Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

REST API安全测试的思路
基于Swagger的REST API自动化安
全测试实践
贾玉彬 Gary
Gary_jia@rapid7.com
大纲
• 由应用安全说起
• 传统REST API安全测试
• 基于Swagger的REST API 的安全测试
在SDLC中尽早发现和修复安全问题
30X
15X
10X
5X
2X
Cost
Source:  NIST
Production
System
testing
Integration/ component
testing
Coding
Requirements
不同的团队不同的目标
DevSecOps
Image : Pete Cheslock at #DevOpsDaysAustin.
“Everyone is responsible for security” with the
goal of safely distributing security decisions at
speed and scale
It does not have to be like this:
传统的REST API安全测试
REST API
• REST – REpresentational State Transfer
• REST描述的是客户端和服务端的一种交互
形式，REST本身不实用，实用的是如何设
计RESTful风格 API
• 传输资源的形式一般是JSON和XML
RESTful结构的好处
RESTful通过一套统一的接
口为Web, iOS和Android提
供服务
*图片来自互联网
REST API安全问题会带来的后果
• 接口被滥用消耗系统资源
• 数据泄露
• 伪造/篡改数据
• 应用被仿制
• 引入其他安全问题
REST API是可被攻击的
• REST API是可以被常用的攻击方法进行攻击
的，如注入、XSS、CSRF、XML Entity攻击等
等
REST API测试
• 通常没有WEB界面与之进行交互，通过HTTP的各种终端工
具或自己编写HTTP客户端脚本与服务端通讯来进行测试
• 通过变化API调用参数组合，变化API功能调用顺序，实现
全面和各种复杂组合的调用
• 针对安全测试也存在同样的问题
以移动应用为例的测试过程（手工）
• 安装配置代理
• 配置测试移动设备
• 准备测试用数据
• 手工测试
安装并设置代理、配置移动设备
手工测试REST API（SQL注入为例）
•
测试是否存在注入漏洞
•
例如使用PUT方法更新用户档案
•
请求中包含参数值（first_name)
URL: http://192.168.202.131/api/user/1
Method: PUT
Parameter name: first_name
Attack values: test’’
手工测试REST API（SQL注入为例）
Request 1
使用test’’把两个单引号（’）注入
到请求
手工测试REST API（SQL注入为例）
Response 1
用户档案成功提交
手工测试REST API（XSS为例）
•
测试是否存在XSS漏洞
•
例如使用PUT方法更新用户档案
•
请求中包含参数值（first_name)
URL: http://192.168.202.131/api/user/1
Method: PUT
Parameter name: first_name
Attack values: <script>alert(1)</script>
手工测试REST API（XSS为例）
Request
在请求中使用
<script>alert(1)<script>把一
个脚本标签注入到first_name
参数值
手工测试REST API（XSS为例）
使用DAST工具测试REST API
• 手工测试REST API是个很具挑战性的工作
• 大部分的DAST工具都需要training mode对
REST API进行测试（使用复杂的JSON、XML、
GWT结构）
• 方法：导入预先录制的流量文件进行测试
以AppSpider + BurpSuite为例
• BurpSuite使用广泛
• AppSpider可以接受各种录制的流量并且可
以识别JSON、XML、GWT、AMF参数和值，
不需要使用training mode
DEMO
基于SWAGGER的REST API的安全测试
基于Swagger的REST API
• Swagger是一个简单又强大的REST API文档
生成工具
• 标准的、语言无关的，通过它计算机和人
类无需阅读代码、文档或者监测网络流量
就能发现并理解Web服务
Swagger REST API
DEMO
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright © 2010 Trustwave. All Rights Reserved.
A Whitepaper for DEF CON 18, July, 2010
This is not the droid you're looking for...
Christian Papathanasiou
Nicholas J. Percoco
June 21st, 2010
Trustwave
- 2 -
Copyright © 2010 Trustwave. All Rights Reserved.
A Whitepaper for DEF CON 18, July, 2010
Table of Contents
1
   EXECUTIVE SUMMARY............................................................................................ 3
1.1
About the authors.................................................................................................. 4
2
   INTRODUCTION TO GOOGLE ANDROID ................................................................. 5
3
   MOTIVATIONS BEHIND THIS WORK ...................................................................... 7
4
   LINUX KERNEL ROOTKITS...................................................................................... 9
4.1
Hurdles we faced when developing the Android rootkit........................................... 11
4.1.1
   Retrieving the sys_call_table address ......................................................... 11
4.1.2
   Compiling against the HTC Legend Linux kernel source code........................ 12
4.1.3
   Enabling system call debugging ................................................................. 14
5
   THE ANDROID ROOTKIT....................................................................................... 18
5.1
sys_read system call hooking ............................................................................... 18
5.2
Hiding from the user and from the OS................................................................... 19
5.3
Implications ........................................................................................................ 20
6
   CONCLUSIONS...................................................................................................... 22
7
   REFERENCES................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MindAPI
最近API安全概念停⽕的，正好前⼀阵在Twitter上看到⼀个API安全的思维导图，感觉很全⾯，
在这⾥稍微总结下。
⼀、框架识别
1.API框架种类
(1) REST APIs
RESTful 、OData
(2) GraphQL
这⾥有⼀个关于GraphQL的测试项⽬
https://github.com/nicholasaleks/graphql-threat-matrix
(3) SOAP
SOAP 很熟悉了，也就是WebService，开源的Service框架有Apache CXF、以及Apache
AXIS1 2等
(4) XML-RPC
以更简单的 XML 格式传输数据,这⾥很容易联想到Apache OFbiz XML-RPC 反序列化漏洞
(5) JSON-RPC
以JSON格式化⽅式传输数据
(6) gRPC-Protobuf
可以从header头、Content-Type、以及Access-control-expose-headers 响应头
2.API框架简介相关文档
https://smartbear.com/blog/soap-vs-rest-whats-the-diﬀerence/
https://www.odata.org/documentation/
https://www.howtographql.com/basics/1-graphql-is-the-better-rest/
https://www.smashingmagazine.com/2016/09/understanding-rest-and-rpc-for-http-ap
is/
https://www.soapui.org/docs/rest-testing/working-with-rest-services/
https://cloud.google.com/blog/products/api-management/understanding-grpc-openapi
-and-rest-and-when-to-use-them
https://openapi.tools/
⼆、⼀些框架⾃带URL特征
三、如何⿊盒进⾏API信息收集
这⾥主要列出了⼀些API接⼝测试的⼯具和⽹站及技巧
⼯具：Burp、mitmproxy、Wireshark、APKLeaks、APKEnum、Api-Guesser、Keyhacks
Google搜索技巧：site:target.tld inurl:api 、intitle:"index of" "api.yaml" site:target.tld、
WADL WSDL：inurl:/application.wadl、user ﬁletype:wadl、ext:wadl、user ﬁletype:wsd、
ext:wsdl、
OData：Inurl:/%24metadata
Github：https://github.com/search?q=target.tld+%252Bapi
https://github.com/search?q=target.tld+application.wadl&type=code
https://github.com/search?q=target.tld+*.wsdl&type=code
其他：intitle:"index of" intext:"apikey.txt" site:target.tld、allintext:"API_SECRET*" ext:env
| ext:yml site:target.tld
https://github.com/dxa4481/truﬄeHog
https://github.com/eth0izzle/shhgit
⼀些API聚合以及搜索⽹站：
https://apilist.fun/
https://apiharmony-open.mybluemix.net/public
https://www.programmableweb.com/
https://rapidapi.com/hub
http://apis.io/
https://app.swaggerhub.com/search
https://apis.guru/
https://www.postman.com/explore/apis
https://any-api.com/
https://smart-api.info/registry
https://www.apistack.io/
https://public-apis.xyz/
API字典及枚举⼯具：
四、API接⼝测试
1.⼀些⼯具
REST APIs：https://gith...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

7/7/13
IPython Notebook
localhost:8888/a1253220-71b8-49cd-bd84-1d0edbd6bd60/print
1/7
In [56]:
In [57]:
High level stats
In [58]:
Epoc to datetime
In [60]:
In [61]:
Device discovery over time
In [62]:
import pandas
import json
import os
import datetime
#the following is the path to your client json files
data_path="../../data/json_archive"
has_json_ext = lambda x: True if os.path.splitext(x)[-1] == ".json" else False
data_list=[]
for path, deeper_dirs, filenames in os.walk(data_path):
    for filename in filter(has_json_ext, filenames):
        f = open(os.path.join(path, filename), 'r')
        json_data = json.load(f)
        f.close()
        data_list.append(json_data)
df = pandas.DataFrame(data_list)
uniq_devs = df["bluetoothAddress"].nunique()
total_entries = len(df)
print "%-25s %-25s" % ("Uniq Devs:", uniq_devs)
print "%-25s %-25s" % ("Total Sightings:", total_entries)
Uniq Devs:                2489
Total Sightings:          9362
epoc_to_datetime = lambda x:datetime.datetime.fromtimestamp(float(x))
df["timestamp"] = df.timestamp.apply(epoc_to_datetime)
df.head()
Out[61]:
<class 'pandas.core.frame.DataFrame'>
Int64Index: 5 entries, 0 to 4
Data columns (total 10 columns):
bluetoothAddress    5  non-null values
bluetoothName       5  non-null values
clientType          0  non-null values
clientVersion       0  non-null values
deviceMajor         0  non-null values
deviceMinor         0  non-null values
latatude            5  non-null values
longitude           5  non-null values
timestamp           5  non-null values
type                0  non-null values
dtypes: datetime64[ns](1), float64(3), object(6)
all_devs = df[["timestamp"]]
all_devs.sort("timestamp")
all_devs = all_devs.set_index("timestamp")
all_devs["total"] = 1
all_devs["total"] = all_devs.total.cumsum()
fig = all_devs.plot(figsize=(15,5))
fig.set_title("Cumulitive sightings over time")
Out[62]:
<matplotlib.text.Text at 0x1087b4a50>
7/7/13
IPython Notebook
l...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A CTF-Style Escape Journey
on VMware Workstation
f1yyy@Chaitin.Tech
About us
●
Beijing Chaitin Tech Co., Ltd(@ChaitinTech)
○
https://chaitin.cn/en
○
https://realworldctf.com/
●
Chaitin Security Research Lab
○
Pwn2Own 2017 3rd place
○
GeekPwn 2015/2016/2018/2019 awardees
■
PS4 Jailbreak, Android rooting, IoT Offensive Research, ESXi Escape
○
CTF players from team b1o0p, Tea Deliverers
■
2nd place at DEFCON 2016
■
3rd place at DEFCON 2019
■
1st place at HITCON 2019
Before we start
●
VMM(Hypervisor)：Virtual Machine Monitor
●
Guest OS
●
Host OS
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
...
Normally, all of the sensitive behaviors of guest OS will be sanitized by the hypervisor
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
...
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
exploitation
...
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
exploitation
Execute arbitrary codes
on the host
network connectio
...
Introduction of
VMware Workstation
Architecture
Host OS
Physical Hardware
User mode
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Attack Surface
Graphic
Ethernet
USB
SATA
SCSI
COM
Attack in Recent Years
(Pwn2Own 2019)
Graphic
Ethernet
USB
SATA
SCSI
COM
(TianfuCup 2018)
(Pwn2Own 2017)
Our Target
(Pwn2Own 2019)
Graphic
Ethernet
USB
SATA
SCSI
COM
(TianfuCup 2018)
(Pwn2Own 2017)
CVE-2019-5541
Analysis
How e1000e works?
Guest OS
TDT
TDH
TDBAL
TDBAH
e1000e virtual network card
registers
How e1000e works?
Guest OS
TDT
TDH
TDBAL
TDBAH
e1000e virtual network card
registers
write
How e1000e works?
Guest OS
TDT
TDH
TDBAL
T...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

