Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Beat to 1337
Mike Arpaia & Ted Reed
Creating A Successful University Cyber Defense Organization
(Note: slide text will be mostly replaced by images during
the presentation, this deck is designed as a handout)
This presentation...
Will show you a five step program to:
1. Plan! - make a goal for yourself and your university
2. Recruit! - reach out to the campus, find interested parties
3. Organize! - gather resources, don't sulk over no budget
4. Learn! - understand everyone's skills, abilities, and interests
5. Play! - compete, join a competition, start evaluating your
skills
...And we'll give out prizes!
         So try to be involved!
Problem
● Everyone wants to be a hacker but you're not going to learn
how to hack in "Theoretical Computer Science 101"
● Even in information assurance classes, often times the
subject matter is so high-level that you can't really get
anything (practical) out of it...
● You may not have enough information security knowledge
to walk up and be a pen-tester or researcher
● You may not know enough people to make a team
Our solution!
● We compiled data about past competitions for you to use,
learn from, and ramp up your team to compete this coming
year!
● We compiled a detailed guide from what we've learned and
professionals we've sought advice from!
● We modified a collaboration software solution to help
students play, organize and participate in CTFs!
○ We recommend a hardware solution to complement
○ Plan to distribute the software as an ISO image
What's in the Data?
● What we did and what works
○ Don't reinvent the wheel... we did it for you
●  How to stop complaining about the things that are holding
you back and start owning some n00bs!
●  Tips on how to organize, educate and motivate a team of
lazy college kids
● A calendar of national and international CTF-style
competitions that you and your team can compete in!
What's in the Guide?
● Chapters and lesson plans on a wide range of information
security topics includ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

互联网企业安全建设实践
北京站/3.29
靳晓飞
VIPKID安全中心
从这里说起
互联网企业安全建设整体思路
互联网企业面临安全挑战分析
互联网企业核心安全目标
互联网企业核心安全能力建设与提升
互联网企业整体安全视角
互联网企业基础安全体系建设框架
互联网企业安全建设蓝图
互联网企业安全建设如何落地实施
分阶段安全体系建设
如何评价企业安全建设的效果
基础安全全链路纵深防御架构
API 安全监控实践
需要对哪些API进行安全监控？
• 注册接口
• 登录接口
• 找回密码接口
• 订单详情接口
• 收货地址接口
• 其他所有可能会被刷的API
安全监控目标设定
• 具备对高风险API被刷的分钟级主动发
现和感知能力，并可与安全防御系统
联动，实现自动化安全防护
技术上如何实现
• 流量分析
• 日志分析
API 安全监控实践
API 安全监控实践
Github安全监控实践
Github安全监控实践
项目地址：https://github.com/VKSRC/Github-Monitor
做好企业安全建设的必要条件
写在最后
“未知攻，焉知防”，网络攻防对抗本质上是人与人之间的较量，在安全建
设和安全运营过程中企业安全人员不能仅限于被动防御，还需要积极转变思
路，以攻击者视角来看待和审视安全风险，做到攻防兼备，化被动为主动。
Thanks


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

This talk is not about LTE
vulnerabilities
No cables
Why isn’t it
working?
Scared Poopless – LTE
and *your* laptop
Disclaimer:
During the slides you will be exposed to hacker stock
photos from the internet.
Thank you!
Goldy
aSmig
@octosavvi
Intel Security would like to acknowledge and thank the
Huawei PSIRT team  for their responsiveness and cooperation
on this issue.
• CVE-2015-5367: Insecure Linux Image in Firmware
• CVE-2015-5368: Insecure Firmware Update Authentication
http://huawei.com/en/security/psirt/security-
bulletins/security-advisories/hw-446601.htm
DEMO
What did I just see?
This is not a                problem
Remember kids!
This is why you should do
secure firmware updates
NEVER FORGET
Adam Caudill
Brandon Wilson
Who are we?
@jessemichael
@laplinker
Background
• Internal LTE/3G modems and who uses them?
I like to use my
own keyboard
• Internal LTE/3G modems and who uses them?
• Business class devices
I think I have an
idea!
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
Card against
humanity 2015
world champion
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
PCIe ×2, SATA, USB 2.0 and 3.0,
Audio, PCM, IUM, SSIC and I2C
I forgot mac’s don’t have a CD drive
anymore
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
• USB?!
Crap! I just
stabbed my usb
thumb drive!
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in?
• USB?!
• Why hack this device anyway?
Respect the
gas/ski
mask
Background
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in?
• USB?!
• Why hack this device anyway?
• Module available worldwide
• It’s plugged in [INSIDE] your laptop/tablet
• Software
• Firmware
• Hardware
• Software
• Windows ut...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

智能合约安全开发
Ali0th
Email ：martin2877@foxmail.com
智能合约安全开发
1. 相关概念
2. 安全事件
3. 审计之路
4. 常见漏洞
5. 常用工具
智能合约
智能合约（Smart Contract）是以太坊中最为重要的一个概念，即以计
算机程序的方式来缔结和运行各种合约。最早在上世纪 90 年代，Nick
Szabo 等人就提出过类似的概念，但一直依赖因为缺乏可靠执行智能合约的
环境，而被作为一种理论设计。区块链技术的出现，恰好补充了这一缺陷。
以太坊支持通过图灵完备的高级语言（包括 Solidity、Serpent、Viper）
等来开发智能合约。智能合约作为运行在以太坊虚拟机（Ethereum Virual
Machine，EVM）中的应用，可以接受来自外部的交易请求和事件，通过触
发运行提前编写好的代码逻辑，进一步生成新的交易和事件，可以进一步调
用其它智能合约。
智能合约
智能合约
智能合约
Smart Contract
智能合约
DApp
安全事件
The DAO 漏洞
以太坊短地址漏洞
wallet contract奇偶校验破解
Parity多重签名钱包提款漏洞
HTTP RPC API 漏洞
Parity多重签名钱包合约漏洞
以太坊编程语言Solidity漏洞
智能合约Fallback函数
智能合约递归调用（recursive）
调用深度限制（call depth）
太阳风暴
以太坊浏览器 Mist
区块节点漏洞
日食攻击（eclipse attack）
Geth客户端DoS攻击漏洞
浪子合约漏洞
自杀合约漏洞
贪婪合约漏洞
遗嘱合约漏洞
交易顺序依赖性
时间戳依赖性
挖矿中心化
BEC/SMT 智能合约无限转币漏洞
审计之路
如何从零上手新的代码语言进行审计？
审计之路
如何从零上手新的代码语言进行审计？
常规：开发过程->基本语法->深入语法->漏洞类型->工具利用->开始审计
弯道超车：语法->漏洞类型->文本直接审计
审计之路
如何从零上手新的代码语言进行审计？
常规：开发过程->基本语法->深入语法->漏洞类型->工具利用->开始审计
Remix-ide
Pet-shop
DASP
Ethereum Smart Contract Best Practices
Solidity
常见漏洞
- Arithmetic Issues 计算问题
- Integer Overflow 整形上溢
- integer underflow 整形下溢
- Race Condition 条件竞争
- Re-Entrancy 可重入性 (同函数条件竞争)
- Cross-function Race Conditions 跨函数条件竞争
- Carelessness 粗心
- Missing Constructor 构造函数缺失
- Wrong Interface 错误接口
- Code Logic Issues 代码逻辑问题
- Unchecked External-Call 未经核查的外部调用
- Unprotected Function 未受保护函数
- Use tx.origin for authorization 使用tx.origin做认证
- Time manipulation 时间操纵
- Timestamp Dependence 时间戳依赖
- Access Control 访问控制
- delegatecall 使用delegatecall
- Bad Randomness 随机数问题
- Using block variables 使用区块变量
- Blockhash 使用区块哈希值
- Private Seed 使用私有种子
- front-running 抢先交易
- Forcibly Sending Ether to a Contract 强制向合约转账
- Denial of Service 拒绝服务
- DoS with (Unexpected) revert 恢复交易拒绝服务
- DoS with Block Gas Limit  Gas耗尽拒绝服务
- unexpected throw 意外报错
- unexpected kill 意外自杀
- access control breached 突破访问控制
- Front Running 抢先交易
- time-of-check vs time-of-use (TOCTOU)
- race condition
- transaction ordering dependence (TOD)
- Short Address Attack 短地址漏洞
常见漏洞
Fallback
1 无参数，不返回值。
2 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

An Inside Look Into Defense
Industrial Base (DIB) Technical
Security Controls:
How Private Industry Protects Our Country's Secrets
James Kirk
Outline
• Background
• DOD Agency Responsible for Interpretation and
Enforcement
• Security Control Development
• Document Drafting and Approval
• Testing of Security Controls
• Enforcement
• The fun stuff… gaps in security controls
Background/Disclaimer
• What kind of data are we talking about?
• National Industrial Security Program (NISP) Executive
Order 12829 1.
• National Industrial Security Program Policy Advisory
Committee (NISPPAC)
• National Industrial Security Program Operating Manual
(NISPOM)
1. DoD 5220.22-M “National Industrial Security Program: Operating Manual.”
DOD Agency Responsible for
Interpretation and Enforcement
• The Defense Security Service (DSS)
• Agency Structure
• Directorates (IS, CI, DISCO, and CDSE)
• ODAA
• Field Offices
Basics of Certification and
Accreditation (C&A)
• What is C&A? 1., 2.
• Certification
• Accreditation
• ISSP role
• RDAA role
• Enough background on the DSS, lets get into security
controls
1. Industrial Security Field Operations (ISFO) Process Manual for the
Certification and Accreditation Of Classified Systems under the National
Industrial Security Program Operating Manual (NISPOM) and NIST 800-53.
2. Master System Security Plan (MSSP) Template for Peer-to-Peer Networks.
Security Controls
• Where do they originate
from?
• Linux controls 1.
• Audit Areas
1./bin
2./usr/bin
3./etc
4./sbin
5./usr/sbin
6./var/audit
7./usr/local
8./opt
9./home
1. ISL 2007-01
Security Controls cont.
• Linux cont. 1., 2.
• DISA STIG vs NISPOM/DSS ISL
1. Standardization of Baseline Technical Security Configurations.
2. UNIX: Security Technical Implementation Guide.
DISA STIG
DSS NISPOM/ISL
The SA will ensure audit data files have
permissions of 640, or more restrictive.
(2) Audit Trail Protection. The contents of audit trails
shal...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
2
Public safety may be an obscure, public-sector part of the telecom/tech crowd, but
“the crowd” is actually quite sophisticated.
We consulted with members of the standards community before attempting these
attacks to determine what attack surfaces they deemed most vulnerable.
After completing our in-lab research, we disclosed a summary of our findings to
members of NENA’s Development Steering Council.
3
Despite the addition of a few new originating network types in the last 20-25 years, 9-
1-1 remains largely a product of the telephone age, not the computer age. (And
definitely not the Internet age!)
4
In the beginning, the Bell System created the PSTN, and the trust model was void, and
without form – because they were THE PHONE COMPANY, damnit!
The network structure (and law) made trust implicit: Physical connections between
parties, plus an (mostly) separate control plane meant calls generally went where
intended, unmolested.
Generally, confidence was high that the called party was the party intended.
Until the rise of the telephreaks!
Jon Draper, AKA “Cap’n Crunch” found a 2600Hz whistle in a box of…Cap’n Crunch, and
changed the world.
An array of colorful boxes were soon developed by enterprising telephreaks around the
world.
Despite this, the public generally retained high confidence in the integrity and
confidentiality of their phone calls.
5
When “Dial Service” began, each police, fire, and ambulance service had its own 7-digit
local number.
Many local governments distributed stickers that listed the numbers for their local
services.
Consumers could place these on the backs of their telephone receivers, so that the
numbers would be near-to-hand, if an emergency arose.
Dialing these digits took time, however, and the numbers varied from place to place,
and even within different police precincts or fire service zones within a single city or
county.
6
In the mid-’60s, the National Association of Fire Engineers (now the International
Associatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

