Aggregator

近年来，Citrix NetScaler ADC与Gateway持续爆发高危漏洞，引发全球网络安全领域关注。本文从CVE-2025-7775切入，深度剖析其技术原理与影响，并追溯相关历史漏洞演化历程，分析高级威胁行为体利用此类漏洞的攻击链路

文章介绍了Cloudflare错误代码521的原因及其解决方法。该错误通常因源服务器超时或网络连接问题导致。常见原因包括服务器过载或配置错误。建议检查服务器状态并联系托管服务提供商以解决问题。

HackerNews 编译，转载请注明出处： 一场针对韩国政府及情报工作人员的大规模鱼叉式网络钓鱼活动，利用了一份国家情报通讯刊物来诱骗受害者。 网络安全公司Seqrite在8月29日发布的新报告中披露，APT37——一个被认为有朝鲜背景的国家级黑客组织——是此次大规模鱼叉式网络钓鱼活动的幕后黑手。 这项被称为“韩国幻影行动”（Operation HanKook Phantom）的行动包含两波活动，期间APT37武器化了一些能引起韩国政府官员和情报人员兴趣的文档。 以首尔情报为诱饵的鱼叉式钓鱼 第一波活动利用名为“国家情报研究学会通讯-第52期”（韩语：국가정보연구회 소식지 (52호)）的文档作为诱饵。 《国家情报研究学会通讯》是由韩国研究团体“国家情报研究协会”发布的月度或定期内部通讯刊物。它为会员提供最新及即将举办的研讨会、研究计划和组织发展的概述，并重点介绍有关国家安全、劳动力动态、当前地缘政治变化、技术进步（如人工智能）和韩朝关系的 ongoing 讨论。 根据Seqrite研究人员的说法，攻击者分发这份看起来合法的PDF文件的同时，还附带了一个恶意的LNK（Windows快捷方式）文件，该文件被命名为“国家情报研究学会通讯(52期).pdf.LNK”。 一旦LNK文件被执行，便会触发载荷下载或命令执行，使得攻击者能够入侵系统。其入侵链包含多种混淆恶意载荷和逃避检测的方法，包括内存执行、伪装诱饵和隐藏的数据渗出例程。 通过分析攻击链，Seqrite研究人员发现其最终载荷是RokRAT，这是一个通常作为编码后的二进制文件分发的后门程序，在利用武器化文档后由shellcode下载并解密。APT37在过去的攻击活动中也被观察到分发RokRAT。 此鱼叉式钓鱼活动的主要目标包括该通讯刊物的接收者，他们通常是以下一个或多个韩国机构的成员： 国家情报研究协会 光云大学 高丽大学 国家安全战略研究院 中央劳动经济研究所 能源安全与环境协会 救国精神振兴会 养志会（纪念会议主办方） 韩国整合战略 以朝鲜官方通讯为诱饵的鱼叉式钓鱼 第二波活动使用了朝鲜劳动党中央委员会副部长、朝鲜最高领导人金正恩的妹妹金与正于7月28日发表的声明作为诱饵。 Seqrite报告指出，根据平壤的朝鲜中央通讯社（KCNA）报道，该声明表明了朝鲜拒绝韩国任何和解努力的立场。研究人员称：“它强烈批评韩国改善朝韩关系的尝试，称其毫无意义或虚伪。”文件还提到，朝鲜断然拒绝未来与韩国的任何对话或合作，宣布结束和解努力，并将在未来采取敌对、基于对抗的立场。 此攻击链与第一波活动相似，从一个恶意的LNK文件开始，该文件在部署混淆组件（tony33.bat, tony32.dat, tony31.dat）到%TEMP%目录的同时，会释放一个诱饵文档。LNK文件会自行删除，随后批处理脚本触发无文件攻击：tony32.dat在内存中解码，用XOR解密（密钥0x37）tony31.dat，并通过API调用（VirtualAlloc+CreateThread）将其注入。 投放器通过伪造的HTTP请求从命令与控制（C2）服务器获取次要载荷（abs.tmp），通过PowerShell（-EncodedCommand）执行它并删除痕迹。同时，它通过在删除前通过伪装的POST请求（模仿PDF上传）来渗出%TEMP%文件，并使用合法系统工具（LOLBins）、内存执行和流量混合来逃避检测。 第二波活动的目标包括： 李在明政府（韩国政府内阁） 统一部 美韩军事同盟 亚太经合组织（APEC） APT37使用高度定制的鱼叉式钓鱼攻击 Seqrite将这两波结合的活动命名为“韩国幻影行动”（Operation HanKook Phantom），“HanKook”是一个通常用于指代韩国的韩语词，而“Phantom”（幻影）则代表了在整个感染链中使用的隐蔽且规避的技术。 APT37是一个网络间谍组织，拥有许多别名，包括InkySquid、ScarCruft、Reaper、Group123、RedEyes和Ricochet Chollima。该组织至少自2012年以来一直活跃，并被认为与朝鲜政权有关联。其主要焦点是韩国的公共和私营部门，近期的鱼叉式钓鱼活动涉及利用有关朝鲜士兵在乌克兰战争中帮助俄罗斯的文档作为诱饵。 2017年，APT37将其目标范围扩展到朝鲜半岛以外，包括日本、越南和中东，并瞄准了更广泛的行业领域，包括化工、电子、制造、航空航天、汽车和医疗保健组织。 Seqrite研究人员总结道：“对此次行动的分析凸显了APT37如何持续采用高度定制的鱼叉式钓鱼攻击，利用恶意的LNK加载器、无文件的PowerShell执行和隐蔽的渗出机制。”       消息来源：infosecurity-magazine； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