August 8, 2008
Inducing Momentary Faults
Within Secure Smartcards /
Microcontrollers
DEFCON – Las Vegas
Christopher Tarnovsky
Flylogic Engineering, LLC.
chris@flylogic.net – http://www.flylogic.net
August 8, 2008
What is a momentary fault?
• Temporary forced change in behavior
• The change is precisely calculated
• A fault typically lasts no more than a few clock cycles
• Many faults may be executed to force favorable
behavior other than normal
August 8, 2008
How do we do this?
• Low-capacitance buffered driver
• Driver is capable of driving a ‘1’ or ‘0’
• Driver is capable of listening in “Hi-Z”
•
Low-voltage tolerant is a plus
August 8, 2008
Why would we do this?
• A series of changes can allow us too:
• Overwrite stack-pointer
• Force repeated loops in a code segment
• Falsify cryptograms
August 8, 2008
Inducing the fault
•
Physical connection to substrate
•
Use low-capacitance buffered driver
•
Tri-stated buffer is desired-
•
Allow eavesdropping
•
Overdrive at calculated point(s) in time
August 8, 2008
Eavesdropping (listening)
YELLOW: Databus signal
GREEN: Clock
PURPLE: Reset
BLUE: Trigger
August 8, 2008
Overdriving last slides databus
with a logic ‘0’
YELLOW: Databus signal
GREEN: Clock
PURPLE: Reset
BLUE: Trigger
August 8, 2008
Initial steps
• Behavior analysis
• Understand your objective (the goal)
• Determine possible areas of attack
• Areas such as:
• Address bus
• Data bus
• Cryptographic blocks
August 8, 2008
Address bus faults
• Likely choice for cryptographic memories
• Unlikely choice for microcontroller type devices
• Allows complete change of data bus
August 8, 2008
Data bus faults
• Most probable choice of attack
• Allows behavioral changes to many areas
August 8, 2008
Cryptographic block faults
• Limited use typically to Cryptographic Memory type
devices
• Can allow readout of write only keys
August 8, 2008
Execution steps
• Determine-
• When to induce the fault
• How long to induce the fault
• Do we need more than one fault
• Ca...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Drinking from LETHE:
New methods of exploiting and mitigating
memory corruption vulnerabilities
Daniel Selifonov
DEF CON 23
August 7, 2015
Show of Hands
1. Have you written programs in C or C++?
2. Have you implemented a classic stack smash
exploit?
3. … a return-to-libc or return-oriented-
programming exploit?
4. … a return-to-libc or ROP exploit that used
memory disclosure or info leaks?
Motivations
● Software is rife with
memory corruption
vulnerabilities
● Most memory corruption
vulnerabilities are directly
applicable to code
execution exploits
● And there's no end in
sight...
Motivations (II)
● Industrialized
ecosystem of
vulnerability
discovery and
brokering
weaponized exploits
● Little of this discovery
process feeds into
fixes...
The other AFL
Motivations (III)
● State actor (e.g. NSA
Tailored Access
Operations group)
budgets: ≈ $∞
● Bug bounties just
drive up prices
● Target supply, not
demand for exploits...
The Plan
● Sever the path between
vulnerability and
(reliable) exploit
● Why do programmers
keep hitting this
fundamental blindspot?
● Defenses are born in
light of attack strategies
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
<return address to C runtime exit>
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
UWB Real Time Locating Systems
Andrea Palanca
Luca Cremona
Roya Gordon
labs@nozominetworks.com
How Secure Radio Communications May Fail in Practice
© 2022 Nozomi Networks Inc.
2
Overview
01
02
03
04
Methodology of Research
Attack Demos
Remediations
05
Summary & Key Takeaways
Introduction
Introduction
4
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction
•
Ideal for short-range devices
•
Can transmit information quickly
over short distances
•
Ability to send data through solid
objects like walls and other barriers
•
UWB is the preferred
communication protocol for RTLS
Spectral density for UWB and narrowband - Source: FiRa Consortium
UWB
© 2022 Nozomi Networks Inc.
5
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction – Cont’d
•
Uses UWB signals to locate
stationary/mobile objects
•
3 components:
§
Tags
§
Anchors
§
Server that computes, shows
and stores tag positions
•
The time of arrival is analyzed to
determine the position of a tag
RTLS
Anchors
RTLS Server
Tag
Ts_1
Ts_2
Ts_3
Ts_4
UWB
Ethernet, or Wi-Fi, or other media
Operation of an UWB TDoA RTLS
© 2022 Nozomi Networks Inc.
6
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction – Cont’d
Networks will be vulnerable
to attacks by cyber criminals
who are seeking to exploit
vulnerabilities in order to gain
access to sensitive data or
disrupt operations.
Cyber Threats
Source: FiRa Consortium
© 2022 Nozomi Networks Inc.
Motivation
According to the FiRa consortium, in 2018 there was an increased demand for “improvements to existing
modulations to increase the integrity and accuracy of ranging measurements”
Motivation
This is what motivated
us to take a d...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IoT 自动化安全平台体系建设
我是谁？从哪里来？要做什么？
l 我叫孟卓，ID：FengGou
l 来自小米 AIoT 安全实验室
l 保障米系智能产品的安全，赋能业务
团队任务如何达成？
l 消：消除隐患
l 防：防患于未燃
l 员：人员的成长
消除隐患
技术栈复杂
技术难
人才缺失
团队难
产品量激增
压力大
行业经验
无体系
面临严峻挑战
初步尝试
AIoT 消费级物联网产品安全基线
团队能力交叉
误入歧途 - 实验室变流水线工厂
二向箔
IoT自动化审计
的突破
业务构成 -- 抽丝剥茧
芯片
应用
模块
IPC
通信
用户
APP
IoT
智能联动
I2X
二维化
芯片接口
以太流量
无线流量
设备服务
控制协议
固件分析
源码分析
日志行为
接口Fuzz
APP Hook
云服务
攻击链组合
局域网
互联网
本地环回
无认证
弱认证
强认证
认证泄漏
认证绕过
认证劫持
RCE
信息泄露
拒绝服务
TARGET : MQTT
RESULT : HIGH
* 数据分析攻击链路分布
全天候自动化闭环
发现
方案
复查
关闭
学习
修完漏洞就安全了？
这是一个巨大的误区，安全是动态的。随
着技术的迭代，品类的多样化，开发者的
交替、供应的风险以及用户要求的提升，
很难找到一个「基点」来说明产品的安全。
赋能生态
小米
生态
链
三方
业务
合作
防患于未燃
产品构成
○
硬件/芯片
○
传感模块
○
操作系统
○
依赖库/开源代码
○
链路协议栈
不可控
○
应用协议栈/SDK
○
服务代码/APP
○
云服务
○
账号体系
可控
小米战场
AIoT
车联网 / 自动驾驶
机器人 / 工业控制
手机 / 电视 / 笔记本
人无远虑，
必有近忧。
——《论语》


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

JS逆向 | WebPack站点实战（⼀）
收录于合集
#JS逆向
4个
⽂章配套B站视频，很多话语简略了，建议配着视频看。
地址：https://www.bilibili.com/video/BV13F411P7XB/
开始之前了，简单过⼀下下⾯⼏个⽅法加深印象，便于更好理解加载器。也可以直接从
webpack标题开始看起。
Function/函数/⽅法
常规的js函数命名⽅法：
//1. 常规function
var test = function(){
    console.log(123);
}
function test(){
    console.log(2);
}
今天的主⻆，⾃执⾏函数。
//2. ⾃执⾏function
!function(){
    console.log(1);
}()
きっとまたいつか
Depapepe
2022-08-07 09:46 发表于北京
原创
不愿透露姓名的热⼼⽹友 ⼀位不愿透露姓名的热⼼⽹友
}()
// => function a(){} a()
//2.1
!function(e){
    console.log(e)
     var n={
    t:"txt",
    exports:{},
    n:function(){console.log("function n ")}
}
}("echo this")
//2.2
!function(e){
    console.log(e)
     var n={
    t:"txt",
    exports:{},
    n:function(){console.log("function n ")}}
}(
    {
        "test":function(){
                console.log("test")}
    }
)
//(["test":function(){console.log])
call/apply Function
[Fcuntion prototype call and  applay ](Function.prototype.call() - JavaScript | MDN
(mozilla.org))
允许为不同的对象分配和调⽤属于另⼀个对象的函数/⽅法。
call和apply的使⽤效果基本⼀致，可以让A对象调⽤B对象的⽅法：
让 Vx 对象调⽤ _x 对象的 say() ⽅法
var Vx={
       name:"⼀位不愿透露姓名的热⼼⽹友",
       age:"18cm"
};
var _x={
    name:"热⼼⽹友",
    age:"18mm",
    say:function(){console.log("name:"+this.name+" age:"+this.age)}
}
_x.say.call(Vx)
//name:⼀位不愿透露姓名的热⼼⽹友 age:18cm
Webpack
webpack ⼀个静态模块打包器，有⼊⼝、出⼝、loader 和插件，通过loader加载器对js、
css、图⽚⽂件等资源进⾏加载渲染。
实战站点：https://spa2.scrape.center/
WebPack 站点⻓什么样
⽅法1. 右键查看源码发现只会有js链接⽂件，没有其他多余的前端信息，f12看元素就会有
很多数据。
⽅法2. 看Js⽂件，⼀般会有⼀个app.xxxx.js或⻓得像MD5的⽂件名，然后js内容有很多a、b、
c、d、n...的变量来回调⽤，反正就是看着乱。
loader加载器
Webpack站点与普通站点的JS代码扣取是不⼀样的，因为Webpack站点的资源加载是围绕着加
载器进⾏的，然后把静态资源当作模块传⼊调⽤，传⼊的模块就是参数，需要加载什么就运⾏
什么模块。
先简单看⼀下加载器⻓相。
!function(e){
    var t={}
    function d(n){
        if (t[n])
            return t[n].exports;
        console.log(n)
        var r = t[n] = {
            i:n,
            l:!1,
            exports:{}
            };
        return e[n].call(r.exports,r,r.exports,d),
        r.l = !0;
   ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Antenna comparison
20 antennas were tested to see which ones were the best for receiving.
All the antennas are 3/4" Motorola TAD/TAE mount (aka "NMO").
The following lists are ordered as per what you see in the picture (left to right).
General information:
Manufacturer         Model                 Type                                             Freq rating/gain
-------------------  ------------------    ----------------------------------------------   -------------------------
Larsen               NMO-27 (new style)    1/4 wave base loaded                             27-28/0dB
Radiall/Larsen       NMO-27B               1/4 wave base loaded                             27-28/0dB
Larsen               NMO-30B               1/4 wave base loaded                             30-40/0dB
Larsen               NMO-50C               1/4 wave base loaded                             47-54/0dB
Larsen               NMO-2/70 (old sytle)  loaded 1/2 (VHF), closed coil collinear (UHF)    144-
148/6dB 440-450/3.5dB
Larsen               NMO-150 (new sytle)   5/8 wave base loaded                             144-148/3dB
Larsen               NMO-Q                 1/4 wave                                         150-170/0dB
Larsen               NMO-Q                 1/4 wave                                         95-105/0dB
Antenna Specialists  ASPRD1615             1/4 wave                                         430-470/0dB
Maxrad               BMUF9000              1/4 wave                                         896-940/0dB
Larsen               NMO-450               5/8 over 1/2 wave closed coil collinear          450-470/3.4dB
Motorola             TDE6082A (?)          closed coil collinear                            460-470/5dB
Larsen               NMO-UHF               5/8 over 1/4 wave open coil collinear            450-470/3.2dB
Maxrad               BMUF8125              1/2 over 1/2 over 1/4 wave open coil trilinear   806-866/5dB
Maxrad            ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!
 " #$
%
&''&
(
#)
*
+
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
&,)
&''&
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
(
-
+
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
)
#
(
#
!
"
#
$
%
%
&"
$
'
#
!
%
%
(
%
%
)
!
%
!
*
+
 *
,
-
 "
+
./
.
0
1
2
"
!
%
+
3
4
5
6
44
#
7
6
4
.
-
4
43
,
"
,
4
4
0
4
48
+
5!9
4
4:
,
"
+
4
4;
$
)
%
48
,
46
3
4<
34
=
4<
3
5
.
33
3
3
+
:
4
:
&
:
3
+
;
8
5
3
84
3
8
3
83
+
34
8
'
34
:
=
33
8
!4
,
>
!
(
%
!
>!
(
<
!
,
-
'
46
!3
%
4
!
<
!8
,
'
?
*
43
4
3
!:
,
3
:
4
=
*
4:
88
!
;
@
,
%
9
,
%
"
?
%
A
0
%
,
%
'!
9
,
5
%
%
"
5
%
%
,
-B
.
%
!
'
%
5
!
%
!
"
=
44
%
C-
,1<<D
%
E
F
."
%
%
!
%
?
A
5
!
5
5
!
6
Visible
Watermarking
Covert Channels
Steganography
Anonymity
Copyright Marking
Information Hiding
Linguistic
Steganography
Technical
Steganography
Robust
marking
Fragile
marking
Fingerprinting
Watermarking
Imperceptible
Watermarking
=
!4*
,
>
(
%
>
(
'
5
%
%
"
)
%
"
#
"
/
/
5
%
"
'
'
'
5
'
"
%
"
Æ
,
%
%
"
C1-<<D
%
B
"
C-
,1<6
,-D
%
"
%
"
<
,
%
*
!
&
!
%
+
!
$
CG$<6
D
C<6D
%
"
!
%
"
0
%
Æ
'
C1-D
)
E)
@
F
C,-<6D
%
"
%
%
%
%
%
"
%
%
%
9
'
%
%
%
%
%
%
'
"
$
%
5-
%
'
%
(
C6
D
5
,
9
4
#
%
%
#
%
%
"
%
%
%
!
"
%
5
0
#
"
#
-BC#-<<D
0
"
H
"
%
!
%
"
%
?
%
A
%
I
"
,
'
"
%
%
"
"
B
5
"
H
"
"
"
%
B
%
0
%
%
'
B
%
)
!
%
%
)
'
2!
,
"
H
"
%
!
J
"
5
"
5
"
"
%
%
%
!
'
"
44
%
"
"
"C-
,1<6
,-D
%
"
%
"
%
)
5
%
%
!
!
"
,
C<6D
B
?
"A
5
"
%
&
5
"
%
"
?
A
Æ
)
!
0
%
"
%
%
1
/
(
!
%
"
2
%
'
1(
E
"
FC1:;
D
%
"
%
!
)
'
%
"
K
"
"
'
5
"
%
'
"
,
#
4
#
5
5
%
B
"
)
0
,
-
%
0
%
%
!!
%
,
0
"
0
%
%
,
%
(
5
'
(
?
%
%
A
%
J
+
!
'
%
!
%
C#-<<
=
.4
D
%
,
"
%
%
%
!
'
5
#
#
5
5
%
"
!
5
E=
F
%
E=
F
%
E5
=
7F
'
%
5
%
%
%
%
43
"
#
$%&'
,
C
D
CGD
C
D
%
0
%
"
%
C#-<<
=
.4
D
,
%
"
=
)
C-4D
!
"
%
%
)
,
%
%
=8
C#
4
D
(
#
%
'
%
!
%
5
%
/
%
C#-<<
=
.4
-0D
5
'
Æ
!
'
%
"
%
!
?
A
5...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Google Drive 上传⼯具编写
有⼀天，有⼈找我帮忙写⼀个⼯具，被我义正⾔辞的拒绝了。我可不帮⼈写⼯具，我只是爱学习。
这部分内容，官⽅⽂档写得很是清楚。Google 提供的 APIs 访问是基于 Oauth2.0 认证的，其流程可以
⼤致分为以下⼏个步骤：
1. 客户端 App 发起认证（若⽤户没有登录，则需要先登录）
2. 弹出授权⻚⾯，⽤户点击允许后，Google 认证服务器给我们返回⼀个授权码（Authorization
code）
3. 客户端获取到授权码以后，⽤授权码向认证服务器请求 Access Token
4. 服务器验证授权码⽆误后返回 Access Token ⾄客户端
5. 拿到 Access Token 以后，就可以访问 Google APIs 了（其实这⾥还会返回⼀个Refresh token）
⼤家直接看下⾯的图可能会⽐较好理解⼀点：
上⾯的流程只是基于第⼀次获取 Access Token 的情况，因为 Access Token 是有期限的，默认是1个⼩
时，Access Token 过期之后，就需要通过 Refresh Token 来向 Google 认证服务器申请⼀个新的
Access token，不需要经历上⾯的1,2,3步。
0x00 基本认证
2
Refresh Token 并不是⼀直有效的，在下⾯的⼏种情况下将会失效：
⽤户撤销了对应⽤程序的授权
该 Refresh Token 已超过 6 个⽉未使⽤
⽤户修改了密码，并且 Refresh Token 授权的 Scope 包含了 Gmail
⽤户账号的 Refresh Token 数量已超出最⼤数量
⽤户属于具有有效会话控制策略的 Google Cloud Platform 组织
⽬前每个⽤户账号每个授权凭证有 25 个 Refresh Token 的数量限制，如果超过了这个限制，当你新建
⼀个 Refresh token 的时候将会使最早创建那个失效。⼀般来说，我们在经过⽤户授权，拿到授权码请
求到 Refresh Token 后，必须把它缓存起来，以便后续更新 Access Token。
因此在实际使⽤时，使⽤ Refresh Token 来申请 Access Token 即可。
登录 Google，访问 https://console.cloud.google.com/cloud-resource-manager?organizationId=0
点击创建项⽬
0x01 Refresh Token 期限
●
●
●
●
●
0x02 实操获取 Token
2.1 创建应⽤及 OAuth 客户端 ID
3
项⽬名称可⾃定义。创建后进⼊ 【API 和服务】-> 【OAuth 同意屏幕】
4
5
完成之后，进⼊【凭证】创建 OAuth 客户端 ID。
应⽤类型选择【桌⾯应⽤】-> 【创建】。
成功获取到想要的客户端 ID 和 客户端密钥。
还有两步，差点忘了。
6
选择【库】，搜索 【Google Drive API】-> 【启⽤】
组装⼀下连接，放⼊浏览器中访问：
2.2 获取 Authorization code
Plain Text
复制代码
https://accounts.google.com/o/oauth2/auth?client_id=[Application Client
Id]&redirect_uri=http://localhost&scope=[Scopes]&response_type=code
1
7
由于我这⾥已经登录了账号，因此直接点⼊账号即可。
8
成功获取 code。
关于常⽤的 Scope
POST 请求以下内容：
2.3 获取 Access Token 和 Refresh Token
Scope
描述
https://www.googleapis.com/a
uth/drive.file
对应⽤程序创建或打开的⽂件进⾏逐个访问
https://www.googleapis.com/a
uth/drive
访问⽤户所有⽂件的完全、允许的范围。只有在严格需要的情
况下，才会申请这个范围。
https://www.googleapis.com/a
uth/drive.appdata
允许访问 应⽤程序数据⽂件夹
9
成功获取到两个 Token。
由于每个 Access Token 有效时间很短。因此当 Access Token 过期后，服务器需要使⽤ Refresh
Token 来获取新的 Access Token 。
2.4 通过 Refresh Token 获取 Access Token ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