听说你在⽤SigFlip在PE签名⾥嵌⼊
shellcode？
-- 副标题: 检测SigFlip在PE的签名⾥嵌⼊的shellcode，以及嵌⼊⽅法改进
# 前⾔
之前看到 @w8ay 实现的⽩加⿊⽣成器，就感觉这个做法⾮常的棒，但是 SigFlip  的做法
真的隐蔽吗？真的不容易被查杀吗？
刚好最近在研究PE的⽂件签名结构和签名，那今天就详细讲解⼀下签名相关的内容，以及如
何改进 SigFlip 实现更深层次的隐藏。
# 原理回顾
对原理⽐较了解的直接跳过这⼀节。
看⼀下微软给的PE⽂件的签名的结构，这⼀张图⾮常的经典，但是这只是⼀个微软签名省略
了⼤部分细节的概括图，但是有助于我们了解⼀些最基本的信息。
⾸先可以看到图中灰⾊区域标注的内容是不参与⽂件签名hash计算的，并且可以看
到 Attribute Certificate table 的位置是由 PE头中的 Data Directories 中某⼀项指
定的， Data Directories 共有16项，每⼀项的结构都是：
总共8个字节，指定了对应的数据在⽂件中的偏移以及⼤⼩。 Data Directories 的Security
项就指向了其签名数据。
签名数据的数据结构是：
dwLength： 表明签名的数据的总体⼤⼩，⼀般是等于 _IMAGE_DATA_DIRECTORY  的size
字段。
·wRevision：表明当前签名信息的版本。
wCertificateType：指定接下来的签名的类型
bCertificate：Byte数组，存储的就是签名的具体数据。
最值得注意的是 bCertificate 的字节⼤⼩要求8字节对齐。
SigFlip的代码实现
从上⾯分析的不参与⽂件校验的部分可以得知，只有 _WIN_CERTIFICATE 部分是可以⽤来隐
藏数据的，具体我们直接看SigFlip的代码实现。
typedef struct _IMAGE_DATA_DIRECTORY {
    DWORD   VirtualAddress;
    DWORD   Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
1
2
3
4
typedef struct _WIN_CERTIFICATE {
    DWORD       dwLength;
    WORD        wRevision;
    WORD        wCertificateType;   // WIN_CERT_TYPE_xxx
    BYTE        bCertificate[ANYSIZE_ARRAY];
} WIN_CERTIFICATE, *LPWIN_CERTIFICATE;
1
2
3
4
5
6
⾸先获取到 _WIN_CERTIFICATE 的位置和⼤⼩，然后把数据padding到签名中，并扩充为8字
节对齐，最后更新PE⽂件的checksum和 _WIN_CERTIFICATE 的⼤⼩。
# 检测⽅法
SigFlip 的检测是⾮常简单，我们抛开插⼊shellcode时的标识起始
字 \xFE\xED\xFA\xCE\xFE\xED\xFA\xCE 不谈，只看插⼊的内容，可以看到 SigFlip 仅
仅修改了 _IMAGE_DATA_DIRECTORY 中的 Size 字段，但是并没有修改 _WIN_CERTIFICATE
中的 dwLength ,两个长度不⼀致就可以很轻易的发现隐藏在签名中的数据：
//Get IMAGE_DIRECTORY_ENTRY_SECURITY field and retrieve the RVA and
SIZE of the Certificate Table (WIN_CERTIFICATE).
  _CertTableRVA =
_optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY +
_DT_SecEntry_Offset].VirtualAddress;
  _CertTableSize =
_optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY +
_DT_SecEntry_Offset].Size;
  _wCert = (LPWIN_CERTIFICATE)((BYTE*)_peBlob + _CertTableRVA);
1
2
3
4
    memcpy((((BYTE*)_peBlob + _CertTableRVA) + _wCert->dwLength),
_rpadding, strlen(_rpadding...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Vulnerability Exchange:
One Domain Account for More Than Exchange Server RCE
Tianze Ding (@D1iv3)
> whoami
•
Tianze Ding (@D1iv3)
–
Senior security researcher at Tencent Security Xuanwu Lab
–
Focusing on Active Directory Security / Red Team / Web Security
–
Reported some vulnerabilities to Microsoft, Apple, Google, etc.
–
Black Hat Asia / Black Hat USA Arsenal speaker
•
Exchange Server Attack Surface Overview
•
From a Domain Account to Arbitrary Mailbox Takeover
•
From a Domain Account to Exchange Server RCE
•
Lateral Movement & Privilege Escalation
•
Conclusion & Takeaways
Agenda
•
One of the most famous mail servers in the world
•
Stores large amounts of sensitive corporate information
–
Emails, attachments, contacts, calendars …
Why Microsoft Exchange Server ?
•
Highly integrated with Microsoft Active Directory
–
Authentication
–
Mailbox / User / Group management
–
Exchange Server configuration
–
…
•
High-privileged AD objects
–
Exchange Servers are installed by Enterprise Admins /
Schema Admins / …
–
The Exchange Windows Permissions group has
WriteDACL right on the Domain object (fixed in 2019)
Why Microsoft Exchange Server ?
[1] https://docs.microsoft.com/en-us/exchange/plan-and-deploy/active-directory/ad-access?view=exchserver-2019
[2] https://docs.microsoft.com/en-us/exchange/plan-and-deploy/deploy-new-installations/install-mailbox-role?view=exchserver-2019
Exchange Server Attack Surface Overview
•
Client Access Services
–
HTTPS endpoints
–
POP3 / IMAP / SMTP
–
Unified Messaging
•
HTTPS endpoints
–
OWA, ECP
–
RPC, EWS, MAPI, API,
ActiveSync, PowerShell, Auto
Discover, OAB
Architecture and Attack Surface
•
Most historical vulnerabilities exist in ASP.NET code running on IIS Server
Historical Vulnerabilities
IIS Server
POP3
Exchange Server
RPC
ECP
OWA
EWS
MAPI
API
Active
Sync
Power
Shell
Autodi
scover
OAB
Front End
HTTP
Proxy
IMAP
SMTP
UM
Architecture and Attack Surface
POP3
IMAP
SMTP
UM
IIS Server
Windows Server
Exchange Server
…
Exchange Server
Exchange Serv...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Make JDBC Attack Brilliant Again
Xu Yuanzhen(  @pyn3rd)
Chen Hongkun(  @Litch1)
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
Java Database Connectivity
JDBCMysqlImpl
MySQL
JDBC
JDBCOracleImpl
JDBCSQLServerImpl
JDBCDB2mpl
Oracle
MsSQL
DB2
JDBC Driver
Standard Interface
Callback
Java Application
Not Recommended
Unportable
Callback
set evil JDBC URL
establish JDBC connection
execute payload with JDBC driver
Controllable JDBC URL
Class.forName(" com.mysql.cj.jdbc.Driver");
String url = "jdbc:mysql://localhost:3306/demo"
Connection conn = DriverManager.getConnection(url)
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
MySQL client arbitrary file reading vulnerability
• Affect many clients including JDBC driver
• LOAD DATA INFILE statement
establish JDBC connection
greeting packet
query packet
file transfer packet
Server
Client
MySQL JDBC client deserialization vulnerability
establish JDBC connection
read evil object from server
deserialize evil object
• Affected MySQL JDBC driver need to support specific properties
• gadgets are necessary
Server
Client
MySQL Connector/J – CVE-2017-3523
MySQL Connector/J offers features to support for automatic serialization and
deserialization of Java objects, to make it easy to store arbitrary objects in the
database
• The flag "useServerPrepStmts" is set true to make MySQL Connector/J use server-side prepared
statements
• The application is reading from a column having type BLOB, or the similar TINYBLOB, MEDIUMBLOB or
LONGBLOB
• The application is reading from this column using .getString() or one of the functions reading
numeric values (which are first read as strings and then parsed as numbers).
case Ty...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

aaaddress1@chroot.org
Windows Injection  101:
from Zero to ROP
./Bio✨
• ⾺馬聖豪, aaaddress1 aka adr
• Chroot, TDOH
• TDOHConf: 2016 議程組長 & 2017 活動組長
• 精通 C/C++、Windows 特性、逆向⼯工程
• Speaker: HITCON CMT 2015
HITCON CMT 2016 Lightning
SITCON 2016
SITCON 2017
iThome#Chatbot 2017
BSidesLV 2016
ICNC'17
MC2015
CISC 2016
資訊安全基礎技術⼯工作坊
資安實務攻防研習營
⼤大.⼤大.⼤大..⼤大概啦
aaaddress1@chroot.org
#murmur
Some Bullsh*t after I submit this session
aaaddress1@chroot.org
Amazing!
aaaddress1@chroot.org
cfp2017.hitcon.org
“六、欲投稿者請於 2017 年年 7 ⽉月 14 ⽇日前，⾄至⼤大會投稿
系統 ( https://cfp2017.hitcon.org ) 註冊並上傳稿件，俾
利利議程委員審核，審核順序以投稿時間先後為準，如已
達本屆所需論⽂文數量量，⼤大會得提前截稿，故請儘速完成
投稿程序。”
aaaddress1@chroot.org
2017/7/18?
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
aaaddress1@chroot.org
議程中請不要睡著 我也很想睡
請踴躍舉⼿手發⾔言 說好不插嘴的！
請勿吸菸、抽⼤大⿇麻、跑百米賽跑、玩碟仙、摸八圈、
跳八家將、炸鹽酥雞、到我背後抓寶、問我會不會FreeStyle
./CoC
@Loki the Corgi
aaaddress1@chroot.org
Evolution Of Malware
Long Story About How Malware Against AntiVirus
aaaddress1@chroot.org
R3m0t3-C0ntr0l;H4ck;C&C;
B4ckdo0r;Sh311;B0tn3t;K3y
l0gger;Ma1ware;Ro0t;W0rm;
Zer0-D4y;Trojan;Exp10it;H
4ck;$cript;Packet;Cr4ck;R
4T;$ecuri7y;vu1ner4bi1i7y
4dmini$tr4t0r;Byp4$$ing;=
Hacker Friendly World
aaaddress1@chroot.org
until AntiVirus;
aaaddress1@chroot.org
PE (Portable Executable);
aaaddress1@chroot.org
Virus Signature;
aaaddress1@chroot.org
PE (Portable Executable);
aaaddress1@chroot.org
DOS Header
⬅DOS Program
⬅NT Header
⋯⋯
PE
File Header
Optional Header
aaaddress1@chroot.org
DOS Header
⬅DOS Program
⬅NT Header
⋯⋯
1. DOS Header starts with 'MZ'

2. *(DWORD *)((DOS Header + 0x3c)
point to NT Header
PE
File Header
Optional Header
File Header is also referred to
as COFF header.
Records NumberOfSections,
TimeDateStamp,SizeOfOptionalHeade
r, etc.
aaaddress1@chroot.org
Optional Header
typedef'struct'_IMAGE_OPTIONAL_HEADER'{'
''WORD'''''''''''''''''Magic;'
''BYTE'''''''''''''''''MajorLinkerVersion;'
''BYTE'''''''''''''''...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HOW
  TO
  TRAIN
  YOUR
RFID
  HACKING
  TOOLS
By
  Craig
  Young
Security
  Researcher
Tripwire
  VERT
HOW
  TO
  TRAIN
  YOUR
  RFID
  HACKING
  TOOLS
Table
  of
  Contents
Introduction
  .....................................................................................................................................................................
  3
RFID
  At
  A
  Glance
  .............................................................................................................................................................
  4
What
  is
  an
  RFID
  Tag
  ...................................................................................................................................................................
  4
Low
  Frequency
  Cloning
  (T55x7)
  ...........................................................................................................................................
  5
High
  Frequency
  Cloning
  ............................................................................................................................................................
  6
Introducing
  the
  Proxmark3
  (pm3)
  ..........................................................................................................................
  7
Proxmark3’s
  FPGA
  ......................................................................................................................................................................
  7
Proxmark3’s
  CPU
  ........................................................................................................................................................................
  8
Proxmark3’s
  ADC
  ........................................................................................................................................................................
  9
Proxmark3’s
  Connections
  ..........................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defending Networks with Incomplete Information: A Machine Learning Approach
DefCon 21 – 2013
Page 1
Defending Networks with Incomplete
Information: A Machine Learning
Approach
Introduction and Abstract
Let's face it: we may win some battles, but we are losing the war pretty badly.
Regardless of the advances in malware and targeted attacks detection
technologies, our top security practitioners can only do so much in a 24 hour
day. Even less, if you consider they need to eat and sleep. On the other hand,
there is a severe shortage of capable people to do "simple" security monitoring
effectively, let alone complex incident detection and response.
Enter the use of Machine Learning as a way to automatically prioritize and
classify potential events and attacks as something can could potentially be
blocked automatically, is clearly benign, or is really worth the time of your
analyst.
In this Whitepaper we will present publicly for the first time an actual
implementation of those concepts, in the form of a free-to-use web service. It
leverages OSINT sources and knowledge about the spatial distribution of the
Internet to generate a fluid and constantly updated classifier that pinpoints areas
of interest on submitted network traffic and security tool log sources.
Whitepaper Topics:
Introduction and Abstract .................................................................................................................. 1
Security Monitoring: We are doing it wrong............................................................................. 2
Machine Learning and the Robot Uprising ................................................................................ 2
More attacks = more data = better defenses ............................................................................. 5
Designing a model to detect external agents with malicious behavior ........................ 6
Data Collection ...........................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