本月推荐的游戏包括治愈系模拟经营作品《小小书店》，休闲益智的座位安排游戏《这个座位有人坐吗？》，经典重制的潜行动作游戏《潜龙谍影 Δ：食蛇者》，以及收录多款经典弹幕射击作品的合集《宇宙巡航机 起源精选集》。

本文分析了在中文Windows环境下进行数据库提权时遇到的字符集问题。通过MSSQL盲注提权和MySQL UDF提权两个实际案例进行分析

本文介绍了http2指纹实现的一些构想，用于代理检测

A vulnerability, which was classified as problematic, was found in Apple tvOS up to 14.6. Affected by this vulnerability is an unknown functionality of the component Message Handler. Executing manipulation can lead to denial of service. This vulnerability is tracked as CVE-2024-44297. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability classified as problematic has been found in Apple macOS up to 14.6. This affects an unknown function of the component Message Handler. This manipulation causes denial of service. The identification of this vulnerability is CVE-2024-44297. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Apple visionOS up to 14.6. This impacts an unknown function of the component Message Handler. Such manipulation leads to denial of service. This vulnerability is referenced as CVE-2024-44297. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in Apple iOS and iPadOS up to 14.6. Affected is an unknown function of the component Message Handler. Performing manipulation results in denial of service. This vulnerability is identified as CVE-2024-44297. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Apple watchOS. It has been rated as problematic. The impacted element is an unknown function. Performing manipulation results in protection mechanism failure. This vulnerability is known as CVE-2024-44296. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Apple visionOS and classified as problematic. This issue affects some unknown processing. The manipulation results in protection mechanism failure. This vulnerability is reported as CVE-2024-44296. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability was found in Apple iOS and iPadOS. It has been classified as problematic. Impacted is an unknown function. This manipulation causes protection mechanism failure. This vulnerability appears as CVE-2024-44296. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in Apple tvOS. It has been declared as problematic. The affected element is an unknown function. Such manipulation leads to protection mechanism failure. This vulnerability is traded as CVE-2024-44296. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Apple macOS up to 13.6/14.6 and classified as problematic. This vulnerability affects unknown code of the component System Files Handler. The manipulation leads to denial of service. This vulnerability is documented as CVE-2024-44294. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

A vulnerability classified as critical has been found in Apple macOS up to 13.6/14.6. This issue affects some unknown processing. This manipulation causes improper access controls. This vulnerability appears as CVE-2024-44295. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability marked as problematic has been reported in Apple macOS up to 15.0. Affected by this vulnerability is an unknown functionality. This manipulation causes sensitive information in log files. The identification of this vulnerability is CVE-2024-44293. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

发改委要求各地因地制宜发展人工智能，避免无序竞争，并加强资源共享与监管。Python纪录片回顾了其历史与挑战。Meta因激进重组引发内部动荡。央视曝光防蓝光膜虚假宣传。Pixel 10 AI变焦功能出现幻觉问题。AI推理成本上升挤压企业利润。

Win11Debloat是一款开源脚本工具，可一键清理Windows 11预装应用、关闭广告和遥测功能，优化系统性能与隐私安全。使用简单，下载后以管理员身份运行即可选择清理模式。

模型部署安全是大模型安全落地的关键防线，只有确保了部署环境的安全可靠，才能真正发挥大模型的价值，为用户提供安全、可信的AI服务。随着大模型应用场景的不断拓展，模型部署安全技术也将持续演进，为大模型的安全应用提供更加全面的保障