30/06/2009
1
Chema Alonso, José Palzón
30/06/2009
2
 Metadata:
 Information
stored
to
give
information
about
the
document.
▪ For example: Creator, Organization, etc..
 Hidden information:
 Information internally stored by programs and not
editable.
▪ For example: Template paths, Printers, db structure, etc…
 Lost data:
 Information which is in documents due to human mistakes
or negligence, because it was not intended to be there.
▪ For example: Links to internal servers, data hidden by format, etc…
Wrong management
Bad format conversion
Unsecure options
New apps
or program
versions
Embedded
files
Search engines
Spiders
Databases
Embedded
files
Wrong management
Bad format conversion
Unsecure options
30/06/2009
3
 The answer is NOT.
 Almost nobody is cleaning documents.
 Companies publish thousand of documents
without cleaning them before:
 Metadata.
 Hidden Info.
 Lost data.
Total:  4841 files
30/06/2009
4
Real Name
Username
Internal Domain
.. And more…
30/06/2009
5
Total:  896 files
30/06/2009
6
Total:  1075 files
30/06/2009
7
User
Software Version
Internal Server NetBIOS name
Remote Printer Name
Local Printer
30/06/2009
8
30/06/2009
9
 Office documents:
 Open Office documents.
 MSOffice documents.
 PDF Documents.
▪ XMP.
 EPS Documents.
 Graphic documents.
▪ EXIFF.
▪ XMP.
 And almost everything….
30/06/2009
10
EXIFREADER
http://www.takenet.or.jp/~ryuuji/
30/06/2009
11
http://video.techrepublic.com.com/2422-14075_11-207247.html
30/06/2009
12
30/06/2009
13
 Users:
 Creators.
 Modifiers .
 Users in paths.
▪ C:\Documents and settings\jfoo\myfile
▪ /home/johnnyf
 History of use.
 Operating systems.
 Software versions.
 Paths.
 Local and remote.
 Network info.
 Shared Printers.
 Shared Folders.
 ACLS.
 Printers.
 Local and remote.
 Internal Servers.
 NetBIOS Name.
 Domain Name.
 IPAddress.
 Database structures.
 Table names.
 Colum names.
 Devices info.
 Mobiles.
 Photo cameras.
 Private Info.
 Personal data.
30/06/2009
14
 Info is in the file in raw format:
 Binary.
 ASC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle
STICK THAT IN YOUR
(ROOT)PIPE & SMOKE IT
“leverages the best combination of humans and technology to discover
security vulnerabilities in our customers’ web apps, mobile apps, and
infrastructure endpoints”
WHOIS
@patrickwardle
always looking for
more experts!
xpc, rootpipe, malware, patches & 0days :)
OUTLINE
overview of XPC
the bug
in malware
patch bypass
patch(es)
Credits
hax0ring is rarely an individual effort
Ian Beer
Emil Kvarnhammar
Pedro Vilaça
uncovered rootpipe
Jonathan Levin
"Mac OS X & iOS Internals"
@emilkvarnhammar
@osxreverser
implants
backdoor
remotely accessible means of
providing secret control of device
injection
coercing a process to load a module
persistent malicious code
hooking
intercepting function calls
trojan
malicious code that masquerades as
legitimate
gotta make sure we’re all on the same page ;)
SOME DEFINITIONS
OVERVIEW OF XPC
modern IPC on OS X
a simple IPC mechanism which can provide security & robustness
XPC
“There are two main reasons to use XPC: privilege
separation and stability.” -apple.com
sandboxed
'XPC services'
[privilege separation]

[stability]
each XPC service has its
own sandbox
crashes in the XPC services
don't affect the app
used all over the place by Apple
XPC IN OS X
$
  find
  /System/Library/Frameworks
  -‐name
  \*.xpc
AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.FaceTimeService.xpc
AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.MapLauncher.xpc
...
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.32.xpc
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.64.xpc
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc
$
  find
  /Applications
  -‐name
  \*.xpc

iPhoto.app/Contents/XPCServices/com.apple.PhotoApps.AVCHDConverter.xpc
iPhoto.app/Contents/XPCServices/com.apple.photostream-‐agent.VideoConversionService.xpc

Xcode.app/Contents/Developer/Toolchains/.../XPCServices/SourceKi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Vulnerabilities 101:
How to Launch or Improve Your
Vulnerability Research Game
Joshua Drake, Zimperium
Steve Christey Coley, MITRE
DEF CON 24
Aug 7, 2016
Introductions
• About Josh
– 20-years of VR, Ran iDefense VCP
• About Steve
– CVE co-founder, “Responsible Disclosure” (sorry), CVSS,
CWE, ...
• Why we are doing this
– Currently, there is *way* more insecure code out there than
researchers. This isn't guaranteed in 10 years, though.
– We need more people looking at code that’s deployed in the
real world
• What we hope to accomplish by doing this
– Encourage more people to get involved
Disclaimers
• This is our opinion only
• Based on our own career experiences
• Others have their own opinions
• YOU… proving the cliche… are a unique
snowflake
• You’ll find your own way, but hopefully we can
help you find it faster
• No new ‘sploits here
What is a Vulnerability?
• Too many definitions
– Roughly: “a mistake in software’s design or implementation that allows
an ‘attacker’ to conduct activities that (1) affect other users and (2) are
not explicitly allowed or intended by the developer or sysadmin.”
• “What do you have?” vs. “What do you get?” - there must be a
difference
• “How much help must the victim give you?”  (user interaction)
– Automatic
– “Normal” usage (e.g., clicking on a link is *normal*)
– Was victim stupid/clueless? (“just copy this javascript: url
into browser”)
• “How much luck do you need?”
–ASLR, unusual configs, narrow race windows
What is a Vulnerability? (2)
•Vulnerabilities != Exploits (awesome
@SwiftOnSecurity tweet)
•A Vulnerability resides in the software itself,
doing nothing on its own
•An Exploit is a set of steps (possibly manual, or in
the form of a program) that interacts with the
software in a way that has a non-zero chance of
successfully taking advantage of a vulnerability”
What is Vulnerability Research?
• “The process of analyzing a product, protocol, or algorithm
in order to find unintended behaviors that allow an at...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MacOS Big)Sur内核漏洞挖掘和利用
Bio
0 1
Twitter(@peterpan980927)
阿里安全潘多拉实验室
高级安全工程师
iOS/macOS 安全研究&开发
KCon 2019 PPT 放映员&乐透操作手
Agenda
0 2
1.
Backgrounds
2.
Some case studies
3.
Mitigations overview & new features
4.
Attack macOS Big Sur
5.
Summary & Credit
Backgrounds
AppleOS Kernel
0 3
XNU: X is not Unix(Hybrid Kernel)
1.
Mach->(micro kernel)
2.
BSD
3.
IOKit
Mach Ports
0 4
Basic concepts
1. Communication channels for IPC
2. 32bit number in userspace
3. ipc_port struct in kernel space
4. Single receiver/One or Multiple Senders
/osfmk/ipc/ipc_object.h
struct ipc_port {
struct ipc_object ip_object;
struct ipc_mqueue ip_messages;
…
};
struct ipc_object {
ipc_object_bits_t io_bits;
ipc_object_refs_t io_references;
lck_spin_t io_lock_data;
}___attribute__((aligned(8)));
Mach Ports
0 5
Basic concepts
1.
Many kernel data objects are wrapped with mach ports
2.
E.g: Tasks(tfp0)/Driver instance(C++ obj)/clock/file_glob…
/osfmk/kern/ipc_kobject.h
#define IKOT_CLOCK
25
#define IKOT_IOKIT_CONNECT
29
#define IKOT_IOKIT_OBJECT
30
#define IKOT_VOUCHER
37
…
Mach Ports For IPC
0 6
Overview
Apple Driver
0 7
IOKit part
IOKit是一套基于C++子集构建的框架、库、工具和资源
支持设备的动态和自动配置（即插即用）
抢占式多任务，对称多处理…
不支持异常，多重继承，模版和RTTI
KEXT是内核扩展，包含Apple Driver
Apple Driver
0 8
Why?
1.
Kexts run inside kernel, some can even reachable within
the sandbox
2.
Kext deprecated in WWDC 2019
3.
System Extension replacing third party kext: DriverKit、
NetworkExtension、Endpoint Security
4.
Less developers, less attention
Apple Driver
0 9
Attack Surface
1.
ExternalMethod(driver independent)
2.
Notification Port(CVE-2020-9768)
3.
SharedMemory(TOCTOU)
4.
clientClose(CVE-2018-4326)
5.
setProperties(CVE-2016-1835)
Etc…
Apple Driver
1 0
Attack Surface
1.
ExternalMethod(driver independent)
2.
Notification Port(CVE-2020-9768)
3.
SharedMemory(TOCTOU)
4.
clientClose(CVE-2018-4326)
5.
setProperties(CVE-2016-1835)
Etc…
Apple Driver
1 1
Attack Surface
http://homes.sice.indiana.edu/luyixing/bib/CCS20-iDEA.pdf
Case)studies
Case Studies
1 2
CVE-2016-1825(baza...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IOT安全 - 测信道实战
演讲人：KEVIN2600
2019
@Kevin2600
议程
. 测信道的那点事
. 测信道案例简析
. 测信道 Power Analysis
测信道的那点事
测信道攻击是一种针对软件或硬件设计缺陷, 剑走偏锋的攻击方式
攻击途径通常采用被动式监听, 或通过特殊渠道发送隐蔽数据信号
攻击点不在暴力破解, 而是通过功耗; 时序; 电磁泄漏等方式达到
破 解 目 的 .  在 很 多 物 理 隔 绝 的 环 境 中 , 往 往 也 能 出 奇 制 胜
测信道
测信道
. Public key signature check
. Bootloader 加固 (bootdelay = 0)
. 屏蔽调试端口 UART; JTAG; SPI; I2C
. 电子设备全部物理隔离 (Air Gapping)
测信道 WordPress
测信道 Drupal
测信道门禁
测信道门禁
被动式:
: 声波信号采集还原打印机原文
: 美国 NSA 电磁波监听 (TEMPEST)
: 功耗分析破解南韩公交卡密钥系统 (3DES)
: 功耗分析获取 Philipe Hue 智能灯系统密钥 (AES)
主动式:
: Xbox360 Glitch 攻击 (运行 unsigned code)
: 智能网关 Hue NAND Glitch (得到 Root 权限)
: 通过毛刺注入成功获取硬件钱包 Trezor 闪存敏感信息
: 以色列 Ben-Gurion 大学通过 USB 发送电磁信号 (USBee)
测信道案例简析
时耗分析
时耗分析
NAND-Glitch
NAND-Glitch
物联网设备网关 (WinkHub)
通过网页对其进行访问 (set_dev_value.php)
curl “192.168.01/set_dev_value.php” -d “nodeId=a&attrId=; uname -a;”
NAND-Glitch
. NAND Flash 通常存储固件; Bootloader; 内核以及root files
. 使用数据线在系统启动, 读取 NAND 内核信息瞬间, 短接 I/O pin
. 在正确的时间点, 阻止 Bootloader 读取正确的内核数据从而进入
  shell 模式
NAND-Glitch
测信道 Power Analysis
功耗分析
. Power analysis (Simple & Differential)
. 处理器运行不同指令在功耗需求上也不近相同
. 需要了解目标设备所采用的加密算法
. 信号的采集必须在加密或解密的过程中完成
功耗分析
功耗分析 (ChipWhisperer)
. Colin O'Flynn 设计制作, 学习 SCA 功耗分析和毛刺注入神器
. 基于Python 跨平台开源软硬件项目 (Windows; Linux; MacOS)
. 可用于时序或电压毛刺注入攻击测试, 产生 <2nS 的脉冲信号
. 通过 DPA 差分功耗分析获取诸如 RSA; AES; 3DES 等加密密钥
功耗分析 (SPA)
. 处理器运行验证指令在功耗表现上不尽相同
. 密码验证过程功耗表现 (密码错误 -->无限循环)
. 寻找目标设备在特定时刻 (加密/解密) 功耗图形的差异
功耗分析 (SPA)
功耗分析 (DPA)
目标设备
测量方法
测量结果
功耗分析 (DPA)
功耗分析 (DPA)
功耗分析 (AES-128)
功耗分析 (DPA)
功耗分析 (电磁信号)
. 电磁波可通过 H 探头和软件无线电设备远程获取
. 芯片01转换产生电磁波从空气中泄漏, 其中包含密
  钥指纹信息
. Tel Aviv 大学科研人员通过测量分析电磁发射获取
  GnuPG 密钥信息
功耗分析 (电磁信号)
功耗分析 (DPA)
One More Thing ..
测信道 EMFI
测信道 EMFI
测信道 EMFI
测信道 EMFI
测信道 EMFI
Summary
百分百安全的系统并不存在
边信道分析与防御, 硬件安全必备技能
完美的设计, 实施过程中百密⼀疏, 将导致系统完全崩溃
谢谢观看
演讲人：KEVIN2600


