Aggregator

Key Takeaways In late December 2022, we observed threat actors exploiting a publicly exposed Remote Desktop Protocol (RDP) host, leading to data exfiltration and the deployment of Trigona ransomware. On … Read More

从零开始自定义安卓系统(4) product配置详解 前言 在学习修改一样东西时, 最好的方法之一就是搞懂他到底可以干什么. 而不是跟一个教程学一个选

从零开始自定义安卓系统(3) 配置开发环境与新建product aidegen aidegen是一个自动生成项目配置文件的工具 在运行完lunch后 会自动配置这

引言在金融行业的数字化演进中，供应链安全已迅速从一个支持功能转变为核心战略要素。

Jenkins 未授权文件读取漏洞（CVE-2024-23897）今天闹得沸沸扬扬，我也来简单分析一下这个漏洞，并看看这个文件读取如何利用。

首先说的是，由于Jenkins存在版本和插件差异，所以利用时可能也有不一样之处，本文内容不一定适用于所有Jenkins server。我们这里使用Vulhub的环境（2.441）来做分析和演示：https://github.com/vulhub/vul...

A lower percentage of ransomware victims are paying, as new regulations begin to elicit more and more public disclosure of ransomware incidents.

笔者在MacBook M2上搭建Linux虚拟机上开发eBPF程序时，遇到一些LSM eBPF类型程序无法运行的问题。 在笔者尝试定位这些差异时，看到这篇文章，可以让大家更直观地了解LSM eBPF在ARM64、AMD64 内核上的差异。

Vandaag heeft de Algemene Inlichtingen- en Veiligheidsdienst samen met partnerdiensten uit Frankrijk, Duitsland en Zweden een position paper uitgebracht over Quantum Key Distribution (QKD).

Confluence 存在 Velocity 模板注入漏洞，未经身份验证的攻击者可以直接访问`*.vm`文件传入恶意 Ognl 表达式来实现 RCE。

“小米智能终端产品安全风险治理”项目被评选为“2023年度移动互联网APP产品安全漏洞治理十大优秀案例”

开赛之夜，希望大家wonder尽兴！

开赛之夜，希望大家wonder尽兴！

请查收2024春节期间平台放假安排

2024年1月25日，Jenkins 官方披露 CVE-2024-23897 Jenkins CLI 任意文件读取漏洞。

Once you've migrated to the cloud, you need to prioritize your cloud cybersecurity. These three resources from CIS can help.

This is a joint blog written by William Burgess (@joehowwolf) and Henri Nurmi (@HenriNurmi). In our ‘Cobalt Strike and YARA: Can I Have Your Signature?’ blog post, we highlighted that the sleep mask is a common target for in-memory YARA signatures. In that post we recommended using the evasive sleep mask option to scramble the [...]

Read More... from Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM

The post Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM appeared first on Cobalt Strike.

roadmap

之前在 iosre看到一张比较系统的iOS逆向学习路线图，因为接触过一段时间macOS上服务的漏洞挖掘，所以对*OS安全还是挺有兴趣的，也一直想系统性地学习下iOS逆向，之前的一直不成体系，也很零碎，正好对着这个图重构下知识体系。

It’s been four years since the release of The NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0. Since then, many organizations have found it highly valuable for building or improving their privacy programs. We’ve also been able to add a variety of resources to support its implementation. We’re proud of how much has been accomplished in just a few short years, but we’re not resting on our laurels. As another, more famous, Dylan once said, “the times they are a-changin’.” For example, the past year has seen the release of the NIST AI Risk