SecWiki周刊（第56期）
2015/03/23-2015/03/29
安全资讯
[运维安全]  百度统计js被劫持用来DDOS Github
http://drops.wooyun.org/news/5398
[设备安全]  Full Open Source Car Hacking Kit For The Masses
http://www.forbes.com/sites/thomasbrewster/2015/03/25/hack-a-car-for-60-dollars/
[Web安全]  国内漏洞奖励计划大盘点
http://security.tencent.com/index.php/blog/msg/80
[设备安全]  Millions of computers left vulnerable to BIOS chip hack
http://www.welivesecurity.com/2015/03/23/millions-computers-left-vulnerable-bios-chip-hack/
[移动安全]  Study reveals We are being tracked by Our Smartphones
https://www.hackread.com/study-reveals-we-are-being-tracked-by-our-smartphones-every-3-minutes/
[视频]  Fei-Fei Li: How we're teaching computers to understand pictures
http://www.ted.com/talks/fei_fei_li_how_we_re_teaching_computers_to_understand_pictures
[设备安全]  Stealing Data From Computers Using Heat
http://www.wired.com/2015/03/stealing-data-computers-using-heat/
[运维安全]  谷歌发现用于中间人攻击的证书
http://mp.weixin.qq.com/s?__biz=Mjg2NTE4MzUwMA==&mid=203772126&idx=1&sn=0c0c9faafe4e2f83df382baf4f16cf8d&scene=2&from=timeline&isappinstalled=0#rd
安全技术
[移动安全]  列举些Android SDK的国内镜像和相关资源
http://www.xrpmoon.com/blog/archives/jripple1118.html
[Web安全]  websocket-injection:WebSocket 中转注入工具
https://github.com/RicterZ/websocket-injection
[数据挖掘]  大数据分析与机器学习领域Python兵器谱
http://mp.weixin.qq.com/s?__biz=MjM5MTQ4NzgwNA==&mid=202880218&idx=6&sn=6784f6074c5cb3f4d3880890cb0ca802&scene=2&key=79cf83ea5128c3e5a6321fe2b80da0a2f3ad9e27c6fd428c41fb23b425a82bff3aa2dd9aa7c902a3b22a35a041cfa814&ascene=1&uin=MjI2NDkwNDk2MA%3D%3D&de
[数据挖掘]  GTC2015 deep learning session vedio
https://registration.gputechconf.com/form/session-listing&doSearch=true&additional_parameter_selector=none&queryInput=&topic_selector=Machine+Learning+%26+Deep+Learning&type_selector=none
[取证分析]  web日志取证分析工具
http://security.tencent.com/index.php/opensource/detail/15
[编程技术]  Python Programming Tutorials Video
http://pythonprogramming.net/dashboard/
[漏洞分析]  CVE-2014-4487 – IOHIDLibUserClient堆溢出漏洞
http://blog.pangu.io/cve-2014-4487/
[漏洞分析]  BCTF 2015 CamlMaze命題報告及CTF題目鏡像準備方法
http://maskray.me/blog/2015-03-23-bctf-2015-camlmaze
[Web安全]  对JiaThis Flash XSS的挖掘与分析
http://www.leavesongs.com/PENETRATION/jiathis-fso-flash-xss-rootkit.html
[设备安全]  大华监控设备存在弱口令的全网统计报告
http://plcscan.org/blog/2015/03/china-zhejiangdahua-dvr-dvs-global-census-report/
[恶意分析]  Ad-Fraud Malware Hijacks Router DNS – Injects Ads Via Google Analytics
http://aralabs.com/blog/2015/03/25/ad-fraud-malware-hijacks-router-dns-injects-ads-via-google-analytics/
[漏洞分析]  Smart COM Fuzzing - Auditing IE Sandbox Bypass in COM Objects
https://sites.google.com/site/zerodayresearch/Smart_COM_Fuzzing_Auditing_IE_Sandbox_Bypass_in_COM_Objects_final.pdf
[漏洞分析]  honggfuzz:A general-purpose fuzzer with simple, command-line interface
https://code.google.com/p/honggfuzz/
[恶意分析]  揭秘：钓鱼攻击工具包Angler Exploit Kit初探