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Mobile App Moolah:
Profit taking with Mobile Malware
Jimmy Shah
Mobile Security Researcher
Mobile App Moolah: Profit taking with Mobile Malware
2
•
Who we are
•
Mobile malware
•
Modern for-profit malware
•
Examples
Contents
Mobile App Moolah: Profit taking with Mobile Malware
3
Who we are
•
Mobile Antivirus Researchers
•
My team and I specialize in mobile malware and threat analysis on
existing(J2ME, SymbOS,WM, Apple iOS, Android) and upcoming
mobile platforms.
•
We work with a number of large mobile network operators.
Mobile App Moolah: Profit taking with Mobile Malware
4
Mobile Malware
In the Wild
Historical For-profit malware
Trends
Mobile App Moolah: Profit taking with Mobile Malware
5
In the Wild
SymbOS
J2ME
Android
Python
WinCE
MSIL
VBS
BlackBerry
Exploit
Linux
OSX
1200+ variants
Mobile App Moolah: Profit taking with Mobile Malware
6
Mobile Malware
In the Wild
Historical For-profit malware
Trends
Mobile App Moolah: Profit taking with Mobile Malware
7
•
What it does
– First reported J2ME trojan(2006)
– Pretends to access WAP web pages via SMS messages
– Written using the MIDletPascal programming tool
•
Profit?
– In reality, it attempts to send SMS messages to Premium Rate SMS
numbers
– Eventually spawned a large number of J2ME malware/variants
J2ME/Redbrowser.A
RedBrowser installation prompt
(Symbian OS, S60 UI)
“Carefully read following description of RedBrowser program
This program allows viewing WAP pages without GPRS
connection. RedBrowser connects to SMS server of your
operator (MTS, BEELINE, MEGAFON). Page is loaded by
receiving coded SMS. First 5Mb (650 SMS) of traffic are
provided free of charge in test mode. ATTENTION!!!
Program RedBrowser works ONLY on above mentioned cellular
operators.”
description text (original text in Russian)
Mobile App Moolah: Profit taking with Mobile Malware
8
J2ME/Wesber.A
•
What it does
– No GUI, almost pure for-profit J2ME trojan
– Program that disguises itself as an assistant program
– It contains two jpg ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
The Wide World of WAFs
Ben Feinstein, CISSP GCFA
SecureWorks Counter Threat Unit™
DEFCON 16
August 8, 2008
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Web Application Firewalls (WAFs)
•
PCI Data Security Standard
 Requirement 6.6
 Why should you care?
•
ModSecurity
 Concepts
 Core Rules
•
ModSecurity WAF Live Demos
 Reverse Proxy
 Embedded
 Content Injection in Response to Attack
What’s In This Talk?
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Firewall operating at the web application layer
•
Hardware or Software
•
Fluent in many tongues
 HTTP / HTTPS
 XML
 SOAP
 XML-RPC
 WS-*
•
Performs normalization / de-obfuscation
•
Detects attacks
•
Blocks attacks
•
Rewrites / Modifies requests and responses
Web Application Firewalls (WAFs)
The Basics
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Apache dynamically loadable module
•
Dual License
 Community Edition - GPLv2
 Commercial License
•
Created by Ivan Ristic
•
Commercialized by Breach Security
•
Core Rules released under GPLv2
ModSecurity Web App Firewalls
The Basics
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
I apologize in advance if I bore you
•
PCI is driving adoption of WAF (and Web App Vulnerability
Scanning)
•
Pentesters (i.e. QSAs): PCI will drive your business. You
will need to be familiar with WAFs to evaluate and subvert
them.
•
IT Security: You will be deploying WAFs because of PCI
•
Blackhats: You will be subverting WAFs for fun and profit!
Meet the Payment Card Industry!
Why Should You Care?
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Lots of new acronyms, yea!
•
PCI Security Standards Council (PCI)
•
PCI Data Security Standard (PCI DSS)
•
Other PCI security standards exi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows GDI Local Kernel Memory Overwrite
Vulnerability researched and exploit developed by
Joel Eriksson <joel.eriksson@bitsec.com>
About the bug
The Graphics Device Interface, GDI, is part of the Win32-subsystem and is responsible for displaying
graphics on devices such as video displays as well as printers.
Basic information about all GDI objects on the system are stored in a shared memory section named
GdiSharedHandleTable. This table is automatically mapped read-only into every GUI-process on the
system and its contents are only updated by the kernel.
Well, that is how it was supposed to be anyway. If one is able to determine the handle to the
GdiSharedHandleTable shared memory section, it is possible to make an alternate mapping with full
read-write access. Being able to write to data which only the kernel is supposed to write to can never be
a good thing, depending on ones perspective of course.
This bug was found and reported to Microsoft by Cesar Cerrudo from Argeniss over two and a half
years ago now (2004-10-22), but was not made public until the “Month of Kernel Bugs” project [1] in
November 2006. Windows 2003 and Vista is not vulnerable, but all releases of Windows 2000 and XP
were, until a couple of weeks after our talk at BlackHat Europe when a patch was released. ;)
When Cesar made the bug public, he made a PoC exploit available for crashing the system by filling
the entire table with 0x58-chars. I expected a real exploit for the bug to be released shortly afterwards,
but time went by and neither an exploit nor a patch was released. In January I decided to give it a try
myself.
By this time I had no idea whether it was even possible to reliably exploit this vulnerability, since it
was far from obvious judging from the PoC exploit and the crash it produced due to a read from NULL
pointer.
Reliably determining the GDI section handle
The first problem I faced was to come up with a reliable way for determining the handle to the sh...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Revealing Embedded Fingerprints:
Deriving intelligence from USB stack
interactions
 Andy Davis, Research Director NCC Group
Image from: p1fran.com
UK Offices
Manchester - Head Ofﬁce
Cheltenham
Edinburgh
Leatherhead
London
Thame
North American Offices
San Francisco
Atlanta
New York
Seattle
Australian Offices
Sydney
European Offices
Amsterdam - Netherlands
Munich – Germany
Zurich - Switzerland
Agenda
Part One:
• Overview of the USB enumeration phase
• Different USB stack implementations
• USB testing platform
• Installed drivers and supported devices
• Fingerprinting USB stacks and OS versions
Part Two:
• The Windows 8 RNDIS kernel pool overflow
• Challenges faced when exploiting USB bugs
• Conclusions
Part One: Information gathering
• Why do we care?
• If you connect to a device surely you already know the platform?
• Embedded devices are mostly based on Linux anyway aren't they?
• May provide information useful for other attacks
USB Background stuff
Image from: blog.brickhousesecurity.com
Overview of the USB enumeration phase
• What is enumeration for?
• Assign an address
• Speed of communication
• Power requirements
• Configuration options
• Device descriptions
• Class drivers
• Lots of information exchange – implemented in many different ways
Image from :http://ewalk2.blog117.fc2.com
The USB enumeration phase
Enumeration phase peculiarities
• Why is the device descriptor initially requested twice?
• Why are there multiple requests for other descriptors?
• Class-specific descriptors:
Different USB stack implementations
• Typical components of a USB stack
• Windows USB driver stack
• Linux USB stack
• Embedded Access USB stack
Image from: blogs.msdn.com
Typical components of a USB stack
• Host Controller hardware
• USB System software:
• Host Controller Driver – Hardware Abstraction Layer
• USB Driver
• Class drivers
• Application software
Image from: www.wired.com
Windows USB driver stack
Ima...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MSI - Microsoft Windows Installer Elevation of Privilege
Summary: The Microsoft Windows Installer permits under some circumstances to a “standard user” an arbitrary
permissions and content overwrite with SYSTEM privileges.
( Microsoft Windows Installer: https://docs.microsoft.com/en-us/windows/win32/msi/windows-installer-portal )
Products affected: Windows 10 Enterprise (1903) with latest security update (2019 November patch) and probably
also other versions (not tested). Windows 10 Enterprise - INSIDER PREVIEW (Fast ring) 10.0.19033 - Build 19033
Description:
It is possible and allowed by “Windows Installer service” to install a MSI package as “standard user”.
I have noticed, in my research, that when a “standard user” installs a MSI package , the “Windows Installer
service” triggers some operations with SYSTEM privileges. (see image below from Procmon)
Going forward with my research I found that, after a package is installed on the system, a “standard user” could
force a repair of the product with “/f” command line parameter.
In our case, for example, command “msiexec /qn /fa foo.msi” triggers the repair operation .
With this command I’ve seen a couple of interesting operations came out that caught my attention.
As SYSTEM, the  “Windows Installer service” try to set the permissions of the package files that are going to be
reinstalled.
After that, it read and writes the content of the package files ( stored within msi package ).
See image below from Procmon.
As we can see, the first time “Windows Installer service” tries to open one the files impersonating the “standard
user” but as a result it gets a “PRIVILEGE NOT HELD”, then, after that, it closes the file and reopens it as SYSTEM
without impersonating! Afterward it continues to set the permissions of the file as SYSTEM and writes its content.
This is clearly a point of possible exploitation! In order to obtain the desired a result, a “race condition” has to be
successfully exploited. The ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2017年，"Process Doppelganging", NTFS+section
https://github.com/hasherezade/process_doppelganging
https://www.youtube.com/watch?v=Cch8dvp836w
进程的创建不支持NTFS transacted文件,所以分割进程的步骤寻找创建方法
跟踪 CreateProcessW 调用 （xp）
NtOpenFile
NtCreateSection
NtCreateProcessEx
...
NtCreateThreadEx
在win10下，直接使用 NtCreateUserProcess 创建，看起来无法使用ntfs了，但是微软为了
兼容，也可以使用之前xp的创建进程的方法。
2018年
transacted_hollowing
https://github.com/hasherezade/transacted_hollowing
进程替换，只是利用了ntfs translation 和 file delete pending
2021年
Process Ghosting
https://github.com/hasherezade/process_ghosting
使用 delete pending file + Process Doppelganging的手法
NTFS Transactions
Delete Pending
逆向 DeleteFileW ，可以看到使用 NtOpenFile -> NtQueryInfomationFile -> NtClose
用NtOpenFile打开的文件只需要设置delete标志，使用
NtSetInformationFile(FileDispositionInformation) 设置文件为delete-pending
写入文件，因为文件状态是delete-pending,内容可以写入，但是其他外部文件读取会失败。
当关闭文件句柄时，文件也会被删除。


