SecWiki周刊(第243期)
2018/10/22-2018/10/28
安全资讯
[Web安全]  8个成人网站上泄露了120万私密用户数据
https://nosec.org/home/detail/1917.html
[人物]  海康威视总裁胡扬忠:安防市场的虚与实
https://mp.weixin.qq.com/s/7NfXcNC4bEtdT2RJ6vl3Ww
[观点]  信息战部队:美国海军的新型作战力量
https://mp.weixin.qq.com/s/xq2Yoba8UPvZG6Hlv51rNQ
[新闻]  Ex-Dream Market Vendor 'OxyMonster' Sentenced to 20 Years in Prison
https://darkwebnews.com/law-enforcement/20yrs-sentenced-for-oxymonster/
[Web安全]  雅虎数据泄露时隔两年和解,向2亿用户赔偿3.5亿元
https://nosec.org/home/detail/1916.html
[新闻]  DARPA:60岁的“创新偶像”
https://mp.weixin.qq.com/s/xFRR5tJBc2C_SLxOIhlHaw
安全技术
[Web安全]  CTF编码全家桶小程序
https://segmentfault.com/a/1190000016760096
[Web安全]  CTF编码全家桶桌面版
https://github.com/guyoung/CaptfEncoder
[设备安全]  D-Link多型号路由器存在任意文件下载漏洞(CVE-2018-10822)
https://nosec.org/home/detail/1913.html
[Web安全]  攻击面管理策略梳理
https://mp.weixin.qq.com/s/q-5SeJZ9eV9qUXXvzsrSdw
[会议]  安大略湖畔的安全之光——ACM CCS 2018 小记(3)
https://zhuanlan.zhihu.com/p/47333518
[Web安全]  jQuery-File-Upload <= 9.x 远程命令执行漏洞 (ImageMagick/Ghostscript)
https://blog.vulnspy.com/2018/10/23/jQuery-File-Upload-9-x-Remote-Code-Execution-With-ImageMagick-Ghostscript-CN/
[文档]  TenSec 2018 安全议题 ppt 公开
https://paper.seebug.org/726/
[会议]  安大略湖畔的安全之光——ACM CCS 2018 小记(4)
https://zhuanlan.zhihu.com/p/47481683
[数据挖掘]  基于主动学习的异常检测
https://mp.weixin.qq.com/s/wxarbgNuasxaPsZ3Dh4z6g
[Web安全]  安全运维中基线检查的自动化之ansible工具巧用
https://bbs.ichunqiu.com/thread-46896-1-1.html?from=sec
[数据挖掘]  如何玩转网络安全下的深度学习
https://www.leiphone.com/news/201701/RdVHBwh9y0kuvTGJ.html
[恶意分析]  公有云内网威胁检测系统
https://mp.weixin.qq.com/s/-67FpcF3JvZT14M6x-_5Rg
[漏洞分析]  CVE-2018–8414: A Case Study in Responsible Disclosure
https://posts.specterops.io/cve-2018-8414-a-case-study-in-responsible-disclosure-ff74c39615ba
[Web安全]  Linux应急响应(一):SSH暴力破解
https://mp.weixin.qq.com/s/1I0MpWXcyJoe5zGFLnv8gw
[取证分析]  phpStudy 批量入侵的分析与溯源
https://www.anquanke.com/post/id/162787
[新闻]  2018年中国网络安全产业报告
https://mp.weixin.qq.com/s/t54wFWBxA1iKr74LB_KFRg
[Web安全]  Linux应急响应(三):挖矿病毒
https://mp.weixin.qq.com/s/0q1XXqqQZiux3jvrP9zUOg
[数据挖掘]  Twitter 公开俄罗斯伊朗机器人账号的推文存档
https://www.solidot.org/story?sid=58279
[Web安全]  Linux应急响应(四):盖茨木马
https://mp.weixin.qq.com/s/-T9wupsSfW1Q73ocPgvMBg
[恶意分析]  NSA新型APT框架曝光:DarkPulsar
http://www.freebuf.com/articles/network/187424.html
[恶意分析]  来自微信外挂的安全风险
https://xlab.tencent.com/cn/2018/10/23/weixin-cheater-risks/
[数据挖掘]  大规模知识图谱构建与应用
https://mp.weixin.qq.com/s/DlXzTpjLXAIrSmkuM_jDHg
[Web安全]  Platypus 反弹 Shell 构建僵尸网络
https://github.com/WangYihang/Platypus
[Web安全]  ReShellAAS: Reverse Shell as a Service 反弹shell即服务
https://github.com/omg2hei/ReShellAAS
[Web安全]  Linux应急响应(二):捕捉短连接
https://mp.weixin.qq.com/s/tu3c0l_2Bu4kNGqp3tlxKw
[其它]  A profiling method for SSH Clients and Servers
https://engineering.salesforce.com/open-sourcing-hassh-abed3ae5044c?gi=a71f99d6cf2f
[Web安全]  利用C++和C#绕过AV检测
https://xz.aliyun.com/t/3008
[Web安全]  基于时间的高效的SQL盲注-使用MySQL的位运算符
https://xz.aliyun.com/t/3054
[杂志]  SecWiki周刊(第242期)
https://www.sec-wiki.com/weekly/242
[设备安全]  利用硬件性能计数器(HPCs) 检测嵌入式系统中的固件修改
http://www.arkteam.net/?p=4087
[漏洞分析]  深入分析MikroTik RouterOS CVE-2018-14847 & Get bash shell
https://mp.weixin.qq.com/s/6FZqeG3ys2rYpuz7nXr_Lw
[恶意分析]  A Deep Dive into Cobalt Strike Malleable C2
http://threatexpress.com/2018/09/a-deep-dive-into-cobalt-strike-malleable-c2/
[恶意分析]  Dissecting Malicious Office Documents with Linux
https://isc.sans.edu/forums/diary/Dissecting+Malicious+Office+Documents+with+Linux/24248/
[其它]  Available Artifacts - Evidence of Execution
https://blog.1234n6.com/2018/10/available-artifacts-evidence-of.html
[漏洞分析]  二十年以来对 RSA 密码系统攻击综述
https://paper.seebug.org/727/
[移动安全]  iOS渗透测试工具Part 1:App Decryption以及class-dump
http://www.4hou.com/mobile/13188.html
[数据挖掘]  2018达观杯文本智能处理挑战赛 Top10解决方案
https://github.com/moneyDboat/data_grand
[其它]  Focus Training欺诈意识培训和调查培训的课程简介
https://mp.weixin.qq.com/s/4eusVprYSyxjQHR9GpFB3A
[漏洞分析]  WebExec之技术纲要(权限提升&代码执行)
https://xz.aliyun.com/t/3043
[取证分析]  Improve Security Analytics with the Elastic Stack, Wazuh, and IDS
https://www.elastic.co/cn/blog/improve-security-analytics-with-the-elastic-stack-wazuh-and-ids
[Web安全]  Udp2raw-Tunnel:一款功能强大的UDP隧道工具
https://www.freebuf.com/sectool/187069.html
[无线安全]  基于软件无线电对无线领域进行探索
https://cn0xroot.com/2018/10/23/exploring_the_wireless_world_with_sdr/
[运维安全]  SIEM中基于多层网络分析引擎的安全威胁预警研究
https://www.freebuf.com/articles/es/186617.html
[数据挖掘]  基于keras的文本分类实践
http://blog.nsfocus.net/text-categorization-practice-based-keras/
-----微信ID:SecWiki-----
SecWiki,5年来一直专注安全技术资讯分析!
SecWiki:https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第243期)