今天给大家介绍的是一款名叫Pacu的开源AWS 漏洞利用 框架，该工具可以帮助广大开发人员检测AWS云环境的安全状况。

在Pacu的帮助下，测试人员可以利用AWS账号中的错误配置漏洞，而且可以通过使用模块的方式来扩展工具的功能。当前的模块支持大量常见的攻击场景，包括用户提权、IAM用户植入后门以及攻击存在安全缺陷的Lambda函数等等。

Pacu是一款轻量级工具，它要求使用python 3.5+，并需要通过pip3来安装其他Python库。运行install.sh之后，脚本会检查你的Python版本，并确保所有的Python包都是最新版本。

git clone https://github.com/RhinoSecurityLabs/pacu

cd pacu

bash install.sh

python3 pacu.py

具体的安装指令，请参考【 安装指引 】。

Pacu首次启动之后，工具将提示用户开启和命名新的会话。这个会话将用来存储AWS密钥对，以及其他通过运行模块收集到的数据。你可以在Pacu中开启各种不同的会话，每一个会话都拥有各自对应的AWS密钥对以及数据集。

模块的使用同样需要AWS密钥，这个密钥会给你提供AWS环境的访问权。如果你在使用中遇到了困难。可以使用help命令来查看可用命令的列表。

1、 大家可以直接通过电子邮件：pacu@rhinosecuritylabs.com上报Pacu的 漏洞信息 ；

2、 Pacu在每一个会话目录中都创建了错误日志，并且还通过全局错误日志来记录主目录下创建的会话错误。如果可以的话，大家尽量把这些日志一起发送给我们。

3、 如果你想添加额外的功能，或者有其他的想法，，可以从【 这里 】告诉我们。

Pacu使用了大量插件模块来协助测试人员在AWS环境下实现数据枚举、权限提升、数据提取、服务漏洞利用和日志篡改等活动。目前，Pacu提供了36种不同的针对AWS的攻击模块，而且我们仍在开发新的功能模块（新模块即将上线）。

为了适应现有的AWS产品环境，我们在开发模块时使用的是常用的语句和数据结构，并且使用了本地SQLite数据库来存储和管理收集到的数据，与此同时，我们尽量减少了API的调用。除此之外，我们还在框架中整合了漏洞报告和攻击审计的功能，可以帮助研究人员完善测试报告。

如果你想开发自己的Pacu模块的话，可以先看看这篇【 指引文档 】，我们强烈欢迎社区的广大研究人员贡献自己的代码！

*参考来源： RhinoSecurityLabs ，FB小编Alpha_h4ck编译，转载请注明来自CodeSec.Net

The U.S. Department of Homeland Security is seeking innovative blockchain-based solutions from startups to prevent the forgery and counterfeiting of digital documents.

Dec. 4.

According to the release, the request has been published under the aegis of DHS’ Science and Technology Directorate (S&T)’s Silicon Valley Innovation Program (SVIP). The call is open to startups or small enterprises that have not had a government contract in the past 12 months (totalling $1 million or more) and that have a workforce of under 200 employees. The release links to a detailed solicitation, entitled “ Preventing Forgery and Counterfeiting of Certificates and Licenses .”

The solicitation outlines that DHS is interested in possible interoperable implementations of blockchain and Distributed Ledger Technologies (DLT) that could serve the “mission needs” of one or more of its programs or components; these include the U.S. Customs and Border Protection (CBP), U.S. Citizenship and Immigration Services (USCIS), and Transportation Security Administration (TSA).

The new SVIP call has been released in partnership with all three the CBP, USCIS, TSA and is purportedly the first SVIP solicitation to support USCIS use-cases. S&T SVIP Technical Director Anil John issued an official statement in the release, outlining that:

Successful participant startups will reportedly receive up to to $800,000 in non-dilutive funding over four phases; the press release notes that participation, however, “does not ensure procurement contracts with DHS or its components.”

As reported this week, DHS issued a pre-solicitation notice for parties to comment and design applications for blockchain forensic analytics in respect to emerging cryptocurrencies . DHS’ proposal called for analytics solutions for privacy-oriented altcoins such as Zcash and Monero in particular.

Vertcoin (VTC) has fallen prey to a 51% attack, with some estimates suggesting losses have already surpassed $100,000 as a result of double spend transactions on the chain. It is the latest example of a 51% attack, where attackers take control of a majority share of a network, reflecting the inherent weaknesses in the proof of work model.

“Failure to meet this requirement breaks several core guarantees of the Bitcoin protocol, including the irreversibility of transactions,” according to Nesbitt.

The attack follows on from several other similar attacks this year, including those affecting MONA, BTG and XVG. According to Nesbitt, this demonstrates the vulnerability of the so-called ‘long tail’ of crypto assets, as well as the weaknesses of the proof of work system.

“These attacks on VTC are not the only examples of a successful 51% double spending attack. 51% attacks occurred in BTG, XVG, and MONA earlier this year; this is merely another incident that shows that threat actors exist that are both resourced and sophisticated enough to execute this kind of attack. This recent spate of successful 51% attacks has significant implications on what is often referred to as the “long tail” of cryptocurrency assets,” he explained.

With attacks of this kind becoming increasingly common, it looks as though more unsuspecting crypto investors will be caught out by investing in insecure tokens.

Note: Tokens on the Bitcoin Core (segwit) Chain are Referred to as BTC coins. Bitcoin Satoshi Vision ( BSV ) is today the only Bitcoin implementation that follows Satoshi Nakamoto’s original whitepaper for Peer to Peer Electronic Cash. Bitcoin BSV is the only major public blockchain that maintains the original vision forBitcoin as fast, frictionless, electronic cash.

铅笔道１２月６日获悉，针对华为公司首席财务官孟晚舟被拘押一事，外交部发言人耿爽表示，“ 中方已就此事分别向加方、美方表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员，切实保障当事人的合法、正当权益。 中美双方应当按照两国元首达成的共识，加紧磋商，争取尽早达成一个互利双赢的协议。”

答：中方已就此事分别向加方、美方提出严正交涉，并表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员，切实保障当事人的合法、正当权益。

答：我刚才已经说过了，中方已就此事分别向加方、美方表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员，切实保障当事人的合法、正当权益。

至于你提到中美经贸磋商的问题，这两天我一直在说，中美双方应当按照两国元首达成的共识，加紧磋商，争取尽早达成一个互利双赢的协议。

答：关于第一个问题，我无法在此讨论涉及到此案的具体细节。

我能告诉你的是，中方获悉相关情况后，第一时间向当事人提供领事协助，并向加方、美方提出严正交涉，要求对方立即对拘押理由作出澄清，立即释放被拘押人员，切实保障当事人的合法、正当权益。

关于第二个问题，有关中美元首会晤，中美双方都发布了消息，建议你查阅。

答：我不掌握你说的情况。中方坚决反对并依法打击任何形式的黑客攻击。如有关方面有相关证据，可以向中方提供，中国有关部门会依法开展调查，但我们坚决反对在网络安全问题上进行无端指责。

众所周知，网络安全是全球性问题，事关各国共同利益，中国是黑客攻击等网络安全威胁的主要受害国之一，也是网络安全的坚定维护者，一直与各方就打击网络犯罪保持着密切合作。我们倡导国际社会在相互尊重、平等互利基础上，通过对话合作共同应对网络安全威胁，维护共同利益。

答：中国作为联合国安理会常任理事国，一贯认真严格执行安理会各项决议。同时，我们反对一国在安理会框架外对他国实施单边制裁，这一立场是一贯的，明确的。

另外，据我了解，华为公司已经发表声明，强调华为遵守业务所在国的所有适用法律法规。建议你查阅一下。

答：我刚才已经说过了。中方已就此案分别向加方、美方表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员，切实保障当事人的合法、正当权益。

同时，相信你也注意到了，华为公司已就此事发表声明。建议你查阅一下相关内容。

答：中方已就此事分别向加方、美方提出严正交涉，表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员。

据我了解，目前，美、加双方均未对拘押理由作出任何澄清。

答：中方已就此事分别向加方、美方提出严正交涉，表明严正立场，要求对方立即对拘押理由作出澄清，立即释放被拘押人员。

答：据我了解，中国驻温哥华总领馆在第一时间向当事人提供领事协助。中方要求加方切实保障中国公民的安全、人道主义待遇及合法权益。在没有给出明确理由的情况下就把人拘押，当然违反了当事人的人权。

另外，刚才我已经说过了，目前，加方和美方均未对拘押理由作出任何澄清。

答：葡萄牙是连接陆上丝绸之路和海上丝绸之路的重要枢纽，中葡开展“一带一路”合作具有天然优势。葡方一直积极支持并参与“一带一路”倡议，双方签署共建“一带一路”合作谅解备忘录，标志着两国在“一带一路”框架下开展合作迈出新步伐，这将为两国和两国人民带来实实在在的利益。明年4月，中方将在北京举行第二届“一带一路”国际合作高峰论坛。此次访问期间，习近平主席邀请德索萨总统出席论坛并对中国进行国事访问，德索萨总统愉快地接受了邀请。