http://www.freebuf.com/news/special/61942.html
[会议]  IROS 2014 Aerial Open Source Robotics Workshop
http://pixhawk.org/iros2014/proceedings/
[运维安全]  【流量劫持】躲避 HSTS 的 HTTPS 劫持
http://www.cnblogs.com/index-html/p/https_hijack_hsts.html
[编程技术]  MongoDB vs. Elasticsearch: The Quest of the Holy Performances
http://blog.quarkslab.com/mongodb-vs-elasticsearch-the-quest-of-the-holy-performances.html
[Web安全]  easyPass:字典生成和整理工具
https://github.com/he1m4n6a/easyPass
[漏洞分析]  Firefox 31~34远程命令执行漏洞的分析
http://drops.wooyun.org/papers/5350
[数据挖掘]  机器学习的一些通俗易懂的tutorial
http://cn.soulmachine.me/blog/20130327/
[取证分析]  BCTF 2015 - weak_enc Crypto challenge
http://capturetheswag.blogspot.com.au/2015/03/bctf-2015-weakenc-crypto-challenge.html
[Web安全]  Deep Dive Into Stageless Meterpreter Payloads
https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
[恶意分析]  Detection of JavaScript-based Malware
http://research.microsoft.com/en-us/projects/nozzle/
[恶意分析]  Flash in 2015
https://www.fireeye.com/blog/threat-research/2015/03/flash_in_2015.html
[Web安全]  dns recon & research, find & lookup dns records
http://dnsdumpster.com/
[取证分析]  Introducing Elastichoney - an Elasticsearch Honeypot
http://jordan-wright.github.io/blog/2015/03/23/introducing-elastichoney-an-elasticsearch-honeypot/
[Web安全]  XCTF联赛—2015_BCTF_Writeup
http://www.sigma.ws/?p=210
[恶意分析]  Threat Spotlight: PoSeidon, A Deep Dive Into Point of Sale Malware
http://blogs.cisco.com/security/talos/poseidon
[运维安全]  左右互博：站在攻击者的角度来做防护
http://www.freebuf.com/news/special/61508.html
[编程技术]  Adventures in Browser Exploitation: Firefox 32.0 - 35.0.1 RCE
https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636
[文档]  Cisco 2015 Annual Security Report
http://www.cisco.com/web/offers/pdfs/cisco-asr-2015.pdf
[编程技术]  从技术细节看美团的架构
http://www.infoq.com/cn/presentations/see-meituan-architecture-from-technical-details
[其它]  这些年做安全的一点心得
http://weibo.com/p/1001603823512262446951
[移动安全]  Android 签名验证机制
http://riusksk.blogbus.com/logs/272154406.html
[移动安全]  在未越狱的 iPhone 6上盗取支付宝和微信支付的帐号密码
http://drops.wooyun.org/papers/5309
[Web安全]  IE安全系列：IE的自我介绍 （I）
http://drops.wooyun.org/papers/5390
[漏洞分析]  Bypassing Control Flow Guard on Windows 8
https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3/
[移动安全]  Android平台的SQL注入漏洞浅析
http://security.tencent.com/index.php/blog/msg/79
[Web安全]  Unmasked: An Analysis of 10 Million Passwords
http://wpengine.com/unmasked/
[编程技术]  八种最常见Docker开发模式
http://cloud.51cto.com/art/201503/469496.htm
[运维安全]  未来 Docker 的安全
http://weibo.com/p/1001603824370337349167
[移动安全]  PowerSpy: Location Tracking using Mobile Device Power Analysis
http://loccs.sjtu.edu.cn/gossip/blog/2015/03/23/2015-03-23/
[文档]  Cryptographic Backdooring
https://131002.net/syscan.pdf
安全专题
国内NLP相关公司产品
https://www.sec-wiki.com/topic/61
-----微信ID：SecWiki-----
SecWiki，13年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第56期)