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 101
FIRST – A BRIEF MOMENT
OF SILENCE
DevNull
KingTuna
WELCOME TO DEF CON
HighWiz @highwiz
Will @bsummerz
Niki7a @Niki7a
Magen Wu @magen_wu
SecBarbie @SecBarbie
Shaggy @ShaggyMcG
n00bz @n00bznet
MEET THE PANEL
WELCOME TO LAS VEGAS
Pace Yourself
THIS IS DEF CON
DGAF
Everyone was a
n00b once.
All of us are still
n00bs at something.
THE COUNTDOWN
Simple rules for surviving DEF CON
Wash your hands, too
Three Hours Daily
Two meals daily
Once Per Day
THIS IS THE DESERT
Stay hydrated
All Good
Sit Down
And Drink
Water
Grab A
Glass of
Water
Call A
Doctor
THE DEF CON CRUD
Fist your friends
Fist them often
Seriously, wash your damn hands
THIS IS DICK
DON’T.
BE.
A.
DICK.
THE BASICS
Hold the door.
Keep your head up.
Pay attention.
Don’t block the hallway.
DON’T BA AN ASSHAT
Don’t ruin everyone’s time
DON’T HECKLE
If you don’t agree, talk
afterwards.
See the previous slide.
PHONES AND WIRELESS
Seriously?
This is a hacker convention.
Use your head.
ASK PERMISSION
Personal Space
PICTURES
Be Polite – Ask first
Still, expect to be in a picture or two.
Ask nicely if you don’t want to be in one.
NOT EVERYTHING IS FREE
Just because you see it laying
out, does not mean you can
take it.
HAVE A PLAN
Read the program.
HACKER TRACKER!
Talks fill up quickly.  Consider purchasing the videos from
TSOK.
HACKER TRACKER
• The official schedule app for
DEF CON
• Lots of good info about
DC27
• Available on the App Store
and Google Play
• You should have
downloaded it before now
THE TALKS
VILLAGES
AI Village
AppSec Village
Aviation Village
BCOS Block Chain Village
Bio Hacking Village
Blue Team Village
Car Hacking Village
Cloud Village
Crypto & Privacy Village
Data Duplication Village
Hardware Hacking Village
DroneWarz Village
Ethics Village
Hack the Sea Village
Ham Village
ICS Village
Internet of Things Village
Lock Bypass Village
Lock Pick Village
Monero Village
Packet Hacking Village
r00tz Asylum
Recon Village
Red Team Offense Village
Rogue’s Village
Social Engineering Village
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sniper Forensics
“One Shot, One Kill”
Christopher E. Pogue - Trustwave
Copyright Trustwave 2009
Confidential
Thank You Dan Christensen!
http://dcdrawings.blogspot.com/
Copyright Trustwave 2009
Confidential
Who Am I?
•
Senior Security Consultant for the Trustwave SpiderLabs
•
Master’s degree in Information Security
•
Author of “Unix and Linux Forensic Analysis” by Syngress
•
Author of the blog, “The Digital Standard”
•
Board of Governors for the HTCIA
•
Member of the USSS Miami Electronic Crimes Task Force
•
Speaker @ SANS “What Works in Incident Response” ‘09 and ‘10, The
Computer Forensics Show ‘09 and ‘10, Direct Response Forum, SecTor
‘09 and ‘10, USSS ECTF - Miami Conference, The Next HOPE,
BSIDESLV, and most recently, DEF CON 18.
•
Former US Army Signal Corps Warrant Officer
•
Former CERT team member – SEI at CMU
Copyright Trustwave 2009
Confidential
Agenda
• What is Shotgun Forensics?
• What is Sniper Forensics?
• Guiding Principles
• Create an Investigation Plan
• Data Reduction
• Volatile Data Gathering and Analysis
• Data Correlation
• Tools
• Case Studies
• Bring it All Together
• Conclusion
Copyright Trustwave 2009
Confidential
Shotgun Forensics
The process of taking a haphazard, unguided approach to
forensic investigations:
• “Old school”
• Image everything
• Reliance on tools –
autopilot
• Pull the plug
Copyright Trustwave 2009
Confidential
Sniper Forensics
The process of taking a targeted, deliberate approach to
forensic investigations:
• Create an investigation plan
• Apply sound logic
−
Locard
−
Occam
−
Alexiou
• Extract what needs to be extracted, nothing more
• Allow the data to provide the answers
• Report on what was done
• Answer the questions
Copyright Trustwave 2009
Confidential
Three Round Shot Group
Infiltration
• How did the bad guy(s) get onto the system(s)
Aggregation
• What did they do
−
What did they steal
Exfiltration
• How did they get off the system
−
How did they get stolen data off the system
* This is commonly referre...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Go With the Flow
Enforcing Program Behavior Through Syscall Sequences and Origins
Claudio Canella (@cc0x1f)
August 11, 2022
Graz University of Technology
Who am I?
Claudio Canella
PhD Candidate @ Graz University of Technology
 @cc0x1f
 claudio.canella@iaik.tugraz.at
1
Claudio Canella (@cc0x1f)
2002 2004 2006 2008 2010 2012 2014 2016 2018 2020 2022
0
0.5
1
1.5
2
·104
2,1561,527
2,451
4,935
6,6106,520
5,6325,736
4,6534,155
5,2975,191
7,939
6,5046,454
14,714
16,55717,344
18,325
20,149
15,044
Year
Vulnerabilities1
1Source: http://www.cvedetails.com/vulnerabilities-by-types.php
2
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
3
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
Limit Post-Exploitation Impact
3
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
Limit Post-Exploitation Impact
3
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
control ﬂow
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
malicious ﬂow
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
malicious ﬂow
4
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
5
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
Filter
install
5
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
Filter
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
System Call
return
5
Claudio Canella (@cc0x1f)
Sample
6
Claudio Canella (@cc0x1f)
Sample
Syscalls: 0 1 2 3 16 19 20 60 72 202 231
6
Claudio Canella (@cc0x1f)
Syscall-Flow-Integrity Protection
7
Claudio Canella (@cc0x1f)
Syscall-Flow-Integrity Protection
State Machine...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bugscan
发展历程
01
圈子成员
02
框架改进
03
发展历程
2015.2
正式发布
2011
诞生
历时四年，五次重构
2015.5
圈子发布
2015.8
Bugscan
沙龙
圈子人数增加到5000多人，插件由90个增加到600多
目前可针对20多种系统服务进行识别，弱口令破解；
可识别，扫描80多种主流web程序，网络设备的漏洞。
目前已扫描超过100万的目标，600万余条漏洞记录
圈子成员
圈子（社区）
圈子成员
圈子（社区）核心成员
各种通用型插件，数量最多，质量最高
快速跟踪热点漏洞
发现Xx狗拒绝服务漏洞
各种系统服务，协议漏洞
插件审核，圈子商城
插件审核，插件编写教程
Zero
星光点亮◇天
range
Medici.Yan
不流畅
LinE
框架改进-curl的改进
Curl的改进
框架改进-过滤插件
过滤插件的改进
爬虫插件
curl
目标
新目标
过滤型插件
主动插件
curl
目标
过滤型插
件
1.比如检测注入插件中，报错了，过滤型插件就能抓取到
2.比如其他插件在调用curl的时候，过滤型插件发现新的表单
框架改进-日志
日志的改进
服务器与节点通信
爬虫的网址的tree
插件的选派(assign)
插件的验证(audit)
插件调用curl
插件调用debug
task的分发
框架插件异常日志
通信
Task分发
选派assign
验证audit
Curl的调用
Debug日志
框架改进-日志
日志的改进
服务器与节点通信
爬虫的网址的tree
插件的选派(assign)
插件的验证(audit)
插件调用curl
插件调用debug
task的分发
框架插件异常日志
快速定位误报，漏报问题，
定位复杂的综合性bug
发现耗时的插件加以改进。
框架改进-任务分发时的优先级
爬虫插件会推送大量www的task
需要将task普通队列变成优先级队列。
将cms识别。cms类插件，系统插件等重要的插件级别设高。
THANKS FOR YOUR WATCHING


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tuning Your Brain
Tuning Your Brain
 Why does certain music get you out of a black
hole?
 Often when we're stuck in a black hole,  or just can't
figure the problem out - the right music will get us out
of it. Why does this work?  It seems motivating, and it
seems like we solve problems easier, and it seems to
create a flow.  I'll be going over the basics of the brain
structures, neurons, synapses and neurotransmitters,
before getting to how music effects the brain, and how
we think.
Your Brain
 Your brain is made of cells called neurons
 Neurons are in 3 basic parts

cell body

 dendrites [input]

presynaptic membrane is
polarized.

axon [output] –

movement along axon weakens
as it travels

Could be seen as analog
Your Brain
 Neuron cells are cells are interconnected  by
synapses.  from the neuron terminals [axon] to
the membrane of the  dendrite.
 Between the terminal of the axon and
membrane of the dendrite is known as the pre-
synaptic gap
Your Brain
 Neurotransmitters

First discovered by Otto Loewi

There are approximately 100 billion neurons in the human brain.

Neurotransmitters are released from presynaptic terminal  and across to the
receptor membrane on the dendrite.

This causes either depolarization (excitatory – increased likelihood of firing ) or
hyperpolarization (inhibitory- decreased likelihood of firing) of the membrane. If
there is enough (action potential)– the charge passes along the axon to the
terminal and the process repeats. Neurotransmitters  are inactivated after release
– either through re-uptake mechanisms or enzyme action.

Neurotransmitters  are inactivated after release – either through re-uptake
mechanisms or enzyme action.
Your Brain
  Major Brain Structures

Frontal Lobe

Parietal Lobe

Occipital Lobe

Temporal Lobe
[From Neuroscience For Kids]
Brainwaves

What are brainwaves? How are they  made?

 Records of the electrochemical transmission – polarization/ depolarization at t...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

POS SYSTEMSED
   Romantically available
   Hacker
   Outdoor day drinker
  Sort of an adrenaline junkie
Our Target
Motivation
Very common high security device
Companies often use on terminal encryption to justify

   weak security elsewhere.
The companies that do care often don’t have the resources

   to validate any security claims vendors make.
What this talk is not
Exhaustive comparison of all Pinpads / Card terminals
Endorsement or indictment of any speciﬁc vendor
Conﬁguration or Compliance Guide
What this talk is
In depth dive into one line of devices
Exploits!
Previous Work
Skimmers
Previous Work
Pong on payment terminals1
Previous Work
Tamper resistant bypasses

and emv protocol exploits2
Previous Work
2015 Survey of POS attacks

(90% use default PIN)3
Previous Work
Breaches
Device Overview
Linux under the hood (V/OS)
400 MHz, ARM11 32-bit RISC processor
ARMv6 instruction set :(
512MB (256MB Flash, 256MB SDRAM)
4 or 7 inch display!!! !
Connectivity
Varies by device conﬁguration
-Ethernet (optional)
-Wiﬁ (optional)
-Bluetooth (optional)
-USB host (optional)
-RS-232 (optional)
-Old IO methods from mx800 series
Generally expose similar functionality
Remote Attack Surface
2 TCP ports open
-Services expect XML messages
DHCP (sometimes)
Normal Operation
Generally frmAgent.exe running as usr1
Only communicates over conﬁgured interfaces

    - Generally USB or Ethernet
Daemons provide IPC for privileged operations
Physical Attack Surface
Smart Card Reader / Mag
Usb (Host)
USB(9600 Baud Serial)
Com ports
SD card slot
BERG