中葡将以签署谅解备忘录为契机，加强发展战略对接，扩大贸易往来和双向投资，推动双边合作优化升级，共同拓展第三方市场，打造新的合作增长点，推动中葡共建“一带一路”取得更多务实成果，为中葡全面战略伙伴关系注入新的强劲动力。同时，我们也愿继续加强“一带一路”倡议同欧盟欧亚互联互通战略对接，为亚欧国家之间的合作提供新动力，为地区以及世界经济的增长开辟新空间。

答：中方对也门问题瑞典和谈表示欢迎，对联合国秘书长也门问题特使格里菲斯及有关各方所作的积极努力表示赞赏。我们希望也门各派以国家和人民利益为重，抓住当前的“机会之窗”，以务实和坦诚的态度展开对话，为早日恢复也门的和平、稳定和秩序创造积极有利的氛围和条件。

答：我刚才说了，我无法在此讨论关于此案的细节。

答：据我了解，李勇浩外相访华相关活动安排主要在明天。活动后，中方会及时发消息，请你届时予以关注。

编辑 | 南柯

优质项目报道通道：创业者请加微信wujinna1015，务必注明项目名称；或发送BP至wujinna@pencilnews.cn。

优质项目融资通道：创业者请加微信jiazongchaopku，务必注明项目名称；或发送BP至jiazongchao@pencilnews.cn。

Key Takeaways Micronaut provides seamless integration with several distributed tracing solutions, such asZipkin and Jaeger Several security solutions are provided "out-of-the-box" with the framework, suchas JWT-based authentications. Micronaut provides features such as “Token Propagation” to ease secure communication between microservices. Thanks to its low memory footprint, Micronaut is capable of running in Function as a Service (FaaS) serverless environments.

In the rst article within this series we developed and deployed three microservices with the JVM-based Micronaut framework. In this second tutorial article we are going to add several features to our app: distributed tracing, security via JWT and a serverless function. Moreover, we will discuss the user input validation capabilities offered by Micronaut.

Breaking our system up into smaller, ne-grained microservices results in multiple benets, but it also adds complexity when it comes to monitoring the system in production.

Micronaut integrates natively with Jaeger and Zipkin -- the top open-source distributed tracing solutions.

An easy way to start Zipkin is via Docker:

$ docker run -d -p 9411:9411 openzipkin/zipkin

The app is composed of three microservices. (gateway,inventory,books) which we developed in therst article.

Modify build.gradle to add tracing dependency:

Add the following dependencies to build.gradle to send tracing spans to Zipkin.

Congure tracing:

Setting tracing.zipkin.sample.probability=1 means we want to trace 100% of request. In production, you probably would want set a lower percentage.

Disable tracing in tests:

That is it. With minimum conguration changes you are able to integrate distributed tracing into Micronaut.

Let us run the app and see the distributed tracing integration action. In the rst article, we integrated Consul for service discovery into our app. Because of this, you need to start both Zipkin and Consul before starting the microservices. When we start the microservices, they will register themselves at Consul service discovery. When we engage them with a request, they will send spans to Zipkin.

To start the microservices, Gradle has a handy ag (-parallel) for that:

./gradlew -parallel run

You can run a cURL command to engage the three microservices:

You can then navigate to http://localhost:9411 to access the Zipkin UI.

Micronaut ships with several security options out of the box. You can congure basic authentication, session based authentication, JWT authentication, Ldap authentication etc. JSON Web Token (JWT) is an open, industry standard RFC 7519 method for representing claims securely between two parties.

Micronaut ships out-of-the-box with capabilities to generate, sign and/or encrypt, and verify JWT tokens.

We are going to integrate JWT authentication into our app.

The gateway microservice will be responsible for generating and propagating JWT tokens.

Modify build.gradle to add micronaut-ecurity-jwt dependency to each microservice ( gateway,inventory and books ):

Modify application.yml :

We have made several important conguration changes which are worth discussing:

With Micronaut, you can use @Secured annotation to congure access at Controller or Controller's Action level.

The AV-TEST Institute recently tested the most popular windows 10 client antivirus products on three primary criteria: protection, performance, and usability. Only six of the 18 products tested earned a perfect rating of 6 for each of those criteria: Bitdefender Endpoint Security 6.6, Kaspersky Lab Endpoint Security 11, Kaspersky Small Office Security 6, Microsoft Windows Defender Antivirus 4.18, and Symantec Endpoint Protection 14.2 and Endpoint Protection Cloud 22.15. The top 14 antivirus offerings shown here in alphabetical order scored at least 17 points out of a possible 18.

The downloadable infographic below summarizes the results, along with earlier test data for Windows 7 and Windows 8. You can drill down on the full results at The AV-TEST Institute's website .

Windows antivirus tools test results

This infographic summarizes tests of Windows client antivirus software conducted by the AV-TEST Institute. The AV-TEST Institute

Avast Antivirus Business 18.5 and 18.6 could have had a perfect score with just a slight improvement on performance and protection. It stopped 99.3 perscent of all zero-day malware attacks, but the biggest issue was with slow-downs when launching popular websites. It was 6 percentage points slower on a standard PC than industry average. Otherwise, it had a perfect score for usability with no false warnings, detections or blockages.

One of five products with perfect scores for protection, performance and usability, Bitdefender Endpoint Security stopped all zero-day malware web and email attacks tested, and all malware discovered in the last four weeks. Performance degradation when using applications and websites was minimal and in some cases better than industry average. For the latest round of tests, the product gave no false positives.

The results for Bitdefender Endpoint Security Elite are nearly identical to those of the standard Bitdefender product. The main difference was in some insignificant differences in a few performances tests.

A newcomer to the top 10 list, ESET Endpoint Security detected all malware discovered in the last four weeks and 99.3 percent of all zero-day malware attacks. It did well in most performance tests, although it was six percentage points slower than industry average installing frequently used programs and 11 points slower copying files. It had no false warnings or blockages, and it did not flag any legitimate software as malware.

PSB Computer Protection would have had perfect scores in all categories, except it slowed copying files locally or on a network more than industry average. A few percentage points improvement would have earned it a full 6 rating. The software did flag one legitimate program as malware during a system scan.

Except for some performance issues, G Data AntiVirus Business would have been among the elite products with perfect scores. It slowed the following actions morer than industry average: launching popular websites, launching standard applications, installing frequently used applications, and copying files locally or in a network. The software stopped 99.3 percent of the 311 zero-day malware samples used in the test, but detected all 21,257 malware samples discovered in the last four weeks.

With its nearly perfect scores across the board, Kaspersky Endpoint Security continues its run in the top tier of anti-malware products. It stopped 100 percent of all zero-day and known attacks tested. On the performance side, the product had minimal impact on the launching or installation of websites or applications. It did flag one out of more than 1.3 million legitimate software samples as malware.

Kaspersky Small Office Security scored similarly to the company’s endpoint protection product. It had a slightly higher impact on website launches. It also falsely flagged one legitimate software sample as malware.

For protection and usability, McAfee Endpoint Security ranks with the best of its competitors. However, it falls a little short on performance, particularly during launch or installation of software. The McAfee product slowed launching standard applications by 32 percent, well above the industry average of 13 percent. It was worse during installation of frequently used applications―46 percent slower. The industry average there is 31 percent.

Performance is all that holds back Microsoft Windows Defender Antivirus from elite status..In most performance categories, the product is faster than or nearly the same as industry average times. However, it slows installation of frequently used applications by 85 percent on a standard PC, nearly three times industry average. It detected 99.3 percent of zero-day attacks and all malware discovered in the last four weeks.

Contributed article from Edward Amoroso ( @hashtag_cyber )

I love to ask tech start-up founders what it was that prompted formation of their business. I’m usually listening to see if they are driven by some deeply-held personal belief (good answer) or by some greedy, near-term revenue growth objective (bad answer). I also listen for that wonderful moment when the spark was lit in the founder’s mind to hang out a shingle. Such inspiration is infectious, and usually drives customers to hop aboard.

When I asked this question to Brian Hazzard, co-founder of cyber security company Randori , his answer was indeed memorable: “My team at the time was using a guy named Moose to hack our systems,” he explained. “We noticed that every time Moose gave us a once-over, our security improved dramatically. So, I decided to partner up with Moose to create a company that would automate this red team process and the result is Randori.”

The Moose, of course, is Randori co-founder David Wolpoff, and it is from his LinkedIn profile that I pulled that awesome term at the top of my post: Thaumaturgic . Its Merriam-Webster definition is “performing miracles,” and in the context of expert penetration testing and white hat engagements, it seems a relevant term and one that potential Randori customers are likely to remember. Welcome to awesome Cyber Marketing 101.