haya
ATT&CK红队战术漫谈
◉ haya
◉ 木星安全实验室 · 红队负责人
◉ Github: https://github.com/hayasec
◉ Blog:  hayasec.me
◉ 红蓝对抗与红队武器化
ABOUT ME
今天聊点啥？
ATT&CK与红队攻击战术漫谈
ATT&CK矩阵(站在攻击者的视角来描述攻击中各阶段用到的技术的模型)
初 始
访 问
执 行
攻 击
权 限
维 持
权 限
提 升
防 御
绕 过
凭 据
获 取
数 据
披 露
横 向
移 动
目 标
数 据
收 集
内 网
数 据
窃 出
偷渡式攻击
外部程序攻击
硬件植入
USB复制
鱼叉式附件
鱼叉式钓鱼
供应链攻击
可信关系
有效帐户
……
命令行界面
编译HTML文件
控制面板项
动态数据交换
通过API执行
通过模块加载执行
利用客户端执行
图形用户界面
LSASS驱动
本地作业任务
计划任务
脚本执行
服务执行
签名二进制代理
签名脚本代理执行
文件名后的空格
第三方软件
Trap程序
可信的开发工具
用户执行
WMI
Win远程管理
XSL脚本处理
……
辅助功能
账户操纵
Shimming应用
验证包
BITS任务
浏览器扩展
更改默认文件关联
组件固件
COM劫持
创建账号
DLL顺序劫持
Dylib劫持
外部远程服务
文件系统权限
隐藏文件和目录
挂钩
虚拟机技术
IFEO注入
内核模块和扩展
LSASS驱动
启动Agent
启动守护进程
本地作业调度
……
访问令牌操作
辅助功能
Bypass UAC
DLL搜索劫持
Dylib劫持
漏洞提权
EWM注入
文件系统权限
挂钩
IFEO注入
启动守护进程
新服务
路径拦截
Plist修改
端口监视器
进程注入
SID历史注入
任务计划
服务注册表权限
启动项
Sudo缓存
有效账户
Web Shell
……
账户操纵
Bash历史
暴力破解
凭证转储
文件凭证
注册表凭证
凭证漏洞利用
强制认证
输入捕获
输入提示
LLMNR投毒
网络嗅探
密码筛选器DLL
私钥
安全内存
双因素拦截
……
帐户发现
应用窗口发现
浏览器书签发现
文件和目录发现
网络服务扫描
网络共享发现
密码策略发现
外围设备发现
权限组发现
进程发现
查询注册表
远程系统发现
安全软件发现
系统信息发现
网络配置发现
网络连接发现
系统用户发现
系统服务发现
系统时间发现
……
访问令牌操作
BITS任务
二进制填充
绕过UAC
清除命令历史
代码签名
组件固件
COM劫持
控制面板项
DLL侧载
禁用安全工具
EWM注入
文件删除
文件权限修改
隐藏用户
隐藏窗口
IFEO注入
指标拦截
从主机移除指标
间接命令执行
安装根证书
InstallUtil程序
LC_MAIN劫持
……
AppleScript消息
应用部署软件
分布式对象模型
远程服务漏洞利用
登陆脚本
PtH
PtT
远程桌面协议
远程文件复制
可移动媒体复制
SSH劫持
共享Webroot
污染共享内容
第三方软件
Win管理员共享
Win远程管理
远程服务
……
音频捕获
自动化收集
剪贴板数据
数据整合
存储库数据
本地系统数据
网络驱动器数据
可移动媒体数据
电子邮件收集
输入捕获
浏览器中间人
截屏
视频捕获
……
自动化透传
数据压缩
数据加密
数据传输大小限制
透传的备用协议
C2通道进行透传
网络介质透传
物理介质透传
周期传输
……
常用端口
可移动媒体通信
代理传输
自定义协议
数据编码
数据混淆
域前置
备用信道
多段信道
多层加密
……
影 响
消 除
账户权限删除
数据销毁
磁盘擦除
终端拒绝服务
固件损坏
拒绝系统恢复
资源劫持
服务停止
数据传输操作
……
命 令
控 制
● 红队作战攻击重要步骤
● 战术中用到的技术点
● 工具改造与武器化
初始访问@TA0001
初始接入策略代表攻击者用于在网络中取得初始立足点
的(攻击)向量
打点?
初始访问: 打点
薄弱防护系统，边缘业务
同C段同ISP
关键集权系统
供应链
......
注册表
计划任务
初始访问：钓鱼攻击
载荷格式？
投递方式？
社工话术？
利用方式？
初始访问: 免杀宏
● VelvetSweatshop
● 诱导
● 白加黑
执行@TA0002
执行策略表示造成在本地或远程系统上执行由攻击者控
制的代码的技术。该策略通常与初始接入一起使用，作
为一旦获得访问就执行代码的手段，之后进行横向移动
以扩展对网络上远程系统的访问。
执行:LOLBINS
● https://github.com/LOLBAS-Project/LOLBAS
lolbins可以是带有Microsoft签名的二进制文件，可以是Microsoft系统目...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

GoBypassAV
整理理了了基于Go的16种API免杀测试、8种加密测试、反沙盒测试、编译混淆、加壳、资源修改等免
杀技术，并搜集汇总了了⼀一些资料料和⼯工具。
免杀专题⽂文章及⼯工具：https://github.com/TideSec/BypassAntiVirus
免杀专题在线⽂文库：http://wiki.tidesec.com/docs/bypassav
本⽂文涉及的所有代码和资料料：https://github.com/TideSec/GoBypassAV/
0x01 基于Go的免杀
Go语⾔言是⾕谷歌2009发布的第⼆二款开源编程语⾔言，Go语⾔言专⻔门针对多处理理器器系统应⽤用程序的编程进
⾏行行了了优化，使⽤用Go编译的程序可以媲美C或C++代码的速度，⽽而且更更加安全、⽀支持并⾏行行进程。
基于Go的各种免杀也就是使⽤用不不同的windows API为shellcode申请⼀一段内存，然后把指令寄存器器
指向shellcode的开头，让机器器执⾏行行这段shellcode。除此之外，再加上⼀一些其他⽅方式，也可以有效
的提⾼高免杀效果。
本⽂文就这些常⽤用免杀⽅方式进⾏行行总结汇总。
0x02 使⽤用不不同API
在本系列列上⼀一篇⽂文章 《76.远控免杀专题(76)-基于Go的各种API免杀测试》 中，已经对常⻅见的 16
种API免杀 效果进⾏行行了了测试，⼤大家可以浏览参考。
测试使⽤用的平台为VT平台： https://virustotal.com/
0x03 反沙盒检测
在本系列列的第75篇⽂文章 《75.远控免杀专题(75)-基于Go的沙箱检测》 中，对常⻅见的8种沙盒检测
⽅方式进⾏行行了了总结。
具体沙盒检测代码在这⾥里里： https://github.com/TideSec/GoBypassAV/tree/main/SandBox
测试结果为如下。
未使⽤用沙箱检测技术的，VT查杀结果为：10/71
使⽤用了了沙箱检测技术的，VT查杀结果为：8/70
这些都属于⽐比较常规、简单且已经公开的⽅方式，所以差别不不是很⼤大，沙盒基本都能反反检测了了。
0x04 Go编译对免杀的影响
在使⽤用Go进⾏行行免杀的时候， go build 的编译选项也对免杀效果有较⼤大影响。
在编译时，常⽤用的编译命令为 go build -ldflags="-s -w -H=windowsgui"
测试使⽤用的平台为VT平台： https://virustotal.com/ ，使⽤用的是专题76中的 HelloTide 代
码。
L. 直接使⽤用 go build ，VT免杀率7/70，免杀效果最好的，但⽂文件相对⽐比较⼤大，⼀一
个 helloworld 都能1.8M。
N. -ldflags="-s -w" 参数：VT免杀率7/70，主要是减⼩小⽂文件⼤大⼩小， helloworld 能缩减到
1.2M，没有增强免杀效果。
O. -ldflags="-H=windowsgui" 参数：VT免杀率13/70，主要是隐藏窗⼝口，但会降低免杀效
果，VT查杀增加4。
Q. -race 参数：VT免杀率20/70，在2021年年的时候这个参数效果很好，但现在已经不不能⽤用了了，
正常的 helloworld 加上这个参数后VT平台直接16个报病毒。
所以⽐比较推荐的编译命令为 go build -ldflags="-s -w" ，但是这样就会有⿊黑窗⼝口，后⾯面会说如
何解决⿊黑窗⼝口的隐藏问题。
0x05 加壳混淆
对程序进⾏行行加壳或者混淆也是常⽤用的免杀⽅方式，本系列列⽂文章之前也介绍过⼀一些加壳软件，⽐比如upx
加壳之类的，这⾥里里对⽐比⼀一下对Go程序进⾏行行UPX加壳的免杀效果。
还是使⽤用上⾯面 go build ，VT免杀率7/70的程序进⾏行行加壳对⽐比。
5.1 upx加壳
使⽤用最优加壳 upx --best 00-HelloTide.exe -o upx-hello.exe
加壳后⼤大⼩小从1.8M降为1.08M，但是VT免杀率降到了了13/70。
5.2 shielden加壳
使⽤用 safengine shielden 加壳2.4.0.0 软件进⾏行行加壳，加壳后⽂文件居然变⼤大到了了2.5M，VT免杀
率居然降到了了33/70，可以直接放弃这个了了。
5.3 VMProtect加壳
使⽤用 VMProtect Ultimate 3.4.0  进⾏行行加壳，加壳后⽂文件居然6.3M，VT免杀率居然降到了了
19/70。⽂文件那么⼤大，免杀效果也⼀一般，也可以放弃了了。
5.4 garble代码混淆
使⽤用 garble 可对Go程序进⾏行行编译混淆，起到⼀一定的免杀作⽤用。 项⽬目地...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前⾔
常规的shellcode注⼊⼀般是通过 VirtualAllocEx , WriteProcessMemory  和
CreateRemoteThread  来实现的，但是这种⽅式是被安全软件重点监控的，同时微软提供的
ETW接⼝也是可以轻易检测出上述⽅式进⾏代码注⼊的痕迹。本⽂的核⼼是讲解怎么利⽤具
备 RWX-S 权限且⾃身有签名的⽩DLL进⾏⼀种⽐较隐蔽的shellcode注⼊，
并讲解具体的代码实现以及在写代码实现的过程中遇到的坑。本⽅法是由⽂章提出的：https:
//billdemirkapi.me/sharing-is-caring-abusing-shared-sections-for-code-injection/ ，详情可
以参考此⽂章。
基础知识回顾
PE⽂件的每个section都具备⾃⼰的权限，表明他被映射到虚拟内存之后的操作权限，也就是
SECTION_CHARACTERISTICS  这个字段，占四个字节。
通常来讲 .text  节区只具备 IMAGE_SCN_MEM_READ  和 IMAGE_SCN_MEM_EXECUTE  权
限， .data  节区⼀般只具备 IMAGE_SCN_MEM_READ , IMAGE_SCN_MEM_WRITE  权限。 当PE⽂
件被映射到内存后，对⼀个不具备 IMAGE_SCN_MEM_WRITE  权限的节区进⾏写操作或者对⼀
个没有 IMAGE_SCN_MEM_EXECUTE  的节区进⾏执⾏时，都会报异常。
看微软的⽂档：document, 会发现⼀个权限叫做 IMAGE_SCN_MEM_SHARED 。 那共享到底意味
着什么？据测试显示：具备此权限的section会被当前系统所有的进程共享，如果进程A和进
程B都加载了具备IMAGE_SCN_MEM_SHARED权限的模块C，那么模块C的此section在系
统层⾯上只有⼀份，这也就意味着A进程对C的修改（有IMAGE_SCN_MEM_WRITE权限）
会影响到B进程
那么思路就来了，如果⼀个模块的某个节区是具备 RWX-S  权限，我只需要把它加载到进程A
中，然后修改它的内容为恶意代码，然后想办法让他加载到进程B中，就可以实现在B中执⾏
恶意代码了， 那这种利⽤主要分为如下⼏个步骤：
⾄于怎么去找⼀个具备 RWX-S权限的签名dll，原⽂作者也提供了⼀个yara规则在virustotal上
来筛选，不再细说:
这⾥提供⼀个我找到的DLL: https://www.virustotal.com/gui/file/855277c0aeea89d17a07e27
e9cf79c98b26e70e8e57561c4b592097e0032c4e9，
以后的代码都是基于此DLL完成的。
1. 找到⼀个有签名的并且具备 RWX-S 权限的dll。(不具备RWX-S权限也可以，可以patch系
统内的已签名的dll，但是这样会破坏签名，不够隐蔽)
2. 将DLL加载到进程A的内存⾥，修改 RWX-S 权限的section的代码进⾏patch
3. 调⽤  SetWindowsHookEx，使⽤DLL中的某个函数指针作为 HOOKPROC 参数，使得DLL被
注⼊到⽬标进程B中。
4. ⽬标进程B加载DLL，并触发恶意代码执⾏。
import "pe"
rule RWX_S_Signed_Search
{
  meta:
    description = "Detects RWX-S signed binaries. This only verifies
that the image contains a signature, not that it is valid."
    author = "Bill Demirkapi"
  condition:
    for any i in (0..pe.number_of_sections - 1): (
      (pe.sections[i].characteristics & pe.SECTION_MEM_READ) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_EXECUTE) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_WRITE) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_SHARED) )
    and pe.number_of_signatures > 0
}
其实这⾥⾯最关键的是步骤⼆，主要涉及两个问题：...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

