Tencent Security Xuanwu Lab Daily News
• GitHub – hardenedvault/vaultboot:
https://github.com/hardenedvault/vaultboot
・ VaultBoot – 下一代固件安全解决方案的开源实现
– Jett
• [Tools] cypress-io/cypress:
https://github.com/cypress-io/cypress
・ Cypress – 浏览器前端自动化测试工具
– Jett
• CobaltStrike Beacon生成原理分析:
https://tttang.com/archive/1631/
・ CobaltStrike Beacon生成原理分析
– lanying37
• Analyzing CVE-2022–22980 to discover a real exploitable path in the source code review process with CodeQL | by Frentzen Amaral | Jun, 2022 | InfoSec Write-ups:
https://infosecwriteups.com/analyzing-cve-2022-22980-to-discover-a-real-exploitable-path-in-the-source-code-review-process-with-145d97717656
・ 用 CodeQL 挖掘 VMware Spring Data MongoDB CVE-2022-22980 漏洞的利用路径
– Jett
• [Malware] Access Denied:
https://www.akamai.com/blog/security/new-p2p-botnet-panchan
・ Panchan – 近期 Akamai 发现的 P2P Botnet，以 SSH 蠕虫的方式渗透 Linux 服务器
– Jett
• Revive: from spyware to android banking trojan | Cleafy Labs:
https://www.cleafy.com/cleafy-labs/revive-from-spyware-to-android-banking-trojan
・ Revive Android 银行木马分析
– Jett
• Release v0.4.0:
https://github.com/rizinorg/rizin/releases/tag/v0.4.0
・ Rizin – 逆向框架 radare2 的 fork 版本，目前更新 0.4.0 版本，支持自动化特征识别、FLIRT 特征生成等特性
– Jett
• [PDF] https://www.usenix.org/system/files/sec21-wang-yan.pdf:
https://www.usenix.org/system/files/sec21-wang-yan.pdf
・ MAZE – 基于 S2E 实现自动化地 Heap Feng Shui 布局
– Jett
• star-sg/NotQuite0day:
https://github.com/star-sg/NotQuite0day
・ 因报告的漏洞被拒绝修复，Starlabs 公开了几个 PoC
– Jett
• Spring Function Cloud DoS (CVE-2022-22979) and Unintended Function Invocation | Checkmarx.com:
https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/
・ Spring Function Cloud DoS (CVE-2022-22979) and Unintended Function Invocation
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(06-28)