What Randori does involves the automation of penetration testing using a platform that identifies and scans a customer’s attack surface for vulnerabilities. In the early days of simple white hat projects, this was a straightforward activity. But in today’s evolved enterprise ecosystem with remote access, third-party portals, mobile infrastructure, shadow IT, cloud services, and on and on locating an enterprise attack surface is easier said than done.

“Our cloud-hosted platform basically allows us to launch attacks on our customer’s infrastructure,” explained Wolpoff, “and we can be creative to locate unknown systems and other subtle vulnerabilities that a normal penetration testing process might not notice. And the automation allows us to provide continuous assessment in a way that would be challenging by a team of humans.”

I asked Wolpoff how the Randori platform stacks up against bug bounties, especially ones that employ automated platform support and he responded that Randori is designed to complement such crowd-based focus. I also asked how Randori stacks up against automated attack simulation platforms and his answer was the same: “We enhance the overall security ecosystem,” he replied, “even if pen testing, bug bounty, and simulation are present.”

The company was founded in February of 2018, so it remains a toddler, but I must say that it comes with some powerful supporters and advisors. My friend Stewart Baker, for example, serves on their Advisory Board, as do Patrick Morley from Carbon Black, and Mike Convertino from Twitter. It would be a real challenge finding higher quality cyber security veterans than that to offer guidance.

So, if you are in the market to complement your overall assurance program with an automated platform that will attack you from the cloud, then give a call over to David Wolpoff, and ask to hear the Randori story. And maybe you’ll be lucky enough to spend some time with Moose as well. Tell him you were inspired by his reference to Thaumaturgic security and perhaps Randori will work miracles for you.

As always, please share with us what you learned.

About the Author

Dr. Ed Amoroso is currently Chief Executive Officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, beginning in Unix security R&D at Bell Labs and culminating as Senior Vice President and Chief Security Officer of AT&T from 2004 to 2016.

Trustology has raised $8 million in a seed investment for technology and services to help private and institutional investors make sure that their digital assets are safe.

The money comes from Two Sigma Ventures and ConsenSys. The latter helped incubate London-based Trustology.Both investors will be joining Trustology’s board of directors.

Trustology’s first product,TrustVault, combines private key protectionagainst cyber and physical threats with low latency execution. The company said it can safeguard private keys andcontrol code inside tamper-proof, programmable hardware security modules hosted in securedatacenters, with encrypted backups in the cloud.

“Key safeguarding is the catalyst for the world’s transition to digital assets and an inclusive shiftfor the internet economy,” said Trustology CEOAlex Batlin in a statement. “Trustology’sunique blend of people, process, and key management technology offers industry definingdigital asset security with speed of access and unrivalled ease of use. Trustology aspires to bethe digital trust brand of the future.”

The company’s team has more than 100 years of combined global banking and technology expertise.Batlin formerly ledblockchain innovation work at UBS AG and BNY Mellon and was a founding member of theEnterprise Ethereum Alliance, Trusted IoT Alliance, Utility Settlement Coin and R3 consortium.

Other team members include former executives from ADIA, Bank of America Merrill Lynch,Barclays, BNY Mellon, Curve, Deutsche Bank, Goldman Sachs, RBS, Starling Bank, and UBS.

“ConsenSysinvests in solutions that elevate ― and work toward integrating ― the blockchain ecosystem, providing individuals and institutions with the tools needed to transition from legacy systems to a world built on decentralised infrastructure,” said Joseph Lubin, ConsenSys founder and Ethereum cryptocurrency cofounder, in a statement. “Trustology has developed breakthroughs in keymanagement and is providing support services to clients seeking unparalleled safeguarding fordigital assets. By prioritizing security without the need to sacrifice accessibility, Trustology willserve current digital asset holders and attract new institutional and individual investors to thespace. Trustology represents a profound technological piece that will move the needlenoticeably on institutional adoption of digital assets. And the world-class Trustology team hasthe pedigree to drive these discussions.”

Trustology will use the money to develop new capabilities, like smart accounts withprogrammable controls; support additional asset classes; and expand its operationsinternationally. The company is currently bringing on selected clients for beta tests.

SALT LAKE CITY (BUSINESS WIRE) #Cybersecurity ― Venafi ,

the leading provider of machine identity protection, and DigiCert, the

world’s leading provider of TLS/SSL, IoT and other PKI solutions, today

announced a new, deeper integration that simplifies and automates

complex machine identity programs for the world’s most demanding,

security-conscious organizations. The combined solution enables

organizations to customize and orchestrate public key infrastructure

(PKI) and machine identity protection at machine speed and scale.

“The rapid adoption of DevOps, microservices, cloud, and IoT requires a

new level of technical sophistication and innovation to deliver

protection for all machine identities,” said Kevin Bocek, vice president

of security strategy and threat intelligence for Venafi. “The Global

5000 are looking for a certificate provider that tightly integrates with

the Venafi Platform and provides them with the confidence of a complete

solution. DigiCert is the leading CA of choice for large enterprises.” (1)

The integrated solution leverages DigiCert’s industry-leading, globally

dispersed, modern OCSP infrastructure and a deep API integration with

Venafi’s industry-leading machine identity protection platform. The new,

adaptable driver allows customers to access a rich set of new features

from DigiCert CertCentral. Mutual customers can customize specific

features, from fully automating certificate provisioning to enforcing

internal policies, allowing them to easily address industry regulations

such as PCI DSS, HIPAA and GDPR as well as the most demanding use cases.

The integrated solution also simplifies the integration of machine

identity protection across a wide variety of systems and allows

customers to fulfill high-value certificate requests in seconds. Venafi

solutions support the most popular CertCentral features out-of-the box.

“DigiCert enjoys a long-standing history of collaboration and

integration with Venafi, and we share mutual enterprise customers that

benefit from their robust platforms and services,” said Dan Timpson,

chief technology officer to DigiCert. “In an era when enterprises face

increasing threats from a growing landscape of connected devices and

agile deployments, Venafi provides leading solutions for addressing

machine identity and digital certificate management. We are looking for

additional ways to work together to support enterprise customers.”

Key features of the integration include:

For more information please visit:

1. DigiCert maintains the largest market share for the Alexa Top 1000 as

measured by Datanyze. https://www.datanyze.com/market-share/ssl/Alexa%20top%201K/

About DigiCert, Inc.

DigiCert is the world’s leading provider of scalable PKI solutions for

identity and encryption. The most innovative companies, including the

Global 2000, choose DigiCert for its expertise in identity and

encryption for web servers andInternet of Thingsdevices. DigiCert

supportsTLS/SSLand other digital certificates for PKI deployments at

any scale through its certificate lifecycle management

platform,CertCentral. The company has been recognized with dozens of

awards for its enterprise-grade management platform, fast and

knowledgeable customer support, and market-leading growth. For the

latest DigiCert news and updates, visit digicert.com

or follow @digicert .

About Venafi

Venafi is the cyber security market leader in machine identity

protection, securing machine-to-machine connections and communications.

Venafi protects machine identity types by orchestrating cryptographic

keys and digital certificates for SSL/TLS, IoT, mobile and SSH. Venafi

provides global visibility of machine identities and the risks

associated with them for the extended enterprise on premises, mobile,

virtual, cloud and IoT at machine speed and scale. Venafi puts this

intelligence into action with automated remediation that reduces the

security and availability risks connected with weak or compromised

machine identities while safeguarding the flow of information to trusted

machines and preventing communication with machines that are not trusted.

With 31 patents currently in its portfolio, Venafi , delivers innovative

solutions for the world’s most demanding, security-conscious Global 5000

organizations, including the top five U.S. health insurers; the top five

U.S. airlines; four of the top five U.S., U.K., Australian and South

African banks; and four of the top five U.S. retailers. Venafi is backed

by top-tier investors, including TCV, Foundation Capital, Intel Capital,

QuestMark Partners, Mercato Partners and NextEquity. For more

information visit: www.venafi.com .

Contacts

Media Contacts:

Venafi

Shelley Boose

shelley.boose@venafi.com

Black HatCrafty infosec researchers have figured out how to remotely set answers to windows 10’s password reset questions “without even executing code on the targeted machine”.

Thanks to some alarmingly straightforward registry tweaks allied with a simple python script, Illusive Networks’ Magal Baz and Tom Sela were not only able to remotely define their own choice of password reset answers, they were also able to revert local users’ password changes.

Part of the problem is that Windows 10’s password reset questions are in effect hard-coded; you cannot define your own questions, limiting users to picking one of Microsoft’s six. Thus questions such as “what was your first’s pet name” are now defending your box against intruders.

The catch is that to do this, one first needs suitable account privileges. This isn’t an attack vector per se but it is something that an attacker who has already gained access to your network could use to give themselves near-invisible persistence on local machines, defying attempts to shut them out.