Disassembly
Tamper resistant hardware
Likes to wipe itself when opened up
Not necessary to get ﬁrmware
Warranty Voided!
Administrator Mode
Press 1 + 5 + 9
Enter pin
Massively increased attack surface!
Diagnostic Info!
Install Software Updates!
Software Update
Manual Interaction required

    unless using PAYware :...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Project “The Interceptor”
 Avoiding counter-drone systems with nanodrones
David Melendez Cano
R&D Embedded Software Engineer
Introduction
With massive drone industry growth, comes antidrone systems industry. Due to multiple and even
classic vulnerabilities of communications now used by drones, antidrone industry can take down
those drones using well documented attacks.
State of the art
Drone-antidrone competition is already put into scene, and we can look at the state-of-the-art from
two points of view:
•
Anti-drone systems:
◦ Detection:
▪ Image/Thermal cameras, and radar
▪ Flight plan
▪ Motor noise signatures
▪ Image recognition
▪ Radio control and telemetry signature
◦ Actions:
▪ Radio protocol specific attacks (Deauth WiFi, etc)
▪ Vendor sub-protocol specific attacks (Command injection/manipulation)
▪ Radio jamming
▪ GPS spoofing
▪ Camera blinding
▪ Capture with other aircraft
•
Drone countermeasures
◦ Physical
▪ Surrounding protection nets
▪ Swarm attacks
◦ Logical
▪ Spread spectrum radio techniques
▪ Inertial navigation with drift correction using image recognition  (No GPS)
▪ Use 3G/4G networks to control and telemetry
The main point of this paper resides behind the fact that state-of-the-art antidrone mitigations
claim they are effective, just because the frequency bands they use for control and telemetry are
illegal to disturb: (3G/4G)
This a reasonable point considering that many antidrone systems are managed, indeed, with
3G/4G links, but it has obvious limitations.
New approach
Using a communication system that claims to be secure  and immune to jamming, because
jamming it would be illegal,  is simply not enough when we are talking about, for example,
government/army equipment. Not to mention that you cannot fly if no 3G/4G coverage is available.
Also, physical detection is key to antidrone systems, based mainly on the aircraft size and radar
signature.
This new approach offers three main points:
Drone size: Small drones are more difficult to detect...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
GoPro or GTFO
A Tale of Reversing an Embedded System
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Agenda
Intro
GoPro Overview
Previous Research
Methodology/Findings
Future Research/Next Steps
Conclusion
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
INTRO
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
About Us
•
Todd Manning a.k.a. “El Isleño”
•
Sr. Research Consultant, Accuvant LABS’ Applied Research
Consulting
•
Previously Mgr. of Security Research at BreakingPoint Systems
•
Zach Lanier a.k.a. “quine”
•
Sr. Research Consultant, Accuvant LABS’ Applied Research
Consulting
•
(Net | App | Web | Mobile) pen tester type
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Why the GoPro?
•
Highly popular, consumer “rugged” camera
•
WiFi-enabled
•
Possible applicability to other Amberella-based
devices
•
Including commercial IP-enabled CCTV installations
•
We focused mainly on GoPro Hero3 Black Edition
•
So most details apply, but may be some HW differences
•
Plus: IT’S EXTREEEEEEEEEEEEEEME!
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
GOPRO OVERVIEW
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
•  Ambarella A770 camera SoC
•
ARMv6 1136J-S core (@528MHz)
•  Sitronix ST7585 LCD
•  Atheros AR6233GEAM2D 802.11n + BT
controller
•  and more...
GoPro Overview
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
•
H3B runs two operating systems:
•
ITRON
•
Embedded RTOS
•
Manages most of the camera bits
•
Runs the “GoPro” Webserve...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSLstrip – hijacking SSH Sessions
Bowne
Page 1 of 5
What You Need for This Project
 A computer running Linux to be the Attacker (I wrote the instructions on a Ubuntu 8.04 virtual
machine).
 A second computer running any OS to be the Target.  I used my Windows 7 host machine as the
target.
Goal
The Attacker will serve as a proxy, converting secure HTTPS sessions to insecure HTTP ones.  This
will not be obvious to the user.
Starting the Target Machine
1.
Start your Target machine.
2.
Open a browser on your Target machine and make sure you can connect to the Internet.
Opening Facebook on the Target Machine
3.
On your Target machine, in Firefox, go to facebook.com.  Notice that this page is not
secure—the URL starts with http instead of https, as shown below on this page.
4.
On your Target machine, in Firefox, click View, "Page Source".  In the "Source of
http://www.facebook.com" window, click Edit, Find.  In the Find: box at the bottom of the
window, type login and click the Next button.
5.
You can see the form statement for the login form.  This shows that although the page is not
secure, the actual login method uses a URL starting with https.  Many Websites use this
system: a single page has both secure and insecure items.  That is the vulnerability we will
exploit.
SSLstrip – hijacking SSH Sessions
Bowne
Page 2 of 5
Starting the Attacker Machine
6.
Start an Ubuntu 8.04 virtual machine.  That will be your Attacker machine.
7.
Open a browser on your Attacker machine and make sure you can connect to the Internet.
Downloading SSLstrip
8.
On the Attacker Linux machine, open Firefox and go to this URL:
thoughtcrime.org
9.
Click Software.  On the next page, click sslstrip.  In the Download section, Click sslstrip.  At
the time I wrote this (Mar. 4, 2009), it was at version 0.2.
10.
Save the file on your desktop.
11.
On your desktop, right-click the sslstrip-0.2.tar.gz file and click "Extract Here".
12.
On your deskt...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Revolting Radios
Get it? It’s a pun!
Thanks
Mike Walters
Ang Cui
Schuyler St. Leger
Taylor Streetman
Sergey Bratus
Travis Goodspeed
A little background
“One of the things that makes Orwell's '1984' scary is the way it uses technology.
In Orwell’s dystopia, tech is a one-sided means of control. The powers that be
use machines for pervasive surveillance, to weaken your sense of self and to
make real change feel impossible. Humans deprived of any private space are
uniquely vulnerable, and Big Brother knows it.”
                                                                                - DEF CON 26 theme
“Let’s over-commit to that theme.”
                                                    - Mike & Dominic
Who are we?
Michael Ossmann
Founder and CEO of Great Scott Gadgets
Dominic Spill
Security Researcher at Great Scott Gadgets
Breadboard SDR
Scenario
We’ve found that we can reprogram one of Big Brother’s telescreens and stream
samples from the auxiliary Analog to Digital Converter (ADC) in its
microcontroller.
Can we build a radio receiver out of this microcontroller?
Breadboard SDR
When you build a radio
in software, you don’t
need much hardware
Clock Signal Transmitters
Scenario
We need to exfiltrate data from one of Big Brother’s air-gapped networks.
We have an ally but no radio transmitter inside.
Can our ally reprogram a microcontroller on the inside to transmit data over the
air?
Toggling IO Pins
Miek’s OOK transmitter
https://gfycat.com/gifs/detail/cloudyinfamouscapybara
Ang Cui’s Funtenna
http://www.funtenna.org/CuiBH2015.pdf
Raspberry Pi FM
https://github.com/PNPtutorials/FM_Transmitter_RPi3
GreatFET One PLL Transmitter
Real World Radios
Our demonstration target used a frequency deviation of +/-25 kHz and a center
frequency of 315.005 MHz.
We transmitted with a frequency deviation of +/-50 kHz at a center frequency of
315.050 MHz, and it worked!
If it oscillates like a radio
and emits like a radio
It’s a radio
GPIO Pin Receiver
Scenario
Big B...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A Bridge Too Far
Defeating Wired 802.1X with a
Transparent Bridge Using Linux
Alva Lease ‘Skip’ Duckwall IV
Exorcyst at gmail d0t com
Who Is This Guy?
• Been working with Linux since before the 1.0
kernel (1993ish)
• Unix admin by trade – transitioned to IT security
• Likes alphabet soup:
– CISSP, CISA, GCIH, GCIA, GCFW, GPEN, GWAPT
– GCUX, GSEC, GCFA, RHCE, SCSA (missing 12 letters)
– Sitting for the GSE written in the middle of August
• Works for Northrop Grumman on a team that
performs full scope penetration tests ☺
THE BASICS
The Objective
To introduce a device on a wired 802.1X secured
network with the following properties:
1. Transparent (undetectable) to the network
administrators
2. Remote communication and interaction
3. The ability to inject traffic on to the network
What We Need
• Linux Box with 2 network ports
• Extra Ethernet Cable
• A Workstation authenticating to the local
network using wired 802.1X of some sort
• Another box that we use to handle the
callbacks
A laptop/Netbook with an additional
USB network device running Linux
– Obviously Difficult to Hide
– Powerful x86 CPU/memory/HD
– Best used for in person demos ☺
Small x86 Computer (industrial/mini pc)
– Atom CPU (x86) with 1-2gb memory
– Storage via laptop HD or flash
– Fanless in many cases
– Built in Dual Gig Ethernet in some
– 4”x4.5”x1” approximately
Plug Computer
• Embedded Marvell CPU (ARM) running Linux
• 512mb ram/512mb internal flash
• Can use SD cards for storage / Boot
• Fanless
• Built in Ethernet/USB port
• Looks like a weird “wall wart”
Choice of Linux Distro
• Backtrack 4r2 for x86 CPUs
– Quiet by default (no services start by default, no
network by default, etc)
– Well tested and used
– Lots of built-in toys
– Yes, I know 5 is out.  Already had it working with 4.
• Ubuntu 9.04 for my plug computer
– Newer versions of the hardware might not support it
– Moving forward will probably switch to Debian or roll
my own distribution
Quick Review: Ethernet Frame
For TCP/IP (w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Unboxing Android
Everything you wanted to know about Android packers
Slava Makkaveev
Avi Bashan
Who Are We?
@Avi
R&D Team Leader at Check Point, former security
researcher at Lacoon Mobile Security.
Experienced in OS Internal research, mobile security, linux
kernel.
@Slava
Senior Security Researcher at Check Point, former Security
Researcher at Verint.
Vast experience in mobile OS research and linux internals.
“Boxing” Apps
●
Malware authors use various “boxing” techniques to prevent
○
Static Code Analysis
○
Reverse Engineering
●
This can be done by proprietary techniques or 3rd party software
●
This Includes
○
Code Obfuscation
○
Anti Debugging
○
Anti Tampering
○
Anti Dumper
○
Anti Decompiler
○
Anti Runtime Injection
Maliciousness of Packed Apps
Analyzed 13,000 Apps (July 2017)
Techniques to protect an app’s
code
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
pm.getClass().getMethod("getPackageSizeInfo", String.class,
Class.forName("android.content.pm.IPackageStatsObserver")).invoke(pm, packInfo.packageName,
    new IPackageStatsObserver.Stub() {
        public void onGetStatsCompleted(PackageStats pStats, boolean succeeded) {
        }
    });
v6.getClass().getMethod("getPackageSizeInfo", String.class,
Class.forName("android.a.a.a")).invoke(v6, ((PackageInfo)v0_5).packageName,
    new a() {
        public void a(PackageStats arg3, boolean arg4) {
        }
    });
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
Original
DEX
● Obfuscators
● Packers
● Protectors
Packer
Loader
Encrypted
DEX
APK
APK
Packing
process
Apk Protection Techniques
Packer
Loader
Encrypted
DEX
● Obfuscators
● Packers
● Protectors
Packer
Loader
Original
DEX
APK
APK
Execution
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Original
DEX
Encrypted
Modified
DEX
APK
APK
Protection
Process
Protector
Loader
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Katana:
Portable Multi-Boot Security Suite
JP Dunning
DefCon 2010
© Shadow Cave LLC
JP Dunning
Graduate Student:
Computer Science, Virginia Tech
Research Focus:
Wireless and Portable Security
Website:
www.hackfromacave.com
© Shadow Cave LLC
To Many Tools!
● Finding Tools
● Cases of CDs
– Keeping up with disks
● Tools on different devices
● Using different Operating Systems
● Indecent Response
– Need It Now!
© Shadow Cave LLC
Katana
● Run from USB Flash Drive
– No partitioning necessary
● Security Tools:
– Katana Tool Kit: 100s of portable Windows
applications
– Katana Live: A dozen Live Distributions
– Consolidation of tools onto one medium
● User configurable list of security related tools
– Add, Remove, Update
© Shadow Cave LLC
CD vs USB
Attribute
CD/DVD
USB Flash Drive
Write Speed
~ 5 MB/s (32x) / ~ 21
MB/s (16x)
~ 25 MB/s
Read Speed
~ 8 MB/s (52x) / ~
26.5/s (20x)
~ 35 MB/s
Transfer Rate
X * (150kb/s)
~ 60 MB/s
Environment
Static
Dynamic
BIOS Boot
Support
Early 90's
Early 00's
Disk Space
700MB/4.7GB
128 MB–256 GB
Physical Space
~ 12x12x0.1 cm
~ 4x1.5x0.5 cm
Time To Failure
~ 1,000 writes OR 3 – 5
years
~ 10,000 to 100,000 writes
OR 5 to 10 years
Bootable Tools
More
Less
© Shadow Cave LLC
Who Made The Cut?
● Security related
● Free (at least for personal use)
● Unique contribution
● Currently supported
© Shadow Cave LLC
Katana Live
© Shadow Cave LLC
Katana Included Distros
● Backtrack
● Ultimate Boot CD
● UBCD4Win
● Ophcrack
● Puppy
● CAINE
● CloneZilla
● Trinity Rescue Kit
● Derik's Boot and
Nuke
● Kon-Boot
© Shadow Cave LLC
Getting the Darn Thing to Work
● Boot loader syslinux
– USB bootloader
● Binary Configuration file editing
– Initd file
● Clean Up
– Minimizing the mess of folders and files
© Shadow Cave LLC
Add Your Own Distros
● Each distro requires different modifications
– Often change to init file
– Modify cfg menu file
– Change file/directory names and structures
© Shadow Cave LLC
Example: Adding Samurai 0.8
1) Download Samurai from:
samura...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Unintended Consequences:
Four Years under the DMCA
1. Executive Summary
Since they were enacted in 1998, the “anti-
circumvention” provisions of the Digital Millennium
Copyright Act (“DMCA”), codified in section 1201 of
the Copyright Act, have not been used as Congress
envisioned. Congress meant to stop copyright pirates
from defeating anti-piracy protections added to
copyrighted works, and to ban “black box” devices
intended for that purpose.1
In practice, the anti-circumvention provisions have
been used to stifle a wide array of legitimate activities,
rather than to stop copyright piracy. As a result, the
DMCA has developed into a serious threat to three
important public policy priorities:
Section 1201 Chills Free Expression and
Scientific Research.
Experience with section 1201 demonstrates
that it is being used to stifle free speech and
scientific research. The lawsuit against 2600
magazine, threats against Princeton Professor
Edward Felten’s team of researchers, and
prosecution of Russian programmer Dmitry
Sklyarov have chilled the legitimate activities
of journalists, publishers, scientists, students,
programmers, and members of the public.
Section 1201 Jeopardizes Fair Use.
By banning all acts of circumvention, and all
technologies and tools that can be used for
circumvention,
section
1201
grants
to
copyright owners the power to unilaterally
eliminate the public’s fair use rights. Already,
the music industry has begun deploying
“copy-protected CDs” that promise to curtail
consumers’
ability
to
make
legitimate,
personal copies of music they have purchased.
Section 1201 Impedes Competition and
Innovation.
Rather than focusing on pirates, many
copyright owners have chosen to use the
DMCA to hinder their legitimate competitors.
For example, Sony has invoked section 1201
to protect their monopoly on Playstation
video game consoles, as well as their
“regionalization” system limiting users in one
country from...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ElcomSoft.com
ElcomSoft.com
© 2017
Vladimir Katalov
ElcomSoft Co.Ltd.
Moscow, Russia
Breaking)into)the)iCloud)Keychain
ElcomSoft.com
Page 2
[Some)of])our)customers
ElcomSoft.com
Page 3
What)do)we)want)to)hack)today?
1.All)user’s)passwords
2.Credit)card)data
ElcomSoft.com
Page 4
What’s)inside)the)smartphone?
(tip:&almost&everything)
• Contacts)&)calendars
• Call)logs)and)text)messages)
• Emails)and)chats
• Account'and'application'passwords
• Web'and'Wi-Fi'passwords
• Credit'card'data
• Documents,)settings)and)databases
• Web)history)&)searches
• Pictures)and)videos
• Geolocation)history,)routes)and)places
• 3rd party)app)data
• Cached)internet)data
• System)and)application)logs
• Social)network)activities
ElcomSoft.com
§
Problems
§
Different&platforms&(Apple,&Google,&Microsoft)
§
Many&vendor-specific&clouds
§
3rd party&cloud&services
§
Credentials&needed&(password&or&token)
§
Profits
§
No&physical&access&needed
§
May&be&performed&silently
§
Backup
§
No)standard)way)to)get
§
Might)not)be)available
§
Almost)all)data)from)device
§
Sync
§
Limited)set)of)data
§
Most)critical)real-time)data
§
Synced)across)all)devices
§
Storage
§
Only)files/documents
§
Easy)to)access
Page 5
Data)acqusition methods)|)Cloud)acquisition)pros)and)cons
§
JTAG/chip-off
§
No)test)access)port)on)many)devices
§
Full)disk)encryption
§
Physical
§
Limited)compatibility
§
Data)may)be)encrypted
§
Logical
§
Limited)compatibility
§
Bypassing)screen)lock)is)needed
§
Cloud
§
Limited)set)of)data)// oh,$really?$J
§
Need)credentials
§
Legal)problems
ElcomSoft.com
§ Full)device)backups)are)sometimes)available
§ 3rd party)application)data)is)usually)not)available
§ Passwords)are)additionally)encrypted)with)hardware-specific key
§ Daily)backups)(in)best)case,)until)forced)from)the)device)
§ Backups)cannot)be)forced)remotely
§ 3rd party)software)is)needed
§ Almost)no)way)to)manage
§ Slow)access,)long)download
§ Account)might)be)locked)due)to)‘suspicious)activity’
Page 6
Cloud)services:)backups)[iCloud]
ElcomSoft.c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Multipot: A More Potent Variant of Evil Twin
K. N. Gopinath
Senior Wireless Security Researcher and Senior Engineering Manager
AirTight Networks
This presentation pertains to a discovery of a more potent variant of Evil Twin. We call it
‘Multipot’. What is unique about Multipot is that the prevalent defenses against Evil
Twin, in particular deauth based session containment, are totally ineffective against the
Multipot. Multipot threat can occur naturally in enterprise and campus network
environments or it can be presented by attacker with deliberate malicious intent. A
demonstration of Multipot threat will be provided at the end of the presentation. Multipot
provides a glimpse into complexities of evolving wireless vulnerabilities and their
countermeasures [1,2].
Multipot: What It Is and How It Works
Multipot is a newly discovered threat scenario consisting of multiple APs which are
configured with the same SSID and lure WiFi clients into connecting to them. The term
Multipot is derived from “multiple” and “honeypot”.
Multipot can occur naturally in the form of multiple Municipal APs or Metro APs around
the victim client, all of which are naturally configured for the same SSID (e.g.,
GoogleWiFi). A client which has such an SSID in its WiFi profile can connect to such a
Multipot. Another example of naturally occurring Multipot is multiple APs in the
neighbor’s corporate network around the victim client, which again are naturally
configured with the same SSID. Neighboring networks which are open (i.e., do not use
cryptographic security) and/or use manufacturer default SSIDs are good candidates for
this type of Multipot. Wireless connections of corporate or campus clients to such
naturally occurring Multipots can lead to non-policy compliant communication.
There can also be a handcrafted or malicious version of Multipot where an attacker can
combine it with known Evil Twin attack tools (see references 3 to 8). Each of these APs
in a handcraf...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Debugging and Reversing ALPC
Contents:
Introduction & Disclaimer
Environment Preparation
Getting Off The Ground
From User to Kernel Land
Hunting An ALPC Object
Introduction & Disclaimer
This post is an addendum to my journey to discover and verify the internals of ALPC, which I’ve
documented in Offensive Windows IPC Internals 3: ALPC. While preparing this blog I figured a
second post, explaining the debugging steps I took to verify and discover ALPC behaviour, could
be useful to all of us that are beginners in the field of reverse engineering and/or debugging.
While I’ve certainly used the techniques and methods shown in this post below, these where not
my only resources and tools to dive into ALPC. Even implying this would undermine the important
and major work of other researchers that have documented and reversed ALPC internals in the
past, like Alex Ionescu and many others. Hence this disclaimer.
TL;DR: The techniques below are practical and useful, but I was only able to apply them due to the
work of others.
Another important disclaimer is: I am - by no means - an experienced reverse engineer and this
blog post is not meant to be an introduction into ‘how to become a reverse engineer’ or show a
smart way to get in this field. This is a ‘use Windows debugging to stumble into a topic and
make your way to look around’ post.
Environment Preparation
In order to follow the steps shown below you want to set up a kernel debugging environment. If
you already have a kernel debugging environment set up, feel free to skip to section Getting Off
The Ground. If you don’t, you’ve got two basic choices for this setup:
Local live kernel debugging
Remote kernel debugging
Although the local kernel debugging option only requires a single test machine (virtual VM) and
only a single command and a reboot to set you up, I nevertheless recommend starting two
machines (VMs) and set up for remote debugging. The reason for this is that local live kernel
debugging comes with...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