消失的那几年
杨 蔚 301
白帽子的成长独白
2016.07.14
众安天下
关于我
01
90后，连续创业者，黑客理想主义者
02
乌云核心白帽子，大学肄业
03
原乌云合伙人，乌云众测平台负责人
04 北京众安天下科技有限公司创始人兼
CEO，安全自媒体平台出品人（301
在路上）
WeChat：2036234
Email：301@allsec.cn
杨 蔚 花名：301
众安天下
CONTENT
消失的那几年哪去了
这几年做到的事情
快速成长的秘笈
安全总结与建议
众安天下
1、消失的那几年哪去了
众安天下
消失的那几年哪去了
WHY?
高考失利，人生太顺，无法接受
WHAT?
网络工作室，把自己关在网络世界
里，但因经营不善，工作室关闭
HOW?
选择继续消失，逃避，不愿他人
看到自己的失意和落魄，退学。
WHERE?
与亲朋好友断绝了联系，失联很
久，在新的地方重新开始创业
一心想挤进"安全圈"
消失的那几年的愿景
众安天下
“大部分人的成长轨迹"
消失的那几年哪去了
众安天下
利用大量精力弥补
消失的那几年哪去了
301，一直在路上
众安天下
消失的那几年哪去了
" 301，什么时候来北京出差。"
——身边所有的声音
众安天下
2、这几年做到的事情
众安天下
高级安全顾问（2012.7—2014.2）
•
在国内知名安全咨询公司谷安天下，做渗透测试方向
安全顾问，"野蛮生长"
乌云合伙人，乌云众测负责人（2014—2016.4）
•
负责乌云企业商业运营及技术服务、创新业务，服务
企业和白帽子，并完成很多不可能的事情。
众安天下创始人兼CEO（2016年创业在路上）
•
安全人才服务、安全内容服务、提供一站式的企业安
全顾问服务等。
这几年做到的事情
众安天下
这几年遇到的事情
"白帽子，不信任，不理解"
——身边大部分的声音
众安天下
"你之所以看不到黑暗"
"是因为有人竭尽全力把黑暗挡在你看不到的地方"
这几年遇到的事情
——暴走大事件主编王尼玛
众安天下
3、快速成长的秘笈
众安天下
第一、健康心态
快速成长的秘笈
众安天下
第二、换位思考
快速成长的秘笈
众安天下
第三、自我驱动
快速成长的秘笈
众安天下
第四、提升效率
快速成长的秘笈
众安天下
第五、自信不自负
快速成长的秘笈
众安天下
第六、合理试错
快速成长的秘笈
众安天下
第七、专业技能
快速成长的秘笈
众安天下
第八、行业知识
快速成长的秘笈
众安天下
4、安全总结和建议
众安天下
"原地踏步就是退步"
安全的建议和总结
众安天下
"最大的对手是自己"
安全的建议和总结
众安天下
"真正懂你的人，不是自己"
"而是竞争对手"
安全的建议和总结
众安天下
"执行力是成功的第一生产力"
安全的建议和总结
众安天下
多数失败，死在"快"的路上
安全的建议和总结
众安天下
"大部分人：什么是竞争力？ "
安全的建议和总结
众安天下
"把简单的事情做到极致"
"就是核心竞争力"
安全的建议和总结
众安天下
"意欲取之，必先予之"
安全的建议和总结
众安天下
"安全是一种能力"
"技术转化为生产力"
安全的建议和总结
众安天下
在对的时间里
跟对的人
一起做对的事情
安全的建议和总结
众安天下
“认可、包容、机会 "
安全的建议和总结
——安全新人们的心音
众安天下
THANK YOU
聚天下英才而用之
以人为本，众安天下
www.allsec.cn
众安天下
301在路上
301@allsec.cn


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Wietze Beukema (@wietze)
D3FC0N, August 2022
SAVE THE ENVIRONMENT (VARIABLE)
HIJACKING LEGITIMATE APPLICATIONS WITH A MINIMAL FOOTPRINT
D3F
C0N
@Wietze
▪ Sr Threat Hunter on CrowdStrike’s OverWatch Elite team
▪ Based in London, UK
▪ Previously presented at BSides London, MITRE ATT&CK EU Community,
SANS DFIR
HELLO WORLD, WHO DIS?
2
@WIETZE
D3F
C0N
DLL HIJACKING
“Tricking a (legitimate/trusted) application into loading an arbitrary DLL”
Legitimate DLLs
Trusted program
Evil DLL
3
@WIETZE
D3F
C0N
Attacker-
controlled folder
Original folder
4
@WIETZE
DLL HIJACKING: COMMON TYPES
DLL SIDE-LOADING
Move vulnerable EXE, put next to malicious DLL
DLL SEARCH ORDER HIJACKING
Put malicious DLL in folder searched before legit DLL
DLL SUBSTITUTION
Replace the original DLL with a malicious one
D3F
C0N
Attacker-
controlled folder
Original folder
5
@WIETZE
DLL HIJACKING: LESS COMMON TYPES
PHANTOM DLL HIJACKING
Create malicious DLL in location that is searched for,
but normally does not exist
WINSXS HIJACKING
Manipulate Windows Side-by-Side infrastructure
INPUT-BASED HIJACKING
Manipulate the command line, Windows Registry, etc.
D3F
C0N
WELL DOCUMENTED
WELL RESEARCHED
WELL DETECTED
6
@WIETZE
D3F
C0N
7
@WIETZE
VARIABLES
D3F
C0N
▪ (Dynamic) variable that can be used by running programs
▪ Can be used in:
▪ Command shells (e.g. %VAR% on Windows, $VAR on Unix)
▪ As well as regular processes (e.g. getenv("VAR") in C)
▪ Typically stored as (ASCII) string
8
@WIETZE
ENVIRONMENT VARIABLES
D3F
C0N
ENVIRONMENT VARIABLES: A BRIEF HISTORY
An environment variable is a special case of a replaceable parameter.
If the SET command is used in the form
SET name=value
to add an environment variable to the system's environment block, the
string value will be substituted for the string %name% wherever the
latter is encountered during the interpretation of a batch file. This
capability is available only in versions 2.x, 3.1, and 3.2.
70
80
90
00
10
20
1978: Version 7 Unix introduces
environment variables
1982...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Protecting Against and
Investigating Insider Threats
A methodical, multi-pronged approach
to protecting your organization
Antonio A. Rucci
Program Director
Technical Intelligence and Security Programs
Global Initiatives Directorate
Oak Ridge National Laboratory
Oak Ridge, TN 37831
AGENDA
A methodical, multi-pronged approach
to protecting your organization
• Key indicators of an insider threat and how to detect
them
• Specific hiring practices to minimize your risk
• Security awareness training and education to thwart
opportunistic individuals
• Recent case studies that illustrate the key indicators and
how to protect against them
www.ornl.gov
AGENDA
A methodical, multi-pronged approach
to protecting your organization
• Key indicators of an insider threat and how to detect
them
• Specific hiring practices to minimize your risk
• Security awareness training and education to thwart
opportunistic individuals
• Recent case studies that illustrate the key indicators and
how to protect against them
Who Are The Insiders?
•
Employees
•
Former Employees
•
Contractors
•
Consultants
•
Suppliers
•
Visitors
•
Collaborators
• User facilities
• University faculty
• Industry
Pre-conditions
• Motive or need to be satisfied through the crime
• Ability to Overcome Inhibitions:
•
Moral values
•
Fear of being caught
•
Loyalty to employer or co-workers
•
Risk-Taking Behaviors
• Trigger that sets the betrayal in motion
• Opportunity to commit the crime
•
Poor and/or lax security practices
Motive
• Financial
• Anger
• Excitement
• Divided loyalties
• Arrogance
• The BIG 3:
- Greed
- Disgruntlement
- Revenge
• Moral Values
• Ethical Values
• Loyalty
• Fear
• Rationalization
Ability to Overcome
Inhibitions
Trigger
•
Personal or professional
event
•
Stress pushes individual to
the “breaking point”
•
React negatively, and
criminally
•
Emotionally stable/well
adjusted
•
React to stress in a positive
manner
At lea...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ode to the DEFCON 15 Badge
Joe Grand (Kingpin)
170 hours of total time spent
2 nights of my honeymoon (oh, how I lament!)
3 circuit board revisions to get it all right
863,600 total components bring them to light
6,800 hackers wearing the badge in all its glory
If you want to learn more, please read this fine story
A matrix of 95 LEDs (5 columns by 19 row)
Two coin cell batteries make the current flow
Six text cutouts and soldermask colors to show
If you're a human, speaker, goon, vendor, press, or uber bro
On power up the badge will not make a peep
But fear not, that's by design, it is only asleep
Touch the top icon (it's a button, really)
And get a scrolling text message intended for thee
Touch the top icon yet again (just trust me)
And you'll move to the next mode for custom text message entry
Hit the bottom icon to begin your noble quest
Then use either icon to cycle through the list
Tap both icons to save a character to your queue
16 letters long is the maximum we can do
When you're all done, seek out the solid block
Tap both icons again and on the screen your message will walk
The next mode sets the speed of your inscription
You can change it like a baud rate or a doctor's drug prescription
Select the scroll velocity between the numbers 1 and 5
Which goes from slow and boring to a thrilling autobahn drive
(Remember to tap both icons for the badge to come alive)
Next we arrive at our last badge state (finally)
A special treat known as persistence-of-vision or POV
Wave the badge in front of your eyes in one direction
And a secret message appears magically like the morning's first erection
If all you see is a jumbled mess of bright lights
Try hiding in the darkness, squinting your eyes, or changing those hard-coded bytes
(When your badge is not in use, set the mode back to snooze)
The source code is open and the schematics are free (as in beer)
So now you can be a hardware hacking engineer
Unpopulated footprints for a wirele...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PCI 2.0:
Still
Compromising Controls
and
Compromising Security
PCI? At DefCon? Again?
Use the hashtag #DefconPCI to rant on the
Twitterz during this talk. We damn sure will!
Use @defconPCIpanel for
comments or Twitter-heckling
Who are we?
• Dave Shackleford @daveshackleford
• Joshua Corman @joshcorman
• James Arlen @myrcurial
• Jack Daniel @jack_daniel
• Alex Hutton @alexhutton
• Martin McKeay @mckeay
Usual disclaimers
• We do not speak for our employers, clients or
customers.  Nor for our spouses, siblings, or
offspring.  But my dog will back me up.
• Our opinions are our own, the facts are as we
see them.
• We aren’t lawyers…etc.
• These QSAs are not your QSAs.
Déjà vu all over again
Déjà vu all over again
Last year…
• PCI 2.0 was new.
• PCI 2.0 was “fresh”.
• PCI 2.0 was just as frustrating as PCI 1.x.
• PCI 2.0 was still lacking in concrete guidance
on a LOT of things:
– Mobile devices
– Virtualization
• So…where the hell are we now?
The Good
Becoming
Compliant is not
easy
So what?
Does Compliance affect “secure” at
all?
We don’t know how to measure
“secure” so the best we can look at
is the frequency & characteristics
of incidents, and compare those to
PCI.
How difficult and targeted
were the attacks?
The Bad
The Bad
Sometimes people cheat
The Ugly
Is History Doomed to Repeat Itself?
• We are doing the same %&$# as a decade ago.
• Firewalls.
• SSL.
• Patches (maybe).
• Crypto (sort of).
• Can a WAF save us all!?
– Ahem.
The Ugly
The Solution(s)?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