The Windows registry, said Baz and Sela, stores items such as the local machine and service users’ passwords within the well-known LSA Secrets entry, which is so secret and secure that even Microsoft Technet bloggers offer step-by-step Powershell guides to examining their contents, which are encrypted. Inevitably, there is a way round that.

Baz told his Black Hat presentation’s audience: “The important thing to understand about how it’s encrypted is that in order to assemble the AES key with which the LSA secrets are encrypted, you need to collect artefacts from the registry on that machine. So if you have full access to the registry on the machine, it’s really not that difficult to get the key with which you can rewrite LSA Secrets.”

Working on the “lucky” assumption that the elevated-privs account they were using for their proof-of-concept test was able to edit local access control lists, the two gave themselves read/write permissions, with Baz adding: “If you want to locate the secret you find the registry key through the format L, for local; SQSA, which stands for security question and security answer; and the GUID of the user to whom the questions belong.” The actual Q&A data was stored as JSON.

Opening a remote desktop session to the target machine gives you the standard Windows logon screen. “Nowadays… if you look at it closely you won’t see a reset password button,” said Baz, who went on to demonstrate a method of bypassing this security protection by forcing the remote desktop session to “fall back to non-network level authentication”.

“Luckily,” said Baz, “as an RDP client you can say you do not support NLA. Thus you can ask the server to give you back the old Windows logon screen with the password reset option”. He and Sela simply created an RDP file with the appropriate flag set.

Once they had obtained access to the standard password reset screen, the two then looked into persistence. It is no good having local access if a suspicious user simply changes his password. But what if you can revert that password back to your known one? “It’s pretty simple, luckily,” said Baz.

“In order to prevent people from reusing their passwords, Windows stores hashes of the old passwords. They’re stored under AES in the registry. If you have access to the registry, it’s not that hard to read them. You can use an undocumented API and reinstate the hash that was active just before you changed it. Effectively I’m doing a password change and nobody is going to notice that,” he continued, explaining that he'd used existing features in the post-exploitation tool Mimikatz to achieve that.

As for protecting against this post-attack persistence problem? “Add additional auditing and GPO settings,” said Sela. The two also suggested that Microsoft allows custom security questions as well as the ability to disable the feature altogether in Windows 10 Enterprise. The presentation slides are available here ( PDF ).

Sponsored: Five steps to dealing with the insider threat

In today’s cryptocurrency market, there are a wide variety of wallets available. However, one brand, in particular, has managed to set itself above the others. It is considered by many as the number one wallet in terms of safety, innovation, and reliability.

Trezor is a company preferred by many experts and is the wallet of choice by businesses of all sizes. It is also perfect for individuals who want to protect their investments with an extra layer of security.

Let’s take a look at two models offered by Trezor: The Model T and the Trezor One . The Model T is the most recent wallet released by Trezor, while the Trezor One was the first one available. Let’s take a look at these two wallets, along with how they compare with one another. This might give you an idea of which one suits your needs.

The Model T offers a stylish black finish with a nice sized 240 x 240 LCD. Through the LCD, you can manipulate and configure the wallet as needed. The sleek design of the Model T makes it more appealing than its counterpart as it gives off a finished and refined vibe. Additionally, the touchscreen available with the Model T creates another layer of security.

The Trezor One , on the other than, is made of plastic. Therefore, this wallet is resistant to falls and shocks. Included on the Trezor One are two buttons which allow you to operate the device. The 128 x 64 OLED is not a touchscreen. You can get the Trezor One in either white or black colors.

The Model T comes in a well-designed box which can be used for storage purposes. Additionally, the box comes with a security seal in place, so you can be sure that it has not been opened. You’ll get a power cable and two cards for the recovery seed, and the instruction manual.

Trezor can handle over 500 cryptocurrencies, which include Bitcoin, Ethereum, Litecoin, Dash, Zcash, and many others. If you need a wallet that handles more digital currencies, then you’re better off going with the Model T . Trezor will provide an update which will allow for the support of more cryptocurrencies, including Cardano, Monero, Ripple, and Tezos.

To use your hardware wallet, you’ll need software which allows you to manage it. It will need to send cryptocurrencies, generate addresses, and view the details of your account. Trezor has developed an online software which you can download without issue so you can manage your wallet.

Not only that, but you can also connect with other wallets like Mycelium, MyEtherWallet, Greenbits, and Electrum. Additionally, you can work with exchanges like Bitex, Bitstamp, and Coinmap.

Both the Trezor One and the Model T are compatible with the online software. You’ll also discover that both work with iOS, linux, windows, and Android applications.

Depending on your level of comfort, the installation for both the Model T and the Trezor One is relatively straightforward. Set up should take no more than ten minutes if you follow the guide. Visit the Trezor website and you’ll discover an assistant which will guide you through the entire process.

Download the Trezor software and connect your wallet to verify that you have the latest firmware version. Once that’s complete, you’ll create a new wallet and then a backup. When initial configuration finishes, you’ll want to write down your recover seeds.

Make sure you write these words down as they are your saving grace if your device gets damaged, lost or stolen. When you have your recovery seeds in a safe place, put a unique name on your wallet so you can identify it.

Last, enter a PIN only you’ll remember so that no one else can physically access your device. You’ll be asked to enter this PIN anytime you turn on or want to access your wallet. If it is entered incorrectly more than three times, the information stored on the wallet gets deleted.

That’s it. Now your Trezor wallet is all set up. The on-screen software should show up which will let you use your wallet.

Trezor devices work with the vast majority of operating systems. You’ll have no trouble with Windows, iOS, Linux, MacOS, or Android. There are also Chrome extensions available if needed.

Trezor’s user interface gives users the option to change the language and watch transactions via its screen. Both the Model T and the Trezor One connect via a USB cable.

The Model T offers more features than the Trezor One , as it provides a touchscreen interface, as well as a microSD slot. This gives users the ability to manage passwords from the memory card as opposed to only having them available via the cloud.

You can also manage multiple funds from the same account by creating several wallets. You can view transactions, sign and record messages, or send transactions, all in a .csv format. Both the Model T and Trezor One are safe and versatile wallets so you don’t have to worry about the safety of your investments.

The Model T is a very user-friendly device. Whether you’re a novice or an expert, you’ll find this wallet easy to use while performing secure transactions. Both the Model T and Trezor one are very secure, which keeps them safe from hackers or other malicious attacks. It’s critical that you protect your cryptocurrency investments.

Overall, both of these Trezor devices are simple and easy to use. The Model T does have a few improvements over the Trezor One , but you’ll pay more for those features. Of course, Trezor has done its research and make its devices better, which is why there is now a newer option available on the market.

Trezor wallets are an easy and secure method through which you can store your cryptocurrencies. The Model T does a great job of providing new and exciting features. You’ll get a new touchscreen, a cleaner, sleeker design, and of course the security for which Trezor devices are known for.

However, keep in mind that the Model T is quite a bit more expensive than the Trezor One. Improvements have been made to the Model T , but the overall operation of the wallet is still basically the same. You’ll have to decide if the increase in price is worth the features.

If you have significant cryptocurrency investments, then the price may be well worth it to have a newer, fresher, model. On the other hand, if your budget is limited, then you might be better off sticking with the Trezor One . The One model will meet your expectations by safeguarding your cryptocurrencies.

Trezor is and has been at the forefront of hardware-based cryptocurrency wallets. This means that no matter whether you go with the Trezor Model T or the Trezor One , you know you’re getting a wallet that will ensure the safety of your coins.

GET YOURSELF A TREZOR NOW!

Image Source: “Flickr, Steemit, Trezor”

This is a simple intro to relay attacks using NFC payment data. I will add different types of relays during next year.

A NFC payment relay is an attack that could be described as extraction of data, using a bridge between a NFC smart card or mobile payment system and the Point of Sale System(PoS) or terminal in real time. Extracting the information and making a bridge while avoiding the latency are the most important and challenging parts.

I already post different introductory content about NFC technology:

Eddie Lee presented in DEF CON 20 about how to design a NFC relay using two Android cellphones . The idea is to generate a bridge using 2 Android phones as you can see in the above image.

The phone 1 is close to the NFC card and the phone 2 is close to the terminal. When the phone 2 approaches the terminal, it mimics a NFC card and the terminal initializes the communication process. Any time when the terminal sends a command to the phone 2 asking about what type of card it is, the phone 2 sends that data over WiFi to the phone 1 and this phone “asks” the smart card the same question. The card answers and phone 1 takes that information and sends it back to phone 2 which responds to the terminal. Using this behavior throughout the communication process. Basically, phone 1 acts as reader and phone 2 as smart card. Simple right?

In DEF CON 25, Haoqi Shan and Jian Yuan presented Man in the NFC implementing two special boards with SDR(Software Defined-Radio) technology to established a dedicated connection to communicate the NFC information faster and with a better control than using cellphones in the same WiFi network.

The main difference between a relay attack and replay attack is that the relay attack has to be done at the moment when the attacker is extracting the data; in the other hand, the replay attack occurs when an attacker extract the information from a transaction and save it to replay it later using a third-party device.