從初出茅廬到破解大師
我的 14 年駭客生涯回顧
Orange Tsai
Orange Tsai
• Principal security researcher at
and captain of
HITCON CTF team, focusing on Web/App 0-day research
• Speaker of top hacker conferences:
Black Hat USA, DEFCON, HITB, HITCON
• 2019 Pwnie Awards, "Best Server-Side Bug"
winner
• 2021 Pwn2Own champion
幼年期
成熟期
完全體
成長期
究極體
幼年期 (2002 ~ 2007)
1. 如何開始接觸電腦?
2. 如何開始接觸駭客?
• 天才駭客新聞... 帥爆了
"最佳解答" 還是錯的...
幼年期 (2002 ~ 2007)
1. 如何開始接觸電腦?
2. 如何開始接觸駭客?
• 天才駭客新聞... 帥爆了
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1.
開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1. 開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1. 開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
把公式整頁抄下來跑去問數學老師...
駭客年會:
第一次有高中生得到名次!?
!∑(ﾟДﾟノ) 第一次有高中生拿到冠軍!?
成熟期 (2009 ~ 2013)
• 如何獲得更多的認同感?
• 外在認同感: 刻意訓練演講能力
•
整理過的資料才是資訊
•
有辦法解釋的才是知識
• 自我認同感: 「我好像有點強」好奇自己的極限在哪裡?
•
挑戰還有哪裡我進不去?
• 「出事了阿伯」
PHP CONF 2013 - 矛盾大對決
能入侵任何網站的駭客 vs. 絕對不會被入侵的網站
成熟期 (2009 ~ 2013)
• 如何獲得更多的認同感?
• 外在認同感: 刻意訓練演講能力
•
整理過的資料才是資訊
•
有辦法解釋的才是知識
• 自我認同感:「我好像有點強」好奇自己的極限在哪裡?
•
挑戰還有哪裡我進不去
• 「出事了阿伯」
完全體 (2014 ~ 2018)
• 對於駭客技術的追求要往哪發洩? ...CTF!
• 技術愛好者的天堂
• 追逐成就感
• 「承認永遠有比你天才的人...」
完全體 (2014 ~ 2018)
• 對於駭客技術的追求要往哪發洩? ...CTF!
• 技術愛好者的天堂
• 追逐成就感
• 「承認永遠有比你天才的人...」
Dead End on Web Part
- 余弦 (EvilCos)
「哪怕再小, 也要讓自己成為某一點的 No.1」
究極體 (2017 ~ Now)
• 眼界放大到世界莫名產生的使命感
• 站上世界、讓世界看到台灣!
• 有哪些人才是我能幫忙的?
• 年年都要超越去年的自己，陷入為了找漏洞而找的泥沼
• 別人(花時間)也能找到的漏洞真的是我的目標嗎?
• 當工具人花時間幫廠商做 QA 不覺得很無聊嗎?
• 用既有招式找漏洞 vs. 創造一整個新的流派
究極體 (2017 ~ Now)
• 眼界放大到世界莫名產生的使命感
• 站上世界、讓世界看到台灣!
• 有哪些人才是我能幫忙的?
• 年年都要超越去年的自己，陷入為了找漏洞而找的泥沼
• 別人(花時間)也能找到的漏洞真的是我的目標嗎?
• 當工具人花時間幫廠商做 QA 不覺得很無聊嗎?
• 用既有招式找漏洞 vs. 創造一整個新的流派
「你會不會有一天不做資安？」
當你的動機只是因為有趣，出現更有趣的東西時馬上就被吸引走
我則是來自於不同階段目標的累加，怎麼覺得我會放棄資安？
Dead End on Web Part
- ?????
「駭客是終生職」
結語
• 變強公式:
1.
找到動機
2.
刻意挑戰 N+1
3.
解決: 獲得樂趣與成就感
4.
失敗: 檢討問題、反思下一次如何避免失誤
• 推薦閱讀系列文:
• (知乎 ZhiHu) 懶人在思考
by @Evilcos (余弦)
• (CoderBridge) 成為專家之路
by @Po-Jen
• (Mediu...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Traffic Interception & Remote Mobile Phone
Cloning with a Compromised CDMA Femtocell
Doug DePerry
Tom Ritter
Andrew Rahimi
iSEC Partners
• The specific method used to access the device that
makes the demonstration possible has been resolved by
Verizon Wireless through a security patch.
• The Network Extenders being used to conduct the
demonstration do not have the security patch installed.
• Verizon Wireless gave iSEC permission to use the
network extenders to conduct the demonstration in
consideration of iSEC bringing the issue to the attention
of Verizon Wireless.
2
• This is not like joining an open WiFi network
• Your phone associates automatically  with no*
indication
• You might be on ours right now. 
• We don’t hack phones… at least not today
No User Interaction
3
Full Disclosure
• Disclosed vulnerabilities to the carrier early December
• They worked extremely hard, over Christmas, to prepare
a patch
• All vulnerabilities disclosed in this presentation have
been patched
• We do have architectural concerns around femtocells
• Concerns shared by…
4
Prior Art
• BH 2011 “Femtocells: a Poisonous Needle in the
Operator's Hay Stack”
• SFR Femtocell (2nd biggest operator in France)
• THC: Vodafone (2010/2011)
• RSAXVC & Doug Kelly (Bsides KC 2011)
• Rooting
• Cable construction
• “Do It Yourself Cellular IDS”
• Black Hat 2013
5
• North American Carrier
• 3G
• CDMA
• Customers affected
• Roughly 1/3 of the population of the US
• Phone Calls & SMS
• MMS, Data Man-In-The-Middling, SSL Stripping
• Cloning
Our Focus
6
Rooting
Exploring
• Filesystem
• Traffic
Exploiting
• Voice, SMS, Data
Cloning
Fixing
Agenda
7
General Architecture
We Are Here! 
8
Rooting the Femtocell(s)
SCS-26UC4
(Older)
SCS-2U01
(Newer)
9
Rooting the Femtocell(s)
SCS-26UC4
(Older)
SCS-2U01
(Newer)
Bonus!
10
• Faraday FA626TE ARM v5TE processor
• on Samsung UCMB board
• OneNAND flash memory
• Lattice FPGA
• Presumabl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

 0xcsandker
 csandker
 RSS Feed
//Posts
//History of Windows
//Archive
//Tags & Search
//ME
 Switch Theme
Debugging and Reversing ALPC
29 May 2022
>> Introduction & Disclaimer
>> Environment Preparation
>> Getting Off The Ground
>> From User to Kernel Land
>> Hunting An ALPC Object
This post is an addendum to my journey to discover and verify the internals of ALPC,
which I’ve documented in Offensive Windows IPC Internals 3: ALPC. While preparing
this blog I gured a second post, explaining the debugging steps I took to verify and
discover ALPC behaviour, could be useful to all of us that are beginners in the eld
of reverse engineering and/or debugging.
Contents:
Introduction & Disclaimer
While I’ve certainly used the techniques and methods shown in this post below,
these where not my only resources and tools to dive into ALPC. Even implying this
would undermine the important and major work of other researchers that have
documented and reversed ALPC internals in the past, like Alex Ionescu and many
others. Hence this disclaimer.
TL;DR: The techniques below are practical and useful, but I was only able to apply
them due to the work of others.
Another important disclaimer is: I am - by no means - an experienced reverse
engineer and this blog post is not meant to be an introduction into ‘how to become
a reverse engineer’ or show a smart way to get in this eld. This is a ‘use Windows
debugging to stumble into a topic and make your way to look around’ post.
In order to follow the steps shown below you want to set up a kernel debugging
environment. If you already have a kernel debugging environment set up, feel free
to skip to section Getting Off The Ground. If you don’t, you’ve got two basic choices
for this setup:
>> Local live kernel debugging
>> Remote kernel debugging
Although the local kernel debugging option only requires a single test machine
(virtual VM) and only a single command and a reboot to set you up, I nevertheless
recommend starting two machines (VMs) ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