REST API安全测试的思路
基于Swagger的REST API自动化安
全测试实践
贾玉彬 Gary
Gary_jia@rapid7.com
大纲
• 由应用安全说起
• 传统REST API安全测试
• 基于Swagger的REST API 的安全测试
在SDLC中尽早发现和修复安全问题
30X
15X
10X
5X
2X
Cost
Source:  NIST
Production
System
testing
Integration/ component
testing
Coding
Requirements
不同的团队不同的目标
DevSecOps
Image : Pete Cheslock at #DevOpsDaysAustin.
“Everyone is responsible for security” with the
goal of safely distributing security decisions at
speed and scale
It does not have to be like this:
传统的REST API安全测试
REST API
• REST – REpresentational State Transfer
• REST描述的是客户端和服务端的一种交互
形式，REST本身不实用，实用的是如何设
计RESTful风格 API
• 传输资源的形式一般是JSON和XML
RESTful结构的好处
RESTful通过一套统一的接
口为Web, iOS和Android提
供服务
*图片来自互联网
REST API安全问题会带来的后果
• 接口被滥用消耗系统资源
• 数据泄露
• 伪造/篡改数据
• 应用被仿制
• 引入其他安全问题
REST API是可被攻击的
• REST API是可以被常用的攻击方法进行攻击
的，如注入、XSS、CSRF、XML Entity攻击等
等
REST API测试
• 通常没有WEB界面与之进行交互，通过HTTP的各种终端工
具或自己编写HTTP客户端脚本与服务端通讯来进行测试
• 通过变化API调用参数组合，变化API功能调用顺序，实现
全面和各种复杂组合的调用
• 针对安全测试也存在同样的问题
以移动应用为例的测试过程（手工）
• 安装配置代理
• 配置测试移动设备
• 准备测试用数据
• 手工测试
安装并设置代理、配置移动设备
手工测试REST API（SQL注入为例）
•
测试是否存在注入漏洞
•
例如使用PUT方法更新用户档案
•
请求中包含参数值（first_name)
URL: http://192.168.202.131/api/user/1
Method: PUT
Parameter name: first_name
Attack values: test’’
手工测试REST API（SQL注入为例）
Request 1
使用test’’把两个单引号（’）注入
到请求
手工测试REST API（SQL注入为例）
Response 1
用户档案成功提交
手工测试REST API（XSS为例）
•
测试是否存在XSS漏洞
•
例如使用PUT方法更新用户档案
•
请求中包含参数值（first_name)
URL: http://192.168.202.131/api/user/1
Method: PUT
Parameter name: first_name
Attack values: <script>alert(1)</script>
手工测试REST API（XSS为例）
Request
在请求中使用
<script>alert(1)<script>把一
个脚本标签注入到first_name
参数值
手工测试REST API（XSS为例）
使用DAST工具测试REST API
• 手工测试REST API是个很具挑战性的工作
• 大部分的DAST工具都需要training mode对
REST API进行测试（使用复杂的JSON、XML、
GWT结构）
• 方法：导入预先录制的流量文件进行测试
以AppSpider + BurpSuite为例
• BurpSuite使用广泛
• AppSpider可以接受各种录制的流量并且可
以识别JSON、XML、GWT、AMF参数和值，
不需要使用training mode
DEMO
基于SWAGGER的REST API的安全测试
基于Swagger的REST API
• Swagger是一个简单又强大的REST API文档
生成工具
• 标准的、语言无关的，通过它计算机和人
类无需阅读代码、文档或者监测网络流量
就能发现并理解Web服务
Swagger REST API
DEMO
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright © 2010 Trustwave. All Rights Reserved.
A Whitepaper for DEF CON 18, July, 2010
This is not the droid you're looking for...
Christian Papathanasiou
Nicholas J. Percoco
June 21st, 2010
Trustwave
- 2 -
Copyright © 2010 Trustwave. All Rights Reserved.
A Whitepaper for DEF CON 18, July, 2010
Table of Contents
1
   EXECUTIVE SUMMARY............................................................................................ 3
1.1
About the authors.................................................................................................. 4
2
   INTRODUCTION TO GOOGLE ANDROID ................................................................. 5
3
   MOTIVATIONS BEHIND THIS WORK ...................................................................... 7
4
   LINUX KERNEL ROOTKITS...................................................................................... 9
4.1
Hurdles we faced when developing the Android rootkit........................................... 11
4.1.1
   Retrieving the sys_call_table address ......................................................... 11
4.1.2
   Compiling against the HTC Legend Linux kernel source code........................ 12
4.1.3
   Enabling system call debugging ................................................................. 14
5
   THE ANDROID ROOTKIT....................................................................................... 18
5.1
sys_read system call hooking ............................................................................... 18
5.2
Hiding from the user and from the OS................................................................... 19
5.3
Implications ........................................................................................................ 20
6
   CONCLUSIONS...................................................................................................... 22
7
   REFERENCES................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MindAPI
最近API安全概念停⽕的，正好前⼀阵在Twitter上看到⼀个API安全的思维导图，感觉很全⾯，
在这⾥稍微总结下。
⼀、框架识别
1.API框架种类
(1) REST APIs
RESTful 、OData
(2) GraphQL
这⾥有⼀个关于GraphQL的测试项⽬
https://github.com/nicholasaleks/graphql-threat-matrix
(3) SOAP
SOAP 很熟悉了，也就是WebService，开源的Service框架有Apache CXF、以及Apache
AXIS1 2等
(4) XML-RPC
以更简单的 XML 格式传输数据,这⾥很容易联想到Apache OFbiz XML-RPC 反序列化漏洞
(5) JSON-RPC
以JSON格式化⽅式传输数据
(6) gRPC-Protobuf
可以从header头、Content-Type、以及Access-control-expose-headers 响应头
2.API框架简介相关文档
https://smartbear.com/blog/soap-vs-rest-whats-the-diﬀerence/
https://www.odata.org/documentation/
https://www.howtographql.com/basics/1-graphql-is-the-better-rest/
https://www.smashingmagazine.com/2016/09/understanding-rest-and-rpc-for-http-ap
is/
https://www.soapui.org/docs/rest-testing/working-with-rest-services/
https://cloud.google.com/blog/products/api-management/understanding-grpc-openapi
-and-rest-and-when-to-use-them
https://openapi.tools/
⼆、⼀些框架⾃带URL特征
三、如何⿊盒进⾏API信息收集
这⾥主要列出了⼀些API接⼝测试的⼯具和⽹站及技巧
⼯具：Burp、mitmproxy、Wireshark、APKLeaks、APKEnum、Api-Guesser、Keyhacks
Google搜索技巧：site:target.tld inurl:api 、intitle:"index of" "api.yaml" site:target.tld、
WADL WSDL：inurl:/application.wadl、user ﬁletype:wadl、ext:wadl、user ﬁletype:wsd、
ext:wsdl、
OData：Inurl:/%24metadata
Github：https://github.com/search?q=target.tld+%252Bapi
https://github.com/search?q=target.tld+application.wadl&type=code
https://github.com/search?q=target.tld+*.wsdl&type=code
其他：intitle:"index of" intext:"apikey.txt" site:target.tld、allintext:"API_SECRET*" ext:env
| ext:yml site:target.tld
https://github.com/dxa4481/truﬄeHog
https://github.com/eth0izzle/shhgit
⼀些API聚合以及搜索⽹站：
https://apilist.fun/
https://apiharmony-open.mybluemix.net/public
https://www.programmableweb.com/
https://rapidapi.com/hub
http://apis.io/
https://app.swaggerhub.com/search
https://apis.guru/
https://www.postman.com/explore/apis
https://any-api.com/
https://smart-api.info/registry
https://www.apistack.io/
https://public-apis.xyz/
API字典及枚举⼯具：
四、API接⼝测试
1.⼀些⼯具
REST APIs：https://gith...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

7/7/13
IPython Notebook
localhost:8888/a1253220-71b8-49cd-bd84-1d0edbd6bd60/print
1/7
In [56]:
In [57]:
High level stats
In [58]:
Epoc to datetime
In [60]:
In [61]:
Device discovery over time
In [62]:
import pandas
import json
import os
import datetime
#the following is the path to your client json files
data_path="../../data/json_archive"
has_json_ext = lambda x: True if os.path.splitext(x)[-1] == ".json" else False
data_list=[]
for path, deeper_dirs, filenames in os.walk(data_path):
    for filename in filter(has_json_ext, filenames):
        f = open(os.path.join(path, filename), 'r')
        json_data = json.load(f)
        f.close()
        data_list.append(json_data)
df = pandas.DataFrame(data_list)
uniq_devs = df["bluetoothAddress"].nunique()
total_entries = len(df)
print "%-25s %-25s" % ("Uniq Devs:", uniq_devs)
print "%-25s %-25s" % ("Total Sightings:", total_entries)
Uniq Devs:                2489
Total Sightings:          9362
epoc_to_datetime = lambda x:datetime.datetime.fromtimestamp(float(x))
df["timestamp"] = df.timestamp.apply(epoc_to_datetime)
df.head()
Out[61]:
<class 'pandas.core.frame.DataFrame'>
Int64Index: 5 entries, 0 to 4
Data columns (total 10 columns):
bluetoothAddress    5  non-null values
bluetoothName       5  non-null values
clientType          0  non-null values
clientVersion       0  non-null values
deviceMajor         0  non-null values
deviceMinor         0  non-null values
latatude            5  non-null values
longitude           5  non-null values
timestamp           5  non-null values
type                0  non-null values
dtypes: datetime64[ns](1), float64(3), object(6)
all_devs = df[["timestamp"]]
all_devs.sort("timestamp")
all_devs = all_devs.set_index("timestamp")
all_devs["total"] = 1
all_devs["total"] = all_devs.total.cumsum()
fig = all_devs.plot(figsize=(15,5))
fig.set_title("Cumulitive sightings over time")
Out[62]:
<matplotlib.text.Text at 0x1087b4a50>
7/7/13
IPython Notebook
l...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A CTF-Style Escape Journey
on VMware Workstation
f1yyy@Chaitin.Tech
About us
●
Beijing Chaitin Tech Co., Ltd(@ChaitinTech)
○
https://chaitin.cn/en
○
https://realworldctf.com/
●
Chaitin Security Research Lab
○
Pwn2Own 2017 3rd place
○
GeekPwn 2015/2016/2018/2019 awardees
■
PS4 Jailbreak, Android rooting, IoT Offensive Research, ESXi Escape
○
CTF players from team b1o0p, Tea Deliverers
■
2nd place at DEFCON 2016
■
3rd place at DEFCON 2019
■
1st place at HITCON 2019
Before we start
●
VMM(Hypervisor)：Virtual Machine Monitor
●
Guest OS
●
Host OS
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
...
Normally, all of the sensitive behaviors of guest OS will be sanitized by the hypervisor
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
...
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
exploitation
...
What is Virtual Machine Escape
VMM
Guest OS
0
Guest OS
1
Guest OS
N
...
Host OS
exploitation
Execute arbitrary codes
on the host
network connectio
...
Introduction of
VMware Workstation
Architecture
Host OS
Physical Hardware
User mode
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Architecture after vmware runs
Host OS
Physical Hardware
User mode
VM Monitor
vmware-vmx
vmmon
VM
VM
VM
Host World
VM World
Attack Surface
Graphic
Ethernet
USB
SATA
SCSI
COM
Attack in Recent Years
(Pwn2Own 2019)
Graphic
Ethernet
USB
SATA
SCSI
COM
(TianfuCup 2018)
(Pwn2Own 2017)
Our Target
(Pwn2Own 2019)
Graphic
Ethernet
USB
SATA
SCSI
COM
(TianfuCup 2018)
(Pwn2Own 2017)
CVE-2019-5541
Analysis
How e1000e works?
Guest OS
TDT
TDH
TDBAL
TDBAH
e1000e virtual network card
registers
How e1000e works?
Guest OS
TDT
TDH
TDBAL
TDBAH
e1000e virtual network card
registers
write
How e1000e works?
Guest OS
TDT
TDH
TDBAL
T...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

August 8, 2008
Inducing Momentary Faults
Within Secure Smartcards /
Microcontrollers
DEFCON – Las Vegas
Christopher Tarnovsky
Flylogic Engineering, LLC.
chris@flylogic.net – http://www.flylogic.net
August 8, 2008
What is a momentary fault?
• Temporary forced change in behavior
• The change is precisely calculated
• A fault typically lasts no more than a few clock cycles
• Many faults may be executed to force favorable
behavior other than normal
August 8, 2008
How do we do this?
• Low-capacitance buffered driver
• Driver is capable of driving a ‘1’ or ‘0’
• Driver is capable of listening in “Hi-Z”
•
Low-voltage tolerant is a plus
August 8, 2008
Why would we do this?
• A series of changes can allow us too:
• Overwrite stack-pointer
• Force repeated loops in a code segment
• Falsify cryptograms
August 8, 2008
Inducing the fault
•
Physical connection to substrate
•
Use low-capacitance buffered driver
•
Tri-stated buffer is desired-
•
Allow eavesdropping
•
Overdrive at calculated point(s) in time
August 8, 2008
Eavesdropping (listening)
YELLOW: Databus signal
GREEN: Clock
PURPLE: Reset
BLUE: Trigger
August 8, 2008
Overdriving last slides databus
with a logic ‘0’
YELLOW: Databus signal
GREEN: Clock
PURPLE: Reset
BLUE: Trigger
August 8, 2008
Initial steps
• Behavior analysis
• Understand your objective (the goal)
• Determine possible areas of attack
• Areas such as:
• Address bus
• Data bus
• Cryptographic blocks
August 8, 2008
Address bus faults
• Likely choice for cryptographic memories
• Unlikely choice for microcontroller type devices
• Allows complete change of data bus
August 8, 2008
Data bus faults
• Most probable choice of attack
• Allows behavioral changes to many areas
August 8, 2008
Cryptographic block faults
• Limited use typically to Cryptographic Memory type
devices
• Can allow readout of write only keys
August 8, 2008
Execution steps
• Determine-
• When to induce the fault
• How long to induce the fault
• Do we need more than one fault
• Ca...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Drinking from LETHE:
New methods of exploiting and mitigating
memory corruption vulnerabilities
Daniel Selifonov
DEF CON 23
August 7, 2015
Show of Hands
1. Have you written programs in C or C++?
2. Have you implemented a classic stack smash
exploit?
3. … a return-to-libc or return-oriented-
programming exploit?
4. … a return-to-libc or ROP exploit that used
memory disclosure or info leaks?
Motivations
● Software is rife with
memory corruption
vulnerabilities
● Most memory corruption
vulnerabilities are directly
applicable to code
execution exploits
● And there's no end in
sight...
Motivations (II)
● Industrialized
ecosystem of
vulnerability
discovery and
brokering
weaponized exploits
● Little of this discovery
process feeds into
fixes...
The other AFL
Motivations (III)
● State actor (e.g. NSA
Tailored Access
Operations group)
budgets: ≈ $∞
● Bug bounties just
drive up prices
● Target supply, not
demand for exploits...
The Plan
● Sever the path between
vulnerability and
(reliable) exploit
● Why do programmers
keep hitting this
fundamental blindspot?
● Defenses are born in
light of attack strategies
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int bar(int x, int y) {
    return x + y;
}
<return address to C runtime exit>
Memory Safety
#include <stdio.h>
int main() {
    foo();
    bar(11, 12);
    return 0;
}
void foo() {
    int a;
    char b[23];
    gets(b);
    printf("Hey %s!\n",b);
}
int ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
UWB Real Time Locating Systems
Andrea Palanca
Luca Cremona
Roya Gordon
labs@nozominetworks.com
How Secure Radio Communications May Fail in Practice
© 2022 Nozomi Networks Inc.
2
Overview
01
02
03
04
Methodology of Research
Attack Demos
Remediations
05
Summary & Key Takeaways
Introduction
Introduction
4
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction
•
Ideal for short-range devices
•
Can transmit information quickly
over short distances
•
Ability to send data through solid
objects like walls and other barriers
•
UWB is the preferred
communication protocol for RTLS
Spectral density for UWB and narrowband - Source: FiRa Consortium
UWB
© 2022 Nozomi Networks Inc.
5
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction – Cont’d
•
Uses UWB signals to locate
stationary/mobile objects
•
3 components:
§
Tags
§
Anchors
§
Server that computes, shows
and stores tag positions
•
The time of arrival is analyzed to
determine the position of a tag
RTLS
Anchors
RTLS Server
Tag
Ts_1
Ts_2
Ts_3
Ts_4
UWB
Ethernet, or Wi-Fi, or other media
Operation of an UWB TDoA RTLS
© 2022 Nozomi Networks Inc.
6
Wireless communication systems are susceptible to various security threats that can compromise their
reliability and impact production operations
Introduction – Cont’d
Networks will be vulnerable
to attacks by cyber criminals
who are seeking to exploit
vulnerabilities in order to gain
access to sensitive data or
disrupt operations.
Cyber Threats
Source: FiRa Consortium
© 2022 Nozomi Networks Inc.
Motivation
According to the FiRa consortium, in 2018 there was an increased demand for “improvements to existing
modulations to increase the integrity and accuracy of ranging measurements”
Motivation
This is what motivated
us to take a d...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IoT 自动化安全平台体系建设
我是谁？从哪里来？要做什么？
l 我叫孟卓，ID：FengGou
l 来自小米 AIoT 安全实验室
l 保障米系智能产品的安全，赋能业务
团队任务如何达成？
l 消：消除隐患
l 防：防患于未燃
l 员：人员的成长
消除隐患
技术栈复杂
技术难
人才缺失
团队难
产品量激增
压力大
行业经验
无体系
面临严峻挑战
初步尝试
AIoT 消费级物联网产品安全基线
团队能力交叉
误入歧途 - 实验室变流水线工厂
二向箔
IoT自动化审计
的突破
业务构成 -- 抽丝剥茧
芯片
应用
模块
IPC
通信
用户
APP
IoT
智能联动
I2X
二维化
芯片接口
以太流量
无线流量
设备服务
控制协议
固件分析
源码分析
日志行为
接口Fuzz
APP Hook
云服务
攻击链组合
局域网
互联网
本地环回
无认证
弱认证
强认证
认证泄漏
认证绕过
认证劫持
RCE
信息泄露
拒绝服务
TARGET : MQTT
RESULT : HIGH
* 数据分析攻击链路分布
全天候自动化闭环
发现
方案
复查
关闭
学习
修完漏洞就安全了？
这是一个巨大的误区，安全是动态的。随
着技术的迭代，品类的多样化，开发者的
交替、供应的风险以及用户要求的提升，
很难找到一个「基点」来说明产品的安全。
赋能生态
小米
生态
链
三方
业务
合作
防患于未燃
产品构成
○
硬件/芯片
○
传感模块
○
操作系统
○
依赖库/开源代码
○
链路协议栈
不可控
○
应用协议栈/SDK
○
服务代码/APP
○
云服务
○
账号体系
可控
小米战场
AIoT
车联网 / 自动驾驶
机器人 / 工业控制
手机 / 电视 / 笔记本
人无远虑，
必有近忧。
——《论语》


