the-black-sunday-hack/amp/

   ・ 讲述了黑客社区如何利用卫星电视的智能卡设计漏洞，通过逆向工程和创造智能卡写入器来突破保护，最终被DirecTV利用动态代码摧毁。 – SecTodayBot

• tldrsec.com:
https://tldrsec.com/p/tldr-every-ai-talk-bsideslv-blackhat-defcon-2024

   ・ 总结了来自BSidesLV、Black Hat和DEF CON的60多场AI和网络安全相关演讲 – SecTodayBot

• Critical Vulnerabilities Expose Hitachi Energy MicroSCADA X SYS600 to Cyberattacks:
https://securityonline.info/critical-vulnerabilities-expose-hitachi-energy-microscada-x-sys600-to-cyberattacks/

   ・ 日立能源的MicroSCADA X SYS600产品存在多个关键漏洞，可能导致系统的保密性、完整性和可用性风险。 – SecTodayBot

• Uncovering the Limits of Machine Learning for Automatic Vulnerability Detection | USENIX:
https://usenix.org/conference/usenixsecurity24/presentation/risse

   ・ 介绍了机器学习自动漏洞检测的局限性，并提出了一种新的评估方法。 – SecTodayBot

• PoC Exploit Released for Arbitrary File Write Flaw (CVE-2024-22263) in Spring Cloud Data Flow:
https://securityonline.info/poc-exploit-released-for-arbitrary-file-write-flaw-cve-2024-22263-in-spring-cloud-data-flow/

   ・ Spring Cloud Data Flow中的CVE-2024-22263漏洞，以及相关的PoC exploit的发布。 – SecTodayBot

• Syntia: Synthesizing the Semantics of Obfuscated Code | USENIX:
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/blazytko

   ・ 介绍了一种基于程序合成的自动代码反混淆方法，通过Monte Carlo Tree Search（MCTS）引导程序合成，成功地学习了混淆代码的语义。 – SecTodayBot

• Analysis of two arbitrary code execution vulnerabilities affecting WPS Office:
https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

   ・ 披露ESET研究人员发现的WPS Office for Windows存在的漏洞，以及APT-C-60对其进行利用的情况 – SecTodayBot

• Gitea 1.22.0 – Stored XSS:
https://dlvr.it/TCV9wf

   ・ Gitea 1.22.0存储型跨站脚本（XSS）漏洞 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(8-30)