【知識】9月19日 - 每日安全知識熱點
熱點概要：Optionsbleed：HTTP OPTIONS方法可以泄露Apache服務器的內存、CCleaner惡意代碼分析預警、USENIX Security '17 會議視頻、Linux攻擊面分析
國內熱詞（一下內容部分來自：http://www.solidot.org/ ）
CCleanup v5.33 被發現植入惡意代碼
利用 Subsystem for Linux 攻擊 Windows
因 Facebook 的專利條款 WordPress 放棄 ReactJS
資訊類：
警告：CCleaner被黑客植入惡意代碼，超過230萬用戶感染
http://thehackernews.com/2017/09/ccleaner-hacked-malware.html
未打補丁的Windows內核bug可促使惡意軟件繞過殺軟的檢測
http://thehackernews.com/2017/09/windows-kernel-malware.html
技術類：
Fastbin攻擊：堆漏洞利用代碼開發
https://0x00sec.org/t/heap-exploitation-fastbin-attack/3627
CCleaner惡意代碼分析預警
http://bobao.360.cn/news/detail/4327.html
CCleanup被曝存在後門，海量計算機受影響
http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html
Optionsbleed：HTTP OPTIONS方法可以泄露Apache服務器的內存
https://www.exploit-db.com/exploits/42745/
USENIX Security '17 會議視頻
https://www.youtube.com/playlist?list=PLbRoZ5Rrl5leSmnr5gJpvedQ3oj2ostRR
TrickBot如何通過Web注入影響到被攻擊者
https://www.uperesia.com/how-trickbot-tricks-its-victims
docker鏡像更新頻率一覽
https://anchore.com/blog/look-often-docker-images-updated/
Leaked Lists
AWS滲透測試part 1：S3 Buckets
https://www.virtuesecurity.com/blog/aws-penetration-testing-s3-buckets/
Pytosquatting：在PyPI中刪除違規偽裝命名的惡意模塊
https://www.pytosquatting.org/
Linux攻擊面分析
https://anvilventures.com/blog/linux-attack-surface-analysis.html
使用Frequency分析來防禦Office 365
https://blogs.technet.microsoft.com/office365security/using-frequency-analysis-to-defend-office-365/
新型惡意軟件變種"Nyetya"威脅大量計算機
http://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
MinerBlock：A web extension to block web based cryptocurrency miners all over the web.
https://github.com/xd4rker/MinerBlock
Kioptrix: Level 1.2 Walkthrough – Vulnhub
https://www.jimwilbur.com/2017/09/kioptrix-level-1-2-walkthrough-vulnhub/
s2-052 iso鏡像實驗環境
https://pentesterlab.com/exercises/s2-052
Hacking a Pizza Order with Burp Suite
https://privsec.blog/hacking-a-pizza-order-with-burp-suite/
Malicious Chrome extension meddling with your searches
https://blog.0day.rocks/malicious-chrome-extension-meddling-with-your-searches-581aa56ddc9c
debian-sys-maint-roll-passwd
https://github.com/digitalocean/debian-sys-maint-roll-passwd
本文由 安全客 原創發布，如需轉載請註明來源及本文地址。
本文地址：http://bobao.360.cn/learning/detail/4442.html