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

JS逆向 | WebPack站点实战（⼀）
收录于合集
#JS逆向
4个
⽂章配套B站视频，很多话语简略了，建议配着视频看。
地址：https://www.bilibili.com/video/BV13F411P7XB/
开始之前了，简单过⼀下下⾯⼏个⽅法加深印象，便于更好理解加载器。也可以直接从
webpack标题开始看起。
Function/函数/⽅法
常规的js函数命名⽅法：
//1. 常规function
var test = function(){
    console.log(123);
}
function test(){
    console.log(2);
}
今天的主⻆，⾃执⾏函数。
//2. ⾃执⾏function
!function(){
    console.log(1);
}()
きっとまたいつか
Depapepe
2022-08-07 09:46 发表于北京
原创
不愿透露姓名的热⼼⽹友 ⼀位不愿透露姓名的热⼼⽹友
}()
// => function a(){} a()
//2.1
!function(e){
    console.log(e)
     var n={
    t:"txt",
    exports:{},
    n:function(){console.log("function n ")}
}
}("echo this")
//2.2
!function(e){
    console.log(e)
     var n={
    t:"txt",
    exports:{},
    n:function(){console.log("function n ")}}
}(
    {
        "test":function(){
                console.log("test")}
    }
)
//(["test":function(){console.log])
call/apply Function
[Fcuntion prototype call and  applay ](Function.prototype.call() - JavaScript | MDN
(mozilla.org))
允许为不同的对象分配和调⽤属于另⼀个对象的函数/⽅法。
call和apply的使⽤效果基本⼀致，可以让A对象调⽤B对象的⽅法：
让 Vx 对象调⽤ _x 对象的 say() ⽅法
var Vx={
       name:"⼀位不愿透露姓名的热⼼⽹友",
       age:"18cm"
};
var _x={
    name:"热⼼⽹友",
    age:"18mm",
    say:function(){console.log("name:"+this.name+" age:"+this.age)}
}
_x.say.call(Vx)
//name:⼀位不愿透露姓名的热⼼⽹友 age:18cm
Webpack
webpack ⼀个静态模块打包器，有⼊⼝、出⼝、loader 和插件，通过loader加载器对js、
css、图⽚⽂件等资源进⾏加载渲染。
实战站点：https://spa2.scrape.center/
WebPack 站点⻓什么样
⽅法1. 右键查看源码发现只会有js链接⽂件，没有其他多余的前端信息，f12看元素就会有
很多数据。
⽅法2. 看Js⽂件，⼀般会有⼀个app.xxxx.js或⻓得像MD5的⽂件名，然后js内容有很多a、b、
c、d、n...的变量来回调⽤，反正就是看着乱。
loader加载器
Webpack站点与普通站点的JS代码扣取是不⼀样的，因为Webpack站点的资源加载是围绕着加
载器进⾏的，然后把静态资源当作模块传⼊调⽤，传⼊的模块就是参数，需要加载什么就运⾏
什么模块。
先简单看⼀下加载器⻓相。
!function(e){
    var t={}
    function d(n){
        if (t[n])
            return t[n].exports;
        console.log(n)
        var r = t[n] = {
            i:n,
            l:!1,
            exports:{}
            };
        return e[n].call(r.exports,r,r.exports,d),
        r.l = !0;
   ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Antenna comparison
20 antennas were tested to see which ones were the best for receiving.
All the antennas are 3/4" Motorola TAD/TAE mount (aka "NMO").
The following lists are ordered as per what you see in the picture (left to right).
General information:
Manufacturer         Model                 Type                                             Freq rating/gain
-------------------  ------------------    ----------------------------------------------   -------------------------
Larsen               NMO-27 (new style)    1/4 wave base loaded                             27-28/0dB
Radiall/Larsen       NMO-27B               1/4 wave base loaded                             27-28/0dB
Larsen               NMO-30B               1/4 wave base loaded                             30-40/0dB
Larsen               NMO-50C               1/4 wave base loaded                             47-54/0dB
Larsen               NMO-2/70 (old sytle)  loaded 1/2 (VHF), closed coil collinear (UHF)    144-
148/6dB 440-450/3.5dB
Larsen               NMO-150 (new sytle)   5/8 wave base loaded                             144-148/3dB
Larsen               NMO-Q                 1/4 wave                                         150-170/0dB
Larsen               NMO-Q                 1/4 wave                                         95-105/0dB
Antenna Specialists  ASPRD1615             1/4 wave                                         430-470/0dB
Maxrad               BMUF9000              1/4 wave                                         896-940/0dB
Larsen               NMO-450               5/8 over 1/2 wave closed coil collinear          450-470/3.4dB
Motorola             TDE6082A (?)          closed coil collinear                            460-470/5dB
Larsen               NMO-UHF               5/8 over 1/4 wave open coil collinear            450-470/3.2dB
Maxrad               BMUF8125              1/2 over 1/2 over 1/4 wave open coil trilinear   806-866/5dB
Maxrad            ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!
 " #$
%
&''&
(
#)
*
+
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
&,)
&''&
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
(
-
+
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
)
#
(
#
!
"
#
$
%
%
&"
$
'
#
!
%
%
(
%
%
)
!
%
!
*
+
 *
,
-
 "
+
./
.
0
1
2
"
!
%
+
3
4
5
6
44
#
7
6
4
.
-
4
43
,
"
,
4
4
0
4
48
+
5!9
4
4:
,
"
+
4
4;
$
)
%
48
,
46
3
4<
34
=
4<
3
5
.
33
3
3
+
:
4
:
&
:
3
+
;
8
5
3
84
3
8
3
83
+
34
8
'
34
:
=
33
8
!4
,
>
!
(
%
!
>!
(
<
!
,
-
'
46
!3
%
4
!
<
!8
,
'
?
*
43
4
3
!:
,
3
:
4
=
*
4:
88
!
;
@
,
%
9
,
%
"
?
%
A
0
%
,
%
'!
9
,
5
%
%
"
5
%
%
,
-B
.
%
!
'
%
5
!
%
!
"
=
44
%
C-
,1<<D
%
E
F
."
%
%
!
%
?
A
5
!
5
5
!
6
Visible
Watermarking
Covert Channels
Steganography
Anonymity
Copyright Marking
Information Hiding
Linguistic
Steganography
Technical
Steganography
Robust
marking
Fragile
marking
Fingerprinting
Watermarking
Imperceptible
Watermarking
=
!4*
,
>
(
%
>
(
'
5
%
%
"
)
%
"
#
"
/
/
5
%
"
'
'
'
5
'
"
%
"
Æ
,
%
%
"
C1-<<D
%
B
"
C-
,1<6
,-D
%
"
%
"
<
,
%
*
!
&
!
%
+
!
$
CG$<6
D
C<6D
%
"
!
%
"
0
%
Æ
'
C1-D
)
E)
@
F
C,-<6D
%
"
%
%
%
%
%
"
%
%
%
9
'
%
%
%
%
%
%
'
"
$
%
5-
%
'
%
(
C6
D
5
,
9
4
#
%
%
#
%
%
"
%
%
%
!
"
%
5
0
#
"
#
-BC#-<<D
0
"
H
"
%
!
%
"
%
?
%
A
%
I
"
,
'
"
%
%
"
"
B
5
"
H
"
"
"
%
B
%
0
%
%
'
B
%
)
!
%
%
)
'
2!
,
"
H
"
%
!
J
"
5
"
5
"
"
%
%
%
!
'
"
44
%
"
"
"C-
,1<6
,-D
%
"
%
"
%
)
5
%
%
!
!
"
,
C<6D
B
?
"A
5
"
%
&
5
"
%
"
?
A
Æ
)
!
0
%
"
%
%
1
/
(
!
%
"
2
%
'
1(
E
"
FC1:;
D
%
"
%
!
)
'
%
"
K
"
"
'
5
"
%
'
"
,
#
4
#
5
5
%
B
"
)
0
,
-
%
0
%
%
!!
%
,
0
"
0
%
%
,
%
(
5
'
(
?
%
%
A
%
J
+
!
'
%
!
%
C#-<<
=
.4
D
%
,
"
%
%
%
!
'
5
#
#
5
5
%
"
!
5
E=
F
%
E=
F
%
E5
=
7F
'
%
5
%
%
%
%
43
"
#
$%&'
,
C
D
CGD
C
D
%
0
%
"
%
C#-<<
=
.4
D
,
%
"
=
)
C-4D
!
"
%
%
)
,
%
%
=8
C#
4
D
(
#
%
'
%
!
%
5
%
/
%
C#-<<
=
.4
-0D
5
'
Æ
!
'
%
"
%
!
?
A
5...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Google Drive 上传⼯具编写
有⼀天，有⼈找我帮忙写⼀个⼯具，被我义正⾔辞的拒绝了。我可不帮⼈写⼯具，我只是爱学习。
这部分内容，官⽅⽂档写得很是清楚。Google 提供的 APIs 访问是基于 Oauth2.0 认证的，其流程可以
⼤致分为以下⼏个步骤：
1. 客户端 App 发起认证（若⽤户没有登录，则需要先登录）
2. 弹出授权⻚⾯，⽤户点击允许后，Google 认证服务器给我们返回⼀个授权码（Authorization
code）
3. 客户端获取到授权码以后，⽤授权码向认证服务器请求 Access Token
4. 服务器验证授权码⽆误后返回 Access Token ⾄客户端
5. 拿到 Access Token 以后，就可以访问 Google APIs 了（其实这⾥还会返回⼀个Refresh token）
⼤家直接看下⾯的图可能会⽐较好理解⼀点：
上⾯的流程只是基于第⼀次获取 Access Token 的情况，因为 Access Token 是有期限的，默认是1个⼩
时，Access Token 过期之后，就需要通过 Refresh Token 来向 Google 认证服务器申请⼀个新的
Access token，不需要经历上⾯的1,2,3步。
0x00 基本认证
2
Refresh Token 并不是⼀直有效的，在下⾯的⼏种情况下将会失效：
⽤户撤销了对应⽤程序的授权
该 Refresh Token 已超过 6 个⽉未使⽤
⽤户修改了密码，并且 Refresh Token 授权的 Scope 包含了 Gmail
⽤户账号的 Refresh Token 数量已超出最⼤数量
⽤户属于具有有效会话控制策略的 Google Cloud Platform 组织
⽬前每个⽤户账号每个授权凭证有 25 个 Refresh Token 的数量限制，如果超过了这个限制，当你新建
⼀个 Refresh token 的时候将会使最早创建那个失效。⼀般来说，我们在经过⽤户授权，拿到授权码请
求到 Refresh Token 后，必须把它缓存起来，以便后续更新 Access Token。
因此在实际使⽤时，使⽤ Refresh Token 来申请 Access Token 即可。
登录 Google，访问 https://console.cloud.google.com/cloud-resource-manager?organizationId=0
点击创建项⽬
0x01 Refresh Token 期限
●
●
●
●
●
0x02 实操获取 Token
2.1 创建应⽤及 OAuth 客户端 ID
3
项⽬名称可⾃定义。创建后进⼊ 【API 和服务】-> 【OAuth 同意屏幕】
4
5
完成之后，进⼊【凭证】创建 OAuth 客户端 ID。
应⽤类型选择【桌⾯应⽤】-> 【创建】。
成功获取到想要的客户端 ID 和 客户端密钥。
还有两步，差点忘了。
6
选择【库】，搜索 【Google Drive API】-> 【启⽤】
组装⼀下连接，放⼊浏览器中访问：
2.2 获取 Authorization code
Plain Text
复制代码
https://accounts.google.com/o/oauth2/auth?client_id=[Application Client
Id]&redirect_uri=http://localhost&scope=[Scopes]&response_type=code
1
7
由于我这⾥已经登录了账号，因此直接点⼊账号即可。
8
成功获取 code。
关于常⽤的 Scope
POST 请求以下内容：
2.3 获取 Access Token 和 Refresh Token
Scope
描述
https://www.googleapis.com/a
uth/drive.file
对应⽤程序创建或打开的⽂件进⾏逐个访问
https://www.googleapis.com/a
uth/drive
访问⽤户所有⽂件的完全、允许的范围。只有在严格需要的情
况下，才会申请这个范围。
https://www.googleapis.com/a
uth/drive.appdata
允许访问 应⽤程序数据⽂件夹
9
成功获取到两个 Token。
由于每个 Access Token 有效时间很短。因此当 Access Token 过期后，服务器需要使⽤ Refresh
Token 来获取新的 Access Token 。
2.4 通过 Refresh Token 获取 Access Token ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

