Tencent Security Xuanwu Lab Daily News
• GitHub – FeeiCN/Security-PPT: 大安全各领域各公司各会议分享的PPT:
https://github.com/FeeiCN/Security-PPT
・ 近些年国内各个安全相关会议的 PPT 整理
– Jett
• [Machine Learning] We update DeepWordBug into a new and more comprehensive CodeRepo : TextAttack for generating adversarial examples to fool NLP predictive models.:
https://github.com/QData/deepWordBug
・ 自动生成对抗性文本序列攻击 NLP 预测模型
– Jett
• ZDI-CAN-12671: Windows Kernel DoS/Privilege Escalation via a NULL Pointer Deref:
https://www.thezdi.com/blog/2021/1/27/zdi-can-12671-windows-kernel-dosprivilege-escalation-via-a-null-pointer-deref
・ Windows win32kfull.sys 一个空指针解引用漏洞的分析
– Jett
• [Fuzzing, Network] De-socketing for Fuzzing:
https://github.com/fkie-cad/libdesock
・ 在 Fuzz 网络应用的时候，将网络的接收和发送重定向到标准输入和输出，方便使用 AFL Fuzz 测试
– Jett
• ASP.NET下的内存马(3) HttpListener内存马:
https://tttang.com/archive/1451/
・ ASP.NET下的内存马(3) HttpListener内存马.
– lanying37
• The Hunt for the Lost Soul: Unraveling the Evolution of the SoulSearcher Malware:
https://www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware
・ Fortinet 对 SoulSearcher 恶意软件样本的分析
– Jett
• MISP/MISP:
https://github.com/MISP/MISP
・ MISP – 开源威胁情报和共享平台
– Jett
• [Tools] 0ang3el/websocket-smuggle:
https://github.com/0ang3el/websocket-smuggle
・ Smuggling HTTP requests over fake WebSocket connection
– Jett
• Catching bugs in VMware: Carbon Black Cloud Workload Appliance and vRealize Operations Manager:
https://swarm.ptsecurity.com/catching-bugs-in-vmware-carbon-black-cloud-workload-appliance-and-vrealize-operations-manager/
・ 利用 Carbon Black Cloud Workload Appliance 和 vRealize Operations Manager 的多个漏洞实现 RCE
– Jett
• [Virtualization] Container Security Checklist: From the image to the workload:
https://github.com/krol3/container-security-checklist
・ Container Security Checklist: From the image to the workload
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(02-28)