With this in mind, we know that we need at least two devices to approach this project, and they could be from different technologies that support NFC:

Even we can combine them to make a relay. For the communication part, we have different options:

To understand the concept, I will start with a “local” relay using two Acr122u USB devices connected in the same computer by USB. One of them will act as PoS, and the second will mimic a smart card. All the connections will be handle by a python script, and my laptop will be the bridge between them:

The idea of this concept is to understand how to design a simple NFC sniffer. To read, see and study the NFC tags. With this design, I can track the communication process without making a real transaction. However, be aware that the ATC(Application Transaction Counter) will increase during this process.

To accomplish this task, the easier and simpler software to use is the library of RFIDIot . Specifically, I will use the pn532mitm.py script. In its help section, we can find different examples to run the code when we have two or more Acr122 connected to our computer or even to run it remotely:

In this video, I run the command:

Being 0 the first reader and 1 the emulator:

We can play with the code to alter the data in real time which is one of the most useful things for relay attacks. Also, we can copy the APDU commands in a decoder to know the meaning of the tags using https://www.emvlab.org/tlvutils/

操作系统内核是每个漏洞利用链的最终目标，大家可以查看Zero Day Initiative (ZDI) Pwn2Own历年比赛，了解这方面内容。windows内核一直以来都是攻击者热衷的目标，我最喜欢的就是滥用 DeviceIoControl 调用来与各种驱动打交道，这样就能访问许多厂商编写的各种驱动，其中许多驱动代码写得并不完善，也没有经过完备测试。

多年以来，许多攻击者都借助 win32k.sys 来攻击Windows内核，这是一个内核模式设备驱动，可以控制Windows图形及窗口管理系统。当微软将该功能从CSRSS中迁移到内核时，进入Windows内核的攻击面也增加了1倍或者3倍，从那时起这已经成为许多漏洞的发源地。

在过去十年期间，自从WDDM（Windows Display Driver Model）取代早期的XDDM后，大家又找到了另一个巨大的攻击面。显示系统调用操作首先会经过 win32k.sys 处理，但在此之后，用户进程就可以直接调用 dgxkrnl.sys ，或者通过 GDIPlus 中的入口点直接调用其他驱动。这进一步扩大了攻击面，因此引起了研究人员的浓厚兴趣。

2018年春季，ZDI从腾讯ZhanluLab的ChenNan及RanchoIce手中购买了5个针对DirectX内核接口的漏洞，利用这些漏洞成功从微软获取了4个CVE编号。本文分析了这些漏洞，并且提供了相应的PoC代码（代码已在我们网站上公布）。

此外，Rancho和ChenNan在9月份的44CON会议上介绍过其中一种攻击技术（ZDI-18-946/CVE-2018-8405），强烈建议大家去学习此次演讲的 演示文稿 。

在分析漏洞之前，我们首先来简要回顾一下DirectX接口及驱动。

DirectX图形内核子系统由3个内核模式驱动所组成： dxgkrnl.sys 、 dxgmms1.sys 以及 dxgmms2.sys 。这些驱动会通过 win32k.sys 以及自己的接口来与用户通信。此外，这些驱动也会与 BasicRender.sys 、 BasicDisplay.sys 以及miniport（微型端口）显示驱动通信。

DirectX定义了许多复杂的内核对象，大部分对象名以 DXG 开头。用户通过许多复杂的API接口与DirectX交互，其中许多接口以 D3DKMT 开头，其他接口以 DXGK 开头。

其中比较有趣的部分入口点如下所示：

从攻击角度来看，来自IOActive的Ilja van Sprundel曾在2014年的Black Hat会议上做过关于WDDM的一次演讲，题目为“ Windows Kernel Graphics Driver Attack Surface ”，这是非常好的概述资料。强烈推荐大家先参考这份材料，其中详细介绍了有关WDDM内核方面的复杂攻击面。

大家可以访问 此处 下载PoC源代码。如果大家想复现崩溃问题，需要安装2018年8月份之前的Windows版本（当时Windows还没打上补丁）。在测试过程中，记得将内核调试器attach目标主机上，并在待攻击的驱动上设置Special Pool（特殊池）。我已在Windows 10 x64位系统上测试过本文分析的这些漏洞。

我们分析的第一个漏洞位于 dgxkrnl.sys 的 DXGDEVICE::CreateAllocation 方法中，可通过 D3DKMTCreateAllocation 接口触发，本地攻击者可以利用该漏洞将权限提升到 SYSTEM 级别。大家可以访问 此处 阅读我们的安全公告，访问 此处 获取微软补丁。漏洞根源在于驱动没有正确验证用户提供的数据，导致存在类型混淆情况。

为了复现漏洞，我们需要在运行PoC之前在 dxgkrnl.sys 上设置一个Special Pool。类型混淆问题源自于在pool分配中没有正确使用 CrossAdapter 标志。在pool分配过程中，PoC代码将 CrossAdapter 标志设置为 0 ，然后将所得句柄传递给第2个分配过程，其中 CrossAdapter 标志被设置为 1 。

蓝屏信息分析如下：

错误代码位于 DXGDEVICE::CreateAllocation ，这是一个在分配过程结束时的一个典型的类型混淆问题：

下一个漏洞位于 dxgmms2.sys 驱动中，可通过 D3DKMTRender 方法触发。攻击者同样可以利用这个漏洞将权限提升到 SYSTEM 级别。大家可以访问 此处 了解我们的安全公告，访问 此处 获取相应补丁。与第一个漏洞一样，这个bug会导致出现类型混淆情况。虽然本质上相似，但这些bug的根本原因并不相同。

同样，我们需要在 dxgkrnl.sys 和 dxgmms2.sys 上启用Special Pool才能复现bug，当然我们也需要将内核调试器attach到目标主机。这个类型混淆源自于两个不同适配器之间混乱的分配操作。

相关PoC代码如下：

PoC崩溃细节：

存在漏洞代码如下：

这个漏洞同样可以由 D3DKMTRender 例程触发。漏洞位于 dxgkrnl.sys 的 DGXCONTEXT::ResizeUserModeBuffers 方法中。大家可以访问 此处 了解我们的安全公告，访问 此处 获取微软补丁。由于驱动在将用户提供的值作为指针解析引用（dereference）时，并没有正确验证这个值，因此导致这个bug出现。出现指针dereference问题，是因为驱动会信任用户设置的一个标志。相关PoC细节如下：

导致出现崩溃现象：

调用栈：

存在漏洞的代码：

显然，用户提供的标志本不应该导致内核中出现任意dereference问题。

最后一个漏洞稍微有点复杂，漏洞位于 BasicRender 驱动对 D3DKMTMarkDeviceAsError API以及 D3DKMTSubmitCommand API的处理过程中。大家可以访问 此处 阅读我们的安全公告，访问 此处 下载微软补丁。这个漏洞中，共享资源并没有得到适当的保护，可能导致出现内存破坏问题。攻击者可以利用这个漏洞将权限提升为 SYSTEM 级别。恶意软件经常使用这类权限提升方法，在用户不小心点击某些东西的时候将自己安装到目标系统中。需要注意的是，微软为这个bug和 ZDI-18-949 分配了同一个CVE编号，表明这两个漏洞的根本原因相同。

这两个漏洞的PoC代码存在相关性，但有所区别。

第一个PoC的关键代码如下：

每次调用 SubmitCommand 时都会通过 VidSchiWorkerThread 生成一个线程。调用 MakeDeviceError 会修改相同对象的状态，导致出现竞争条件。

最终会出现崩溃：

对同一个位置有两次修改，出现竞争条件：

对于 ZDI-18-949 ，虽然漏洞根源一样，但我们还是可以在PoC代码中看到不同之处。PoC中关键代码如下：

执行这个PoC会导致 Run 方法崩溃：

存在漏洞的代码如下：

存在漏洞的代码会在第二次运行 Run 时崩溃。

WDDM以及DirectX图形内核代码使用了许多复杂对象、为用户代码创建许多新的复杂接口，从而为Windows提供了非常强大和灵活的图形系统。分析前文提供的PoC后，大家应该对DirectX在对象实现上的复杂度以及未来该领域可以研究的方向有所了解，我认为该领域还有许多尚未挖掘的财富。

通过直接静态分析方法，我们还是可以获取一些攻击信息，然而这肯定是一项艰巨的任务。还有一种可能采取的方法，我们可以部署一个模糊测试框架，在不同的标志上设置不同的值，然后以不同的顺序来调用DirectX方法，查找崩溃点。当然，我们也可以添加多个线程修改及释放数据，来寻找是否存在竞争条件和TOC/TOU问题。另外别忘了在所有相关驱动上设置Special Pool。

老生常谈，Zero Day Initiative对新漏洞非常感兴趣，当大家发现新漏洞时，可以通过推特（ @FritzSands ）联系我，也可以关注我们团队的 推特 获取最新漏洞利用技术和安全补丁信息。