30/06/2009
1
Chema Alonso, José Palzón
30/06/2009
2
 Metadata:
 Information
stored
to
give
information
about
the
document.
▪ For example: Creator, Organization, etc..
 Hidden information:
 Information internally stored by programs and not
editable.
▪ For example: Template paths, Printers, db structure, etc…
 Lost data:
 Information which is in documents due to human mistakes
or negligence, because it was not intended to be there.
▪ For example: Links to internal servers, data hidden by format, etc…
Wrong management
Bad format conversion
Unsecure options
New apps
or program
versions
Embedded
files
Search engines
Spiders
Databases
Embedded
files
Wrong management
Bad format conversion
Unsecure options
30/06/2009
3
 The answer is NOT.
 Almost nobody is cleaning documents.
 Companies publish thousand of documents
without cleaning them before:
 Metadata.
 Hidden Info.
 Lost data.
Total:  4841 files
30/06/2009
4
Real Name
Username
Internal Domain
.. And more…
30/06/2009
5
Total:  896 files
30/06/2009
6
Total:  1075 files
30/06/2009
7
User
Software Version
Internal Server NetBIOS name
Remote Printer Name
Local Printer
30/06/2009
8
30/06/2009
9
 Office documents:
 Open Office documents.
 MSOffice documents.
 PDF Documents.
▪ XMP.
 EPS Documents.
 Graphic documents.
▪ EXIFF.
▪ XMP.
 And almost everything….
30/06/2009
10
EXIFREADER
http://www.takenet.or.jp/~ryuuji/
30/06/2009
11
http://video.techrepublic.com.com/2422-14075_11-207247.html
30/06/2009
12
30/06/2009
13
 Users:
 Creators.
 Modifiers .
 Users in paths.
▪ C:\Documents and settings\jfoo\myfile
▪ /home/johnnyf
 History of use.
 Operating systems.
 Software versions.
 Paths.
 Local and remote.
 Network info.
 Shared Printers.
 Shared Folders.
 ACLS.
 Printers.
 Local and remote.
 Internal Servers.
 NetBIOS Name.
 Domain Name.
 IPAddress.
 Database structures.
 Table names.
 Colum names.
 Devices info.
 Mobiles.
 Photo cameras.
 Private Info.
 Personal data.
30/06/2009
14
 Info is in the file in raw format:
 Binary.
 ASC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle
STICK THAT IN YOUR
(ROOT)PIPE & SMOKE IT
“leverages the best combination of humans and technology to discover
security vulnerabilities in our customers’ web apps, mobile apps, and
infrastructure endpoints”
WHOIS
@patrickwardle
always looking for
more experts!
xpc, rootpipe, malware, patches & 0days :)
OUTLINE
overview of XPC
the bug
in malware
patch bypass
patch(es)
Credits
hax0ring is rarely an individual effort
Ian Beer
Emil Kvarnhammar
Pedro Vilaça
uncovered rootpipe
Jonathan Levin
"Mac OS X & iOS Internals"
@emilkvarnhammar
@osxreverser
implants
backdoor
remotely accessible means of
providing secret control of device
injection
coercing a process to load a module
persistent malicious code
hooking
intercepting function calls
trojan
malicious code that masquerades as
legitimate
gotta make sure we’re all on the same page ;)
SOME DEFINITIONS
OVERVIEW OF XPC
modern IPC on OS X
a simple IPC mechanism which can provide security & robustness
XPC
“There are two main reasons to use XPC: privilege
separation and stability.” -apple.com
sandboxed
'XPC services'
[privilege separation]

[stability]
each XPC service has its
own sandbox
crashes in the XPC services
don't affect the app
used all over the place by Apple
XPC IN OS X
$
  find
  /System/Library/Frameworks
  -‐name
  \*.xpc
AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.FaceTimeService.xpc
AddressBook.framework/Versions/A/XPCServices/com.apple.AddressBook.MapLauncher.xpc
...
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.32.xpc
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Plugin.64.xpc
WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc
$
  find
  /Applications
  -‐name
  \*.xpc

iPhoto.app/Contents/XPCServices/com.apple.PhotoApps.AVCHDConverter.xpc
iPhoto.app/Contents/XPCServices/com.apple.photostream-‐agent.VideoConversionService.xpc

Xcode.app/Contents/Developer/Toolchains/.../XPCServices/SourceKi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Vulnerabilities 101:
How to Launch or Improve Your
Vulnerability Research Game
Joshua Drake, Zimperium
Steve Christey Coley, MITRE
DEF CON 24
Aug 7, 2016
Introductions
• About Josh
– 20-years of VR, Ran iDefense VCP
• About Steve
– CVE co-founder, “Responsible Disclosure” (sorry), CVSS,
CWE, ...
• Why we are doing this
– Currently, there is *way* more insecure code out there than
researchers. This isn't guaranteed in 10 years, though.
– We need more people looking at code that’s deployed in the
real world
• What we hope to accomplish by doing this
– Encourage more people to get involved
Disclaimers
• This is our opinion only
• Based on our own career experiences
• Others have their own opinions
• YOU… proving the cliche… are a unique
snowflake
• You’ll find your own way, but hopefully we can
help you find it faster
• No new ‘sploits here
What is a Vulnerability?
• Too many definitions
– Roughly: “a mistake in software’s design or implementation that allows
an ‘attacker’ to conduct activities that (1) affect other users and (2) are
not explicitly allowed or intended by the developer or sysadmin.”
• “What do you have?” vs. “What do you get?” - there must be a
difference
• “How much help must the victim give you?”  (user interaction)
– Automatic
– “Normal” usage (e.g., clicking on a link is *normal*)
– Was victim stupid/clueless? (“just copy this javascript: url
into browser”)
• “How much luck do you need?”
–ASLR, unusual configs, narrow race windows
What is a Vulnerability? (2)
•Vulnerabilities != Exploits (awesome
@SwiftOnSecurity tweet)
•A Vulnerability resides in the software itself,
doing nothing on its own
•An Exploit is a set of steps (possibly manual, or in
the form of a program) that interacts with the
software in a way that has a non-zero chance of
successfully taking advantage of a vulnerability”
What is Vulnerability Research?
• “The process of analyzing a product, protocol, or algorithm
in order to find unintended behaviors that allow an at...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MacOS Big)Sur内核漏洞挖掘和利用
Bio
0 1
Twitter(@peterpan980927)
阿里安全潘多拉实验室
高级安全工程师
iOS/macOS 安全研究&开发
KCon 2019 PPT 放映员&乐透操作手
Agenda
0 2
1.
Backgrounds
2.
Some case studies
3.
Mitigations overview & new features
4.
Attack macOS Big Sur
5.
Summary & Credit
Backgrounds
AppleOS Kernel
0 3
XNU: X is not Unix(Hybrid Kernel)
1.
Mach->(micro kernel)
2.
BSD
3.
IOKit
Mach Ports
0 4
Basic concepts
1. Communication channels for IPC
2. 32bit number in userspace
3. ipc_port struct in kernel space
4. Single receiver/One or Multiple Senders
/osfmk/ipc/ipc_object.h
struct ipc_port {
struct ipc_object ip_object;
struct ipc_mqueue ip_messages;
…
};
struct ipc_object {
ipc_object_bits_t io_bits;
ipc_object_refs_t io_references;
lck_spin_t io_lock_data;
}___attribute__((aligned(8)));
Mach Ports
0 5
Basic concepts
1.
Many kernel data objects are wrapped with mach ports
2.
E.g: Tasks(tfp0)/Driver instance(C++ obj)/clock/file_glob…
/osfmk/kern/ipc_kobject.h
#define IKOT_CLOCK
25
#define IKOT_IOKIT_CONNECT
29
#define IKOT_IOKIT_OBJECT
30
#define IKOT_VOUCHER
37
…
Mach Ports For IPC
0 6
Overview
Apple Driver
0 7
IOKit part
IOKit是一套基于C++子集构建的框架、库、工具和资源
支持设备的动态和自动配置（即插即用）
抢占式多任务，对称多处理…
不支持异常，多重继承，模版和RTTI
KEXT是内核扩展，包含Apple Driver
Apple Driver
0 8
Why?
1.
Kexts run inside kernel, some can even reachable within
the sandbox
2.
Kext deprecated in WWDC 2019
3.
System Extension replacing third party kext: DriverKit、
NetworkExtension、Endpoint Security
4.
Less developers, less attention
Apple Driver
0 9
Attack Surface
1.
ExternalMethod(driver independent)
2.
Notification Port(CVE-2020-9768)
3.
SharedMemory(TOCTOU)
4.
clientClose(CVE-2018-4326)
5.
setProperties(CVE-2016-1835)
Etc…
Apple Driver
1 0
Attack Surface
1.
ExternalMethod(driver independent)
2.
Notification Port(CVE-2020-9768)
3.
SharedMemory(TOCTOU)
4.
clientClose(CVE-2018-4326)
5.
setProperties(CVE-2016-1835)
Etc…
Apple Driver
1 1
Attack Surface
http://homes.sice.indiana.edu/luyixing/bib/CCS20-iDEA.pdf
Case)studies
Case Studies
1 2
CVE-2016-1825(baza...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IOT安全 - 测信道实战
演讲人：KEVIN2600
2019
@Kevin2600
议程
. 测信道的那点事
. 测信道案例简析
. 测信道 Power Analysis
测信道的那点事
测信道攻击是一种针对软件或硬件设计缺陷, 剑走偏锋的攻击方式
攻击途径通常采用被动式监听, 或通过特殊渠道发送隐蔽数据信号
攻击点不在暴力破解, 而是通过功耗; 时序; 电磁泄漏等方式达到
破 解 目 的 .  在 很 多 物 理 隔 绝 的 环 境 中 , 往 往 也 能 出 奇 制 胜
测信道
测信道
. Public key signature check
. Bootloader 加固 (bootdelay = 0)
. 屏蔽调试端口 UART; JTAG; SPI; I2C
. 电子设备全部物理隔离 (Air Gapping)
测信道 WordPress
测信道 Drupal
测信道门禁
测信道门禁
被动式:
: 声波信号采集还原打印机原文
: 美国 NSA 电磁波监听 (TEMPEST)
: 功耗分析破解南韩公交卡密钥系统 (3DES)
: 功耗分析获取 Philipe Hue 智能灯系统密钥 (AES)
主动式:
: Xbox360 Glitch 攻击 (运行 unsigned code)
: 智能网关 Hue NAND Glitch (得到 Root 权限)
: 通过毛刺注入成功获取硬件钱包 Trezor 闪存敏感信息
: 以色列 Ben-Gurion 大学通过 USB 发送电磁信号 (USBee)
测信道案例简析
时耗分析
时耗分析
NAND-Glitch
NAND-Glitch
物联网设备网关 (WinkHub)
通过网页对其进行访问 (set_dev_value.php)
curl “192.168.01/set_dev_value.php” -d “nodeId=a&attrId=; uname -a;”
NAND-Glitch
. NAND Flash 通常存储固件; Bootloader; 内核以及root files
. 使用数据线在系统启动, 读取 NAND 内核信息瞬间, 短接 I/O pin
. 在正确的时间点, 阻止 Bootloader 读取正确的内核数据从而进入
  shell 模式
NAND-Glitch
测信道 Power Analysis
功耗分析
. Power analysis (Simple & Differential)
. 处理器运行不同指令在功耗需求上也不近相同
. 需要了解目标设备所采用的加密算法
. 信号的采集必须在加密或解密的过程中完成
功耗分析
功耗分析 (ChipWhisperer)
. Colin O'Flynn 设计制作, 学习 SCA 功耗分析和毛刺注入神器
. 基于Python 跨平台开源软硬件项目 (Windows; Linux; MacOS)
. 可用于时序或电压毛刺注入攻击测试, 产生 <2nS 的脉冲信号
. 通过 DPA 差分功耗分析获取诸如 RSA; AES; 3DES 等加密密钥
功耗分析 (SPA)
. 处理器运行验证指令在功耗表现上不尽相同
. 密码验证过程功耗表现 (密码错误 -->无限循环)
. 寻找目标设备在特定时刻 (加密/解密) 功耗图形的差异
功耗分析 (SPA)
功耗分析 (DPA)
目标设备
测量方法
测量结果
功耗分析 (DPA)
功耗分析 (DPA)
功耗分析 (AES-128)
功耗分析 (DPA)
功耗分析 (电磁信号)
. 电磁波可通过 H 探头和软件无线电设备远程获取
. 芯片01转换产生电磁波从空气中泄漏, 其中包含密
  钥指纹信息
. Tel Aviv 大学科研人员通过测量分析电磁发射获取
  GnuPG 密钥信息
功耗分析 (电磁信号)
功耗分析 (DPA)
One More Thing ..
测信道 EMFI
测信道 EMFI
测信道 EMFI
测信道 EMFI
测信道 EMFI
Summary
百分百安全的系统并不存在
边信道分析与防御, 硬件安全必备技能
完美的设计, 实施过程中百密⼀疏, 将导致系统完全崩溃
谢谢观看
演讲人：KEVIN2600