By Lawrence Baldwin & Jaeson Schultz
“Extreme IP Backtracing”
I've been attacked… now what?
The reality is that few attacks are launched directly from an
attacker's system since they know they would be easily
caught using standard backtracing methods.
The Internet is chock full
of insecure systems which
are easily (read already)
compromised, providing a
means for attackers to
perform untraceable,
indirect attacks.
• Reduce the total number of
compromised hosts
• Minimize the amount of time that
any system remains in a
compromised state
The only profound way to improve
overall Internet security is to:
In order to protect ourselves, we need
to ensure that others are protected.
Every time your firewall or intrusion detection system logs
an event, don't assume the source is the actual attacker.
Think of it as a cry for help from a likely victim whose
system has been compromised and is just being controlled by
an attacker.
When we discover that someone
is obviously exposed, we should
let them know and guide them
to the information they need to
get protected.
CNN.com article “Avoiding future denial-of-service attacks”
about the Feb 2000 DDOS attacks on Yahoo, eBay,
Amazon.com and E*Trade
“Authorities pursuing the attackers say
the servers they used belonged to users
that had no idea their resources were
being used to launch attacks.”
Why notify victims?
Recently, myNetWatchman detected an incident in which a host was
infected with the Microsoft SQL Spida Worm.  A backtrace of the
offending IP yielded some interesting results…
% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-
services/db/copyright.html
inetnum:      194.190.139.0 - 194.190.139.255
netname:      GAN
descr:        Central Region of GAN RF
country:      RU
admin-c:      AV753-RIPE
tech-c:       AV753-RIPE
status:       ASSIGNED PA
n...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

JUST WHAT THE DOCTOR ORDERED?
SCOTT ERVEN
Founder/President – SecMedic
@scotterven
SHAWN MERDINGER
Healthcare Security Researcher
Founder – MedSec LinkedIn Group
@medseclinkedin
1
Why Research Medical Devices?
• Patient Safety & Quality Patient Care
• To Equip Defenders In Assessing &
Protecting These Life Saving Devices
• Directly Contributes To & Affects Healthcare
Organizations’  Mission  and  Values
2
Disclosure Process Overview
• April 30th – SMB Findings Disclosed To
DHS/ICS-CERT
• May 5th – SMB Detailed Briefing With
DHS/ICS-CERT
• May 20th – Additional Disclosure To
DHS/ICS-CERT for Defibs, Healthcare Orgs
• Ongoing Assistance Provided To Federal
Agencies, Healthcare Organizations and
Manufacturers
3
What Will Be Revealed?
• No Zero Days
• Most Vulnerabilities Not From This Decade
• Threat Modeling – Connecting The Dots
• Medical Device Exposure From Public
Internet
4
Bad News
• The external findings pose a significant risk to
patient safety and medical devices
• We located most of these external risks within
1 hour utilizing only previously disclosed
vulnerabilities and open source
reconnaissance
• These findings provide support that
Healthcare is 10 years behind other
industries in addressing security
5
Good News
• These significant external risks can be
mitigated easily
• The external risks can be identified by an
organization within 1 hour using open source
reconnaissance tools
• The external findings can be remediated with
little to no investment from an organization
6
Review of  Previous Research
• Lab Systems
• Refrigeration Storage
• PACS – Imaging
• MRI/CT
• Implantable Cardiac Defibrillators
• External Cardiac Defibrillators
• Infusion Pumps
• Medical Device Integration
7
Review of Previous Research - Top Risks
• Hard-Coded Privileged Accounts
• Unencrypted Web Applications & Web
Services/Interfaces
• Excessive Services With No Operational Use
Case
• System Updates & Patchin...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Do you like to read? I know how to take
over your Kindle with an e-book
Slava Makkaveev
How popular is Amazon Kindle?
10th Generation
■
Kindle Oasis
■
Kindle Paperwhite
■
Kindle
9th Generation
■
Kindle Oasis
8th Generation
■
Kindle Oasis
■
Kindle
7th Generation
■
Kindle Voyage
■
Kindle Paperwhite
■
Kindle
6th Generation
■
Kindle Paperwhite
The 11th Generation is on the way
5th Generation
■
Kindle Paperwhite
■
Kindle
4th Generation
■
Kindle Touch
■
Kindle
3rd Generation
■
Kindle Keyboard
2nd Generation
■
Kindle DX
■
Kindle
1st Generation
■
Kindle
The easiest way to remotely reach a
Kindle is through an e-book
How to deliver an e-book to my Kindle device?
When you are logged into your Amazon account
■
From your browser (Chrome browser extension)
■
From your desktop (PC application)
■
From your Android device (Android application)
Without authentication
■
Via USB cable
■
From your email (as an attachment) to xxx@kindle.com
●
The ability to spoof was ﬁxed at the end of 2020
●
A veriﬁcation link will be sent to your Amazon account
A phishing campaign is the right way to go
Dozens of free online libraries are open to everyone
■
Kindle Store
■
Project Gutenberg
■
Open Library
■
The Online Books Page
■
The Literature Network
■
Classic Reader
■
Classic Bookshelf
■
Chest of Books
■
Fiction.us
■
PublicLiterature.org
■
Authorama
■
Bibliomania
■
International Children's
Digital Library
...
A malware e-book can be easily uploaded
Inside the Kindle E-reader
How to research a Kindle device?
The ofﬁcial source code consists of third-party open source projects with
small Amazon tweaks
1)
The latest ﬁrmware is available for download
2)
It is possible to Jailbreak
Kindle Touch Architecture
Linux OS
D-Bus
LIPC + app registry
Native apps
(busybox)
JRE
Booklets
Pillow
Java Apps
HTML/Javascript
Webkit
X.org
User Interface
High-level services
Low-level services / system
What Kindle components are
responsible for parsing e-books?
The /usr/bin/scanner service
■
Periodically scans /mnt/u...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Advanced MySQL Exploitation
Muhaimin Dzulfakar
muhaimindz@gmail.com
2
Contents
1 Abstract............................................................................................................................................3
2  Introduction ....................................................................................................................................3
3  Stacked Query.................................................................................................................................3
4  Attacking MySQL on applications that do support stacked queries...............................................4
5  Attacking MySQL on applications that do not support stacked  queries........................................5
6  Fingerprinting the web server directory.........................................................................................7
6.1  Fingerprint through error message method................................................................................7
6.2  Fingerprint through LOAD_FILE method......................................................................................7
7  Maximum size of arbitrary code allowed........................................................................................7
8  Arbitrary file compression/decompression ....................................................................................8
9  Dealing with columns......................................................................................................................8
10  Remote code execution on LAMP.................................................................................................9
11  Remote code execution on WAMP.............................................................................................10
References ........................................................................................................................................11
3
1 Abstract
This document discusses i...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Abusing
  HTML5
DEF
  CON
  19
Ming
  Chow
Lecturer,
  Department
  of
  Computer
  Science
TuCs
  University
Medford,
  MA
  02155
mchow@cs.tuCs.edu
What
  is
  HTML5?
•  The
  next
  major
  revision
  of
  HTML.
  To
  replace
  XHTML?
  Yes
•  Close
  enough
  to
  a
  full-‐ﬂedged
  development
  environment
•  The
  three
  aspects
  of
  HTML5:
–  Content
  (HTML)
–  PresentaYon
  of
  content
  (CSS)
–  InteracYon
  with
  content
  (JavaScript)
•  S"ll
  work
  in
  progress
•  Backing
  from
  Google,
  MicrosoC,
  and
  of
  course
  Apple
•  Currently
  supported
  (not
  100%)
  in
  Chrome,
  Firefox
  3.5+,
  Opera,
Internet
  Explorer
  8,
  and
  Safari
•  Many
  incompaYbiliYes
  exist;
  perform
  a
  browser
  test
  via
hdp://www.html5test.com
•  Will
  be
  ﬂexible
  with
  error
  handling
  (i.e.,
  incorrect
  syntax).
  Older
browsers
  will
  safely
  ignore
  the
  new
  HTML5
  syntax.
HTML5:
  What’s
  In?
  What’s
  Out?
•
In:
–  New
  tags,
  including
  <button>,
  <video>,
  <audio>,
  <article>,
  <footer>,
  <nav>
–  New
  adributes
  for
  tags
  such
  as
  autocomplete,
  autofocus,
  pattern
  (yes,
  regex)
  for
input
–  New
  media
  events
–  New
  <canvas>
  tag
  for
  2D
  rendering
–  New
  form
  controls
  for
  date
  and
  Yme
–  GeolocaYon
–  New
  selectors
–  Client-‐side
  storage
  including
  localStorage,
  sessionStorage,
  and
  Web
  SQL
•
Out:
–  PresentaYon
  elements
  such
  as
  <font>,
  <center>
–  PresentaYon
  adributes
  including
  align,
  border
–  <frame>,
  <frameset>
–  <applet>
–  Old
  special
  eﬀects:
  <marquee>,
  <bgsound>
–  <noscript>
Quick
  Demos
•  Video
  capYoning
•  Canvas
•  GeolocaYon
Structure
  of
  an
  HTML5
  Document
<!DOCTYPE html>
<html>
<head>
<title>An HTML Document<...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Greater Than One
Defeating “strong” authentication in
web applications
- Brendan O’Connor
Introduction
 Background Information
 Control Types
 Device Fingerprinting
 One Time Passwords
 Knowledge Base Archives
 Conclusions
Introduction
 Internet Banking
 Bill Pay
 Car Loans and Mortgages
 Retirement Plans / 401K
 Stock Trading / Investments
Background
Federal Financial Institution Examination Council
Authentication in an Internet Banking Environment
The agencies consider single-factor authentication, as the only control
mechanism, to be inadequate for high-risk transactions involving
access to customer information or the movement of funds to other
parties . . . Account fraud and identity theft are frequently the result of
single-factor (e.g., ID/password) authentication exploitation.
source: http://www.ffiec.gov/ffiecinfobase/resources/info_sec/2006/frb-sr-05-19.pdf
Background
 Access to customer information or movement
of funds – read: pretty much every screen in
an Internet Banking application
 Does not mandate 2 factor authentication –
says that single factor is insufficient (greater
than one)
 Hardware tokens are expensive and easily lost
or broken
 Biometrics for the end user are out of the
question
Control Types
 Mutual Authentication
 Device Fingerprinting
 Out of Band Authentication
 One Time Passwords
 Knowledge Base Archives
Control Types
 Mutual Auth
 This is not device based Mutual Auth
 Site to user authentication
 Device Fingerprinting
 Persistent cookies
 Information from HTTP headers
 Device Interrogation
Control Types
 Out of Band Auth
 Not true OOB Auth
 Only delivery is Out of Band.
Authentication still happens within HTTP
session
 Email delivery, SMS message to cell
phone, Phone call that reads you a PIN
Control Types
 One Time Passwords
 Dynamic single use password or PIN
(generally delivered via OOB method)
 Static pre-issued One Time Pads
 Not to be confused with algorithmic
token based auth (such as RSA
SecurID©)
Control Typ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

pipestdin
0x00
0x01
0x02 1-writestdin
0x03 2-pipestdin

0x04

0x05


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Beyond the Lulz:
Black Hat Trolling, White Hat Trolling, and Hacking the Attention Landscape
SECTION 1
Are you familiar with fishing? Trolling is where you set your
fishing lines in the water and then slowly go back and forth
dragging the bait and hoping for a bite. Trolling on the Net is
the same concept - someone baits a post and then waits for
the bite on the line and then enjoys the ensuing fight.
- Anonymous usenet poster, 1995 (relayed by Judith Donath,
Identity and Deception in the Virtual Community, 1998)
The well-constructed troll is a post that induces lots of
newbies and flamers to make themselves look even more
clueless than they already do, while subtly conveying to the
more savvy and experienced that it is in fact a deliberate
troll. If you don't fall for the joke, you get to be in on it.
- Troller’s FAQ by trollfaq@altairiv.demon.co.uk, 1996
Being a prick on the internet because you can. Typically
unleashing one or more cynical or sarcastic remarks on an
innocent by-stander, because it’s the internet and, hey, you
can.
- EREALLY GUD DEFUNITION MAKUR, Urban Dictionary, 2004
A smart vendor treats vulnerabilities less as a software
problem, and more as a PR problem. So if we, the user
community, want software vendors to patch vulnerabilities,
we need to make the PR problem more acute.
- Bruce Schneier, 2007
Laughter at the expense or misfortune of others.
- A troll to Gabriella Coleman,
Hacker, Hoaxer, Whistleblower, Spy, 2014
Part of:
a rich aesthetic tradition of spectacle and transgression...
which includes the irreverent legacy of phreakers and the
hacker underground.
- Gabriella Coleman, Phreaks, Hackers, and Trolls: The
Politics of Transgression and Spectacle,’ 2012
The best challenge to the authority of something is to find where
its semantic or enforceable borders break down and to exploit
those shortcomings.
- Brad Troemel, proclaimed the “Troll of Internet Art,” 2012
We’ve come up with the menacing term 'troll' for someone ...