这个除了查看错误信息、打印调试信息(console.log())、写一些测试脚本以外，还可以当作 javascript API 查看用。例如我想查看 console 都有哪些方法和属性，我可以直接在 console 中输入"console"并执行

判断第一个参数是否为真，false 的话抛出异常并且在控制台输出相应信息。

清空控制台。

console.count()

以参数为标识记录调用的次数，调用时在控制台打印标识以及调用次数。

console.countReset()

与 console.count()配合，清除调用次数。

打印一条错误信息，使用方法可以参考 string substitution。

打印树状结构，配合 groupCollapsed 以及 groupEnd 方法;

console.groupCollapsed()

创建一个新的内联 group。使用方法和 group 相同，不同的是 groupCollapsed 打印出来的内容默认是折叠的。

与 console.group()配合使用，结束当前 Tree

console.info()

打印以感叹号字符开始的信息，使用方法和 log 相同

打印字符串，可以使用 printf 风格的占位符。支持字符（%s）、整数（%d 或%i）、浮点数（%f）和对象（%o）四种。

例如：console.log("%d 年%d 月%d 日",2011,3,26);

console.profile()

可以以第一个参数为标识，开始 javascript 执行过程的数据收集。和 chrome 控制台选项开 Profiles 比较类似，具体可参考 chrome profiles

console.profileEnd()

配合 profile 方法，作为数据收集的结束。（暂时未发现结果）

计时器，接受一个参数作为标识。

与 console.time()配合使用，接受一个参数作为标识，结束特定的计时器。

console.trace()

打印 stack trace.

打印一个警告信息，使用方法可以参考 string substitution。

左侧有用筛选项，可分类显示

实际操作过程中发现 $()并没有按预期返回相匹配的第一个元素，而是返回了所有匹配的元素数组

主要用来查看源代码以及调试 js

断点可以在DOM元素节点发生改变时、XHR生命周期状态改变时、指定的事件执行时被触发

从发起网页页面请求 Request 后分析 HTTP 请求后得到的各个请求资源信息（包括状态、资源类型、大小、所用时间等），可以根据这个进行网络性能优化。

此面板包括5块:

区域① Controls信息如下

区域④ Requests Table 信息如下

未列出部分，可在区域④的表头部分右击点出

区域⑤ Summary 信息如下

通过点击某个资源的 Name可以查看该资源的详细信息，显示信息如下

查看页面性能的，较为复杂~~~暂不讨论

查看页面性能的，较为复杂~~~暂不讨论

记录网站加载的所有资源信息，包括存储数据（Local Storage、Session Storage、IndexedDB、Web SQL、Cookies）、缓存数据、字体、图片、脚本、样式表等。

判断当前网页是否安全，通过该面板你可以去调试当前网页的安全和认证等问题并确保您已经在你的网站上正确地实现HTTPS。

HTTPS（Hyper Text Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加入SSL层，HTTPS的安全基础是SSL，因此加密的详细内容就需要SSL。 它是一个URI scheme（抽象标识符体系），句法类同http:体系。用于安全的HTTP数据传输。https:URL表明它使用了HTTP，但HTTPS存在不同于HTTP的默认端口及一个加密/身份验证层（在HTTP与TCP之间）。

HTTPS和HTTP的区别主要为以下四点：

该课题由独角兽安全夏令营第二届学员黄瑞同学完成

360无线电安全研究院每年暑假都会面向在校学生举办一次暑期训练营，申请者投递简历并提交自己想做的课题介绍后，若入选，会在360技术专家的指导下完成课题。

本系列文章会发布今年5位学员在训练营中的成果。文章相关代码后续会在 训练营github代码仓库 发布 。

从骨干路由器、交通信号灯到家用调制解调器和智能冰箱，嵌入式设备在现代生活中的应用越来越多。嵌入式设备固件的数量也增长到难以计量。安全人员曾经在这类设备上发现很多高危安全漏洞。相比挖掘新漏洞，在这些固件中扫描出已经在其他设备上发现或者是开源代码中发现过的漏洞，也非常重要。

因此，我们需要一种有效的解决方案来搜索固件中的漏洞。 由于各种设备供应商使用了各种不同的处理器架构和独特的工具链，以及固件的高度定制特性，在固件搜索漏洞代码片段极具挑战性。

我们尝试解决的问题是：检测采用不同指令集的二进制固件中，是否使用过包含有特定漏洞的代码片段。我们阅读了一些二进制搜索的学术论文，并实现了验证平台，针对这个目标做了一些改进，识别准确性取得了提高。

本文总结了在阅读分析两篇静态二进制代码搜索的文章后，对文章中的思路和算法进行复现并评估效果，在效果并不理想的情况下进行了一点改进并再次评估的过程。

文章分别是：

给定程序集F={T1, T2, …, Tn} 和一个查询程序Q， Q中包含一个(有漏洞的)函数q，我们的目标是判断 Ti (∈ F) 是否包含一个与q相似的函数。

首先是我们想要解决的问题，比较严谨的问题定义如上，给定T1,T2，T3还有查询程序Q，这些都是二进制程序，其中Q中包含了一个函数q，我们的目标就是搜索这些T中是否有函数与q是相似或者相同的。直观来讲就是在F里面搜索q这个函数。

下面来是解决如上所述问题的意义、解决后可以应用在哪些场景：

跨平台、跨工具链、跨优化等级程序中的代码搜索：最广泛的应用场景是目前IOT的设备越来越多，但是设备的固件都是经过编译、去掉符号表、打包好的，相同功能设备上面的程序可能是跨平台、跨工具链、跨优化等级的，这个时候我们只能从二进制层面去尝试大规模的自动化分析。

闭源软件分析：因为windows上的大多数软件都是闭源的，也只能从二进制层面进行分析搜索。

在阅读了一些文章后总结解决上述问题大致有两种思路：

利用图论：

CFG(control-flow-graph)本质是图，节点是代码片段，边是跳转关系。利用图算法，通过寻找两个CFG间的同构或子图同构来进行相似度匹配

生成特征：

利用一个函数的某些或所有的basic-block的内容以及CFG的结构，执行相应的算法生成属于这个函数的特征，随后通过比较两个代码片段的特征来判断二者的相似度。

Firmup是作者这一系列论文中最新的一篇里的解决方案，也是准确率最高的。Firmup方案中使用的是上面的第二种思路，也就是分别生成属于两段代码的特征，然后对比两个特征得出相似度。下面介绍Firmup方案里的特征提取算法以及特征匹配算法。

第一步：生成CFG

CFG控制流图中每个节点代表一个基本块(basic-block)，跳跃目标以一个块开始，和以一个块结束。生成CFG有很多成熟工具可以完成,同时也允许编程，比如IDApython，和angr 二进制分析框架。

第二步：统一为Vex-IR

VEX-IR是为了方便二进制自动化分析而创造的跨平台间差异的中间表达式。第二步是\CFG的每个节点也就是basicblock的内容以Vex-IR的形式来储存，IR是一种语言的中间形式，类似于clang编译器前端\c语言翻译为IR，编译器后端再\IR编译成具体平台的代码。但是Vex-IR比较特殊，是由二进制代码提升为IR，是反向的，专门用于跨平台二进制分析，能把不同平台的指令统一为同一种形式。比如上图第一张是两条汇编指令，第二张是翻译成的Vex-IR，以IMark指令为分割，\每条汇编指令都翻译成了多条Vex-IR，比如0x404ee这条pop指令翻译之后，包括了读取rsp当前指向内容、缩小栈再到赋值给rbp、为pc赋值\指令指针指向下一条，可以看出Vex-IR是\一条汇编指令的所有功能翻译为多条简单指令(load以及put)来实现跨平台统一的。这是Firmup的思路中起到跨平台的主要工具。

第三步：数据流分片

这一步运用数据流分片，\Basic-Block分为更细的粒度:strand，strand是一个BB中的一个Use-Define链，每个strand只包含用来计算同一输出的多条指令。具体分片操作是由下向上的，比如先使用第5条指令cmp，在里面使用了寄存器r13,接着上找到第四条sub修改了r13的值，同时又读取了r15,再向上找第2条指令为r15赋值，同时也读取了rax，至此上面也没有指令为rax赋值，一个strand就分割完成了。再经过类似的过程，可以\一块BB分割为多个strand，每一个strand都是一个完整的“赋值-使用”的链条。

第四步：Vex-IR to LLVM-IR

进行到这一步之前，每一个basic-block都已经分割为了strand(由Vex-IR表示)。现在将一个Vex-IR块翻译为LLVM-IR的一个函数。这么做的目的在第五步中会详细说明。这一步转换的过程在Firmup的文章中一句带过，但是实际上是技术实现起来最复杂的部分，具体实现在后面在实现部分会有详细介绍。