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Mobile App Moolah:
Profit taking with Mobile Malware
Jimmy Shah
Mobile Security Researcher
Mobile App Moolah: Profit taking with Mobile Malware
2
•
Who we are
•
Mobile malware
•
Modern for-profit malware
•
Examples
Contents
Mobile App Moolah: Profit taking with Mobile Malware
3
Who we are
•
Mobile Antivirus Researchers
•
My team and I specialize in mobile malware and threat analysis on
existing(J2ME, SymbOS,WM, Apple iOS, Android) and upcoming
mobile platforms.
•
We work with a number of large mobile network operators.
Mobile App Moolah: Profit taking with Mobile Malware
4
Mobile Malware
In the Wild
Historical For-profit malware
Trends
Mobile App Moolah: Profit taking with Mobile Malware
5
In the Wild
SymbOS
J2ME
Android
Python
WinCE
MSIL
VBS
BlackBerry
Exploit
Linux
OSX
1200+ variants
Mobile App Moolah: Profit taking with Mobile Malware
6
Mobile Malware
In the Wild
Historical For-profit malware
Trends
Mobile App Moolah: Profit taking with Mobile Malware
7
•
What it does
– First reported J2ME trojan(2006)
– Pretends to access WAP web pages via SMS messages
– Written using the MIDletPascal programming tool
•
Profit?
– In reality, it attempts to send SMS messages to Premium Rate SMS
numbers
– Eventually spawned a large number of J2ME malware/variants
J2ME/Redbrowser.A
RedBrowser installation prompt
(Symbian OS, S60 UI)
“Carefully read following description of RedBrowser program
This program allows viewing WAP pages without GPRS
connection. RedBrowser connects to SMS server of your
operator (MTS, BEELINE, MEGAFON). Page is loaded by
receiving coded SMS. First 5Mb (650 SMS) of traffic are
provided free of charge in test mode. ATTENTION!!!
Program RedBrowser works ONLY on above mentioned cellular
operators.”
description text (original text in Russian)
Mobile App Moolah: Profit taking with Mobile Malware
8
J2ME/Wesber.A
•
What it does
– No GUI, almost pure for-profit J2ME trojan
– Program that disguises itself as an assistant program
– It contains two jpg ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
The Wide World of WAFs
Ben Feinstein, CISSP GCFA
SecureWorks Counter Threat Unit™
DEFCON 16
August 8, 2008
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Web Application Firewalls (WAFs)
•
PCI Data Security Standard
 Requirement 6.6
 Why should you care?
•
ModSecurity
 Concepts
 Core Rules
•
ModSecurity WAF Live Demos
 Reverse Proxy
 Embedded
 Content Injection in Response to Attack
What’s In This Talk?
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Firewall operating at the web application layer
•
Hardware or Software
•
Fluent in many tongues
 HTTP / HTTPS
 XML
 SOAP
 XML-RPC
 WS-*
•
Performs normalization / de-obfuscation
•
Detects attacks
•
Blocks attacks
•
Rewrites / Modifies requests and responses
Web Application Firewalls (WAFs)
The Basics
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Apache dynamically loadable module
•
Dual License
 Community Edition - GPLv2
 Commercial License
•
Created by Ivan Ristic
•
Commercialized by Breach Security
•
Core Rules released under GPLv2
ModSecurity Web App Firewalls
The Basics
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
I apologize in advance if I bore you
•
PCI is driving adoption of WAF (and Web App Vulnerability
Scanning)
•
Pentesters (i.e. QSAs): PCI will drive your business. You
will need to be familiar with WAFs to evaluate and subvert
them.
•
IT Security: You will be deploying WAFs because of PCI
•
Blackhats: You will be subverting WAFs for fun and profit!
Meet the Payment Card Industry!
Why Should You Care?
The Information Security Experts
Copyright © 2008 SecureWorks, Inc. All rights reserved.
•
Lots of new acronyms, yea!
•
PCI Security Standards Council (PCI)
•
PCI Data Security Standard (PCI DSS)
•
Other PCI security standards exi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows GDI Local Kernel Memory Overwrite
Vulnerability researched and exploit developed by
Joel Eriksson <joel.eriksson@bitsec.com>
About the bug
The Graphics Device Interface, GDI, is part of the Win32-subsystem and is responsible for displaying
graphics on devices such as video displays as well as printers.
Basic information about all GDI objects on the system are stored in a shared memory section named
GdiSharedHandleTable. This table is automatically mapped read-only into every GUI-process on the
system and its contents are only updated by the kernel.
Well, that is how it was supposed to be anyway. If one is able to determine the handle to the
GdiSharedHandleTable shared memory section, it is possible to make an alternate mapping with full
read-write access. Being able to write to data which only the kernel is supposed to write to can never be
a good thing, depending on ones perspective of course.
This bug was found and reported to Microsoft by Cesar Cerrudo from Argeniss over two and a half
years ago now (2004-10-22), but was not made public until the “Month of Kernel Bugs” project [1] in
November 2006. Windows 2003 and Vista is not vulnerable, but all releases of Windows 2000 and XP
were, until a couple of weeks after our talk at BlackHat Europe when a patch was released. ;)
When Cesar made the bug public, he made a PoC exploit available for crashing the system by filling
the entire table with 0x58-chars. I expected a real exploit for the bug to be released shortly afterwards,
but time went by and neither an exploit nor a patch was released. In January I decided to give it a try
myself.
By this time I had no idea whether it was even possible to reliably exploit this vulnerability, since it
was far from obvious judging from the PoC exploit and the crash it produced due to a read from NULL
pointer.
Reliably determining the GDI section handle
The first problem I faced was to come up with a reliable way for determining the handle to the sh...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Revealing Embedded Fingerprints:
Deriving intelligence from USB stack
interactions
 Andy Davis, Research Director NCC Group
Image from: p1fran.com
UK Offices
Manchester - Head Ofﬁce
Cheltenham
Edinburgh
Leatherhead
London
Thame
North American Offices
San Francisco
Atlanta
New York
Seattle
Australian Offices
Sydney
European Offices
Amsterdam - Netherlands
Munich – Germany
Zurich - Switzerland
Agenda
Part One:
• Overview of the USB enumeration phase
• Different USB stack implementations
• USB testing platform
• Installed drivers and supported devices
• Fingerprinting USB stacks and OS versions
Part Two:
• The Windows 8 RNDIS kernel pool overflow
• Challenges faced when exploiting USB bugs
• Conclusions
Part One: Information gathering
• Why do we care?
• If you connect to a device surely you already know the platform?
• Embedded devices are mostly based on Linux anyway aren't they?
• May provide information useful for other attacks
USB Background stuff
Image from: blog.brickhousesecurity.com
Overview of the USB enumeration phase
• What is enumeration for?
• Assign an address
• Speed of communication
• Power requirements
• Configuration options
• Device descriptions
• Class drivers
• Lots of information exchange – implemented in many different ways
Image from :http://ewalk2.blog117.fc2.com
The USB enumeration phase
Enumeration phase peculiarities
• Why is the device descriptor initially requested twice?
• Why are there multiple requests for other descriptors?
• Class-specific descriptors:
Different USB stack implementations
• Typical components of a USB stack
• Windows USB driver stack
• Linux USB stack
• Embedded Access USB stack
Image from: blogs.msdn.com
Typical components of a USB stack
• Host Controller hardware
• USB System software:
• Host Controller Driver – Hardware Abstraction Layer
• USB Driver
• Class drivers
• Application software
Image from: www.wired.com
Windows USB driver stack
Ima...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MSI - Microsoft Windows Installer Elevation of Privilege
Summary: The Microsoft Windows Installer permits under some circumstances to a “standard user” an arbitrary
permissions and content overwrite with SYSTEM privileges.
( Microsoft Windows Installer: https://docs.microsoft.com/en-us/windows/win32/msi/windows-installer-portal )
Products affected: Windows 10 Enterprise (1903) with latest security update (2019 November patch) and probably
also other versions (not tested). Windows 10 Enterprise - INSIDER PREVIEW (Fast ring) 10.0.19033 - Build 19033
Description:
It is possible and allowed by “Windows Installer service” to install a MSI package as “standard user”.
I have noticed, in my research, that when a “standard user” installs a MSI package , the “Windows Installer
service” triggers some operations with SYSTEM privileges. (see image below from Procmon)
Going forward with my research I found that, after a package is installed on the system, a “standard user” could
force a repair of the product with “/f” command line parameter.
In our case, for example, command “msiexec /qn /fa foo.msi” triggers the repair operation .
With this command I’ve seen a couple of interesting operations came out that caught my attention.
As SYSTEM, the  “Windows Installer service” try to set the permissions of the package files that are going to be
reinstalled.
After that, it read and writes the content of the package files ( stored within msi package ).
See image below from Procmon.
As we can see, the first time “Windows Installer service” tries to open one the files impersonating the “standard
user” but as a result it gets a “PRIVILEGE NOT HELD”, then, after that, it closes the file and reopens it as SYSTEM
without impersonating! Afterward it continues to set the permissions of the file as SYSTEM and writes its content.
This is clearly a point of possible exploitation! In order to obtain the desired a result, a “race condition” has to be
successfully exploited. The ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2017年，"Process Doppelganging", NTFS+section
https://github.com/hasherezade/process_doppelganging
https://www.youtube.com/watch?v=Cch8dvp836w
进程的创建不支持NTFS transacted文件,所以分割进程的步骤寻找创建方法
跟踪 CreateProcessW 调用 （xp）
NtOpenFile
NtCreateSection
NtCreateProcessEx
...
NtCreateThreadEx
在win10下，直接使用 NtCreateUserProcess 创建，看起来无法使用ntfs了，但是微软为了
兼容，也可以使用之前xp的创建进程的方法。
2018年
transacted_hollowing
https://github.com/hasherezade/transacted_hollowing
进程替换，只是利用了ntfs translation 和 file delete pending
2021年
Process Ghosting
https://github.com/hasherezade/process_ghosting
使用 delete pending file + Process Doppelganging的手法
NTFS Transactions
Delete Pending
逆向 DeleteFileW ，可以看到使用 NtOpenFile -> NtQueryInfomationFile -> NtClose
用NtOpenFile打开的文件只需要设置delete标志，使用
NtSetInformationFile(FileDispositionInformation) 设置文件为delete-pending
写入文件，因为文件状态是delete-pending,内容可以写入，但是其他外部文件读取会失败。
当关闭文件句柄时，文件也会被删除。


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 101
FIRST – A BRIEF MOMENT
OF SILENCE