第五步：优化LLVM-IR

第五步是对刚刚第四步翻译出来的strand(LLVM-IR形式)进行语义上的优化，之所以费了很大力气把Vex-IR转化成LLVM-IR，是想利用llvm 非常成熟的优化工具opt，这样一来不同优化等级、不同工具链编译的代码，能够在opt的分析下统一优化为最高优化等级的代码，这是Firmup论文的思路中起到跨优化等级跨工具链的主要工具。

第六步：统一化

最后会对优化之后的llvm-IR进行命名统一化，包括寄存器名和变量名，统一以其出现的次序重新命名，这也是屏蔽平台间差异的一项措施，最后提取出的一个函数的特征就是他的所有的strand的集合，每个strand都是一段LLVM-IR，也是一串字符，最后我们计算每个strand的md5方便比较、存储。

总结

至此特征提取的六个步骤就介绍完了，总结起来如图：一个可执行程序包含多个函数，每个函数经过CFG得到多块block，每块block都能经过数据流分片分割为多个strand，所以我们提取出的每个function的特征，便是由他下面所有的strand组成的集合，function也是我们用来匹配的单位。

两个函数相似度指标：拥有的相同strand的数量(交集大小)

现在我们得到了每个函数的特征，下面介绍文章中的特征匹配算法。按照刚刚的思路，每个函数的特征都是一个strand集合，我们可以简单的比较和哪个函数的strand交集最多就认为那个函数是最佳的匹配。

但是此时会遇到一个问题，如上图，上侧的ftp retrieve glob与sub443ee2是strand交集是最多的，但实际上443ee2的最佳匹配是getftp，这是函数不同的大小规模造成的，ftpretrieve比sub443ee2小了一些，正确的匹配应该是像上图右半侧里的对应关系。

下面介绍论文中在一定程度上解决这个问题从而提高准确率的匹配算法，如上图：横纵坐标分别是编译在arm和mips平台上的curl里面的函数，2和3代表编译优化level，函数名后面的括号是他包含的strand数，a1、a2、a3是他们的简称。

我们拿a1作为查询函数，首先看b1、b2、b3哪个函数与a1的strand交集数量最多，是b2，直观上可以看到是不对的。算法继续，计算b2的最佳匹配是a2函数，a2和a1是不同的函数，也就表明a1的最佳匹配应该不是b2。这时候我们把b2也放入tomatch栈，先寻找b2的匹配对象，b2的最佳匹配是a2,a2的最佳匹配也是b2，这时候我们认为a2、b2才是正确的匹配，加入到match列表。 最后这时候tomatch里又只有a1,继续计算最佳匹配，现在应该是b1,因为b2已经找到了最佳的匹配对象，继续再看b1的最佳匹配也是a1,匹配成功。至此匹配完成，可以看出在没有在3×3匹配都计算的情况下得到了正确的匹配。最后更加详细的匹配算法伪代码在论文的Algorithm2，感兴趣的同学可以自行仔细阅读，在此不再贴出来赘述。

最后是论文算法所作出的假设以及限制：

粒度过大

匹配算法做了一个很强的假设，就是假设Q T两个程序有相似的函数，或者说从同一套源码编译的，这也就限制了应用的场景在同源程序间的匹配，没有办法只单单搜索函数或片段。

IR的表达能力有限

第二是Vex-IR没有能够完全屏蔽平台间的差异，比如对flag寄存器的操作，平台特有的指令arm里的clz。

实现软件的架构主要分三个角色，matcher、slicer、translator：

matcher里实现了前面提到的匹配相关的所有算法

slicer里面主要是\block分割为strand的函数

translator是主要的部分，能够\vexIR翻译为LLVMIR

因为translator在论文里基本是一句带过，但实际上是技术上实现难度最大的，他的输入是一块vexIR，输出是一个LLVM IR的函数，VexIR里面未读先写的寄存器作为全局变量传入函数，最后一个计算的变量作为函数的返回值，右侧的函数体内是左侧的每条指令逐条翻译过去的，最后用llvm opt优化翻译出的函数，最后根据变量出现的位置进行统一重命名。

评估的方法是：分别编译两个curl，不去除符号表，对作为查询者的curl里面的每个函数都进行一次匹配，由于没有去除符号表，因此我们可以明确确定匹配是成功还是失败，最后计算匹配成功的概率。

如上图，红色是匹配失败项，TP指正确匹配，FP指程序声称匹配到了结果，但结果是错误的。FN指程序认为被搜索的程序中没有匹配到对应函数，但是我们知道这个函数是存在的。

上面是一个比较全面的测试结果，arm0代表在arm架构上优化等级为0。可以看出红色区域是匹配双方包含编译优化等级为0的程序的情况，效率都很不理想，绿色是匹配双方同平台优化等级相似的情况，这时候准确率高一些。黄色区域是跨平台但都经过优化的情况。可以看到总体来看效果不是太理想。

刚刚的效果很不理想，后面在寻找原因时，我发现了一个比较典型的现象，下图中左右两侧分别是两个curl同一个函数的第一块block，红色区域上半部分是Vex-IR，下半部分是翻译后的LLVM-IR，可以看出Vex-IR部分是明显不一致的，但是LLVM-IR部分右侧的黄线以上的部分是与左侧完全相同的。这个现象说明，当前strand的粒度可能还是太大了，前面的复现里的strand的组成是一条一条的汇编指令，我决定将其粒度改为Vex-IR中的一条条statement指令，也就是细化strand的粒度。

上图更改之后的效果，相同的测试场景，可以看到准确率有了明显的提升。

每个单元格的第一个数字代表只保留strand数大于5的函数的准确率，第二个数字代表只保留strand数大于15的函数的准确率，因此可以看出Firmup匹配算法更适合规模较大的函数。

Welcome back to our series on red teams! Here, we’re explaining the tools and concepts behind the in-house organizations designed to test a company’s defenses. We started by introducing Kali linux , a foundational operating system for penetration testing.

Over the last few blogs in this series, we’ve talked about something called “getting shell.” In layman’s terms, getting shell access to a computer, server, or application means that a hacker is able to take it over remotely. The hacker can open a command prompt on their computer that connects to the infected system and execute commands.

Many times, getting shell as a red team member means that you’ve won you’ve successfully penetrated the defenses of your site and it’s time to wrap up. Sometimes, however, you’ll find that shell is just the beginning. You may have shell on a database, for example, but if the database contains nothing of interest, your work is still cut out for you.

When this happens, you have three goals:

Persist ensure you can’t be dislodged if someone reboots or re-images their machine.

Move traverse the network to find better targets.

Escalate upgrade your privileges to access more sensitive data stores

How do you do this? One of the best tools for moving behind the scenes as an attacker is called CrackMapExec (CME).

Unlike the other tools we’ve covered in the past, CME is not installed by default in Kali Linux . Fortunately, the installation process is easy, even if you’re relatively new to the operating system it should download, install, and configure with just a single input on your command line.

To begin with, this tool is a post-exploitation tool. It assumes that you already have shell, or at very least a single login to the network. Your next step is to use the tool to map the rest of the network what else is there? CME can scan the network and tell you how many machines are attached to a given domain.

Your next step is to determine the limits of your abilities. You have default access, but you need administrator credentials. How badly will the system resist your attempt to get them? CME will tell you if the authentication systems for your targeted network will do things like lock you out if you make too many failed attempts within a given window.

Assuming not, the next step is to see what happens when you login. CME is fully concurrent, so it can do things like log you into multiple machines at once or log you into multiple machines using multiple sets of credentials. This allows you to test the same login across the entire network at the same time. As you do this, CME will tell you the extent of privileges whether you have read-only or read-write permissions over various machines and directories.

Finally, let’s say that you manage to find a set of credentials with admin privileges over a given machine. The machine may have nothing interesting on it, but it’s a start. CME gives you the tools to start escalating from there. First, wait until someone with a higher level of access logs on, then use your admin credentials to enable the UseLogonCredential registry key. Once that admin logs out and logs on again, their password will be dumped from memory in plaintext! into the CME database.

CME is as detailed and powerful in its own way as tools like Metasploit , and like Metasploit, we’ve barely scratched the surface of this tool’s capabilities. Suffice to say that it adds scale and automation to the task of penetration testing, which makes it great for red team members who have to audit systems with hundreds or even thousands of machines. That said, it also has stealthy capabilities that an attacker could use to slowly and carefully break into even a carefully-guarded network .

At Safe-T, we’re well aware of the potential for damage caused by attackers who move laterally through the network. This is a hallmark of advanced threats and capabilities. To protect against it, our Software-Defined Access product offers the power of a Zero Trust Network , which segregates internal networks to prevent attackers from escalating privileges. To learn more, contact us for a free demo today.

驱动中国2018年12月6日消息 日前，超过两万用户的电脑感染“微信支付”勒索病毒引发多方媒体关注。目前，该勒索病毒已被破解，关于此事细节线索相继曝出。

据澎湃新闻从技嘉网络安全公司获悉，他们已经初步锁定病毒制造者，嫌疑人是一名95后罗姓男子，目前已将相关信息移交警方。

图片来源于网络

据国家互联网安全应急中心报告，该病毒采用“供应链感染”方式进行传播，通过论坛传播植入病毒的“易语言”编程软件，进而植入各开发者开发的软件，传播勒索病毒；同时，该病毒还窃取用户的帐号密码，包括淘宝天猫、支付宝、QQ等。

对此，支付宝安全中心表示，目前没有一例支付宝账户受到影响。支付宝称，针对此类风险，支付宝风控系统早有针对性的防护，包括二次校验短信校验码、人脸识别等。即便密码泄露，也能最大程度地确保账户安全。

腾讯方面回应称，微信已第一时间对所涉勒索病毒作者账户进行封禁、收款二维码予以紧急冻结，微信用户财产和账户安全不受到任何威胁。此外，微信方面强调，这款勒索病毒是电脑病毒，跟手机没有关系，微信也没有出现病毒，不管是苹果手机还是安卓手机，都不会被感染。

另据e安在线援引多位安全领域专家说法表示，该勒索病毒的加密方式相较于其他勒索病毒破解较为简单，传播量有限，目前国内主流的安全软件已纷纷推出相应的解密工具。受感染用户可在电脑上下载安全软件解密。

2018年11月25日，乌俄两国又突发了“刻赤海峡”事件，乌克兰的数艘海军军舰在向刻赤海峡航行期间，与俄罗斯海军发生了激烈冲突，引发了全世界的高度关注。四天后，360安全大脑在全球范围内第一时间发现了一起针对俄罗斯的APT攻击行动。值得注意的是此次攻击相关样本来源于乌克兰，攻击目标则指向俄罗斯联邦总统事务管理局所属的医疗机构。攻击者精心准备了一份俄文内容的员工问卷文档，该文档使用了最新的Flash 0day漏洞（cve-2018-15982）和带有自毁功能的专属木马程序进行攻击。在发现攻击后，我们第一时间将0day漏洞的细节报告了Adobe官方，Adobe官方及时响应后在12月5日加急发布了新的Flash 32.0.0.101版本修复了此次的0day漏洞，并在官网致谢360团队。

从攻击过程看，攻击者通过投递rar压缩包发起攻击，当受害者打开压缩包内的问卷文档后，将会播放Flash 0day文件。触发漏洞后， winrar解压程序将会操作压缩包内文件，执行最终的PE荷载backup.exe。

360安全大脑经过漏洞分析发现，利用代码借助uaf漏洞，可以实现任意代码执行。从最终荷载分析发现， PE荷载是一个经过VMP强加密的后门程序，通过解密还原，我们发现主程序主要功能为创建一个窗口消息循环，有8个主要功能线程，其中包括定时自毁线程。

按照被攻击医疗机构的网站（http://www.p2f.ru） 介绍，该医疗机构成立于1965年，创始人是俄罗斯联邦总统办公室，是专门为俄罗斯联邦最高行政、立法、司法当局的工作人员、科学家和艺术家提供服务的专业医疗机构。由于这次攻击属于360在全球范围内的首次发现，结合被攻击目标医疗机构的职能特色，我们将此次APT攻击命名为“毒针”行动。目前我们还无法确定攻击者的动机和身份，但该医疗机构的特殊背景和服务的敏感人群，使此次攻击表现出了明确的定向性，同时攻击发生在“刻赤海峡”危机的敏感时段，也为攻击带上了一些未知的政治意图。

近年来，乌克兰和俄罗斯两国之间围绕领土问题的争执不断，发生了克里米亚半岛问题、天然气争端、乌克兰东部危机等事件。伴随着两国危机事件愈演愈烈之时，在网络空间中发生的安全事件可能比现实更加激烈。2015年圣诞节期间乌克兰国家电力部门受到了APT组织的猛烈攻击，使乌克兰西部的 140 万名居民在严寒中遭遇了大停电的煎熬，城市陷入恐慌损失惨重，而相应的俄罗斯所遭受的APT攻击，外界却极少有披露。

http://blogs.360.cn/post/PoisonNeedles_CVE-2018-15982.html

互联网无纸化办公时代，邮件是日常工作往来中不可或缺的一部分。近期却有不少外贸从业者因为点开邮件而遭遇木马。实际上，是有不法分子将木马病毒伪装成PPT文档作为邮件附件，针对外贸行业从业人员进行大范围群发，“精准”打击。而当这种木马病毒在电脑中开始运行，不仅会收集系统版本、内存状态、硬盘信息等电脑数据，还会远程控制电脑，威胁用户安全。

附件PPT竟藏木马病毒 自动播放防不胜防

360安全大脑在解析病毒攻击时发现，这组木马病毒不仅可以激发电脑中潜藏已久的“乱世”木马，造成旧有病毒的二次作案，还会通过伪装成群发邮件附件文档的方式迷惑用户，传播新的木马病毒。用户只要稍不注意点开邮件文档，就会自动全屏播放PPT，而一旦移动鼠标准备关闭文件，就会触发病毒运行，引发电脑感染病毒。值得注意的是，木马作者为了提高邮件附件的打开率，还给病毒制作了多种PPT文档作为伪装，360安全大脑就监测到了包括“空气清新器”在内的多个名称。

目前该木马的主要受害人群多为外贸行业从业人员。针对这一情况，360安全大脑第一时间发布了木马病毒扩散预警信息，提醒广大用户提防未知邮件，并将持续关注病毒动向，及时更新防范攻略。

外贸行业最先中招 360安防攻略帮你揪出木马

普通人虽然不关心“空气清新器”是什么，可对于相关从业者来说，这是最熟悉的内容，即使是陌生邮件，也会有很多人打开一看究竟，这就让木马病毒迅速在外贸行业大肆传播。而移动鼠标触发病毒执行的“刁钻”设置，更是瞄准了电脑操作的常规步骤，让用户更容易中招。不过，集合人工智能、大数据、云计算、IoT智能感知、区块链等新技术于一身的360安全大脑，及时监测到了此类木马病毒的攻击行为。

360安全大脑在监测到病毒后，立即对病毒进行智能查杀解析，并针对病毒的潜藏模式和作案团伙的攻击手法，率先发布了病毒防范攻略。360安全专家指出，此类木马病毒主要依托电子邮件、文档类、IM工具、软件工具四类形式进行传播扩散，因此，用户需谨慎查看不明身份的电子邮件，以及来源不明的任何文档内容。此外，还可以选择安装360安全卫士等安防软件，定期查杀病毒，可有效确保网络安全。

近期，社区发现 Kubernetes 的首个重要安全漏洞 CVE-2018-1002105 ，此漏洞严重等级为 9.8（最高 10 分）被认为非常重要，主要原因是它允许未经授权的用户通过特制的网络请求，通过 Kubernetes API 服务器创建与后端服务器的访问连接。另一个影响涉及具有 pod exec / attach / portforward 权限的普通用户，可以将权限升级为集群管理员，使其能够访问任何容器并 pod 中运行任意命令。

DaoCloud 团队在得知此安全漏洞后，迅速响应，对该安全漏洞进行了分析与确认。经过产品团队严格全面的安全排查与验证，确认此次安全漏洞对于 DaoCloud Enterprise 产品 并无影响 。产品团队在设计研发产品之初，产品本身在安全设计上能够很好地避免此次 CVE-2018-1002105 安全漏洞所带来的风险，所以使用 DaoCloud Enterprise产品的客户尽可放心。

DaoCloud 安全与支持中心团队迅速做出了响应，从安全漏洞被提出的第一时间，与产品团队一起紧密沟通合作，确认漏洞详情与潜在影响，全面认真排查了目前上百家客户、总共上万个数据节点的生产环境，排查消除其他安全隐患。并与客户进行了及时沟通与反馈，解答客户的疑问和提供相应的技术支持，让客户充分了解此次安全漏洞情况与当前所有平台环境的安全情况，能够继续放心地使用 DaoCloud Enterprise 平台，无需实施特别的修复或升级等操作。

DaoCloud 始终重视企业系统平台安全，为了能够更好地为客户系统进行安全保驾护航，近期将发布 云原生平台安全工具――“DaoCloud KubeSecure” ，通过对系统进行全方位扫描，及时发现安全隐患并避免潜在的安全问题发生。

在此，我们衷心感谢每一位客户对 DaoCloud 产品的信赖和支持，我们也将一如既往的提供最优质、最周到的服务支持。

目前，我们也收到许多用户关于 Kubernetes 相关安全问题的咨询，他们或在使用开源产品，或在使用其他的商业平台产品；如果您也有任何 Kubernetes 相关的问题，欢迎随时通过服务热线、邮件、DaoVoice 等方式联系我们，我们期待与您的沟通。

DaoCloud 安全与支持中心

DaoCloud Security & Support Center

2018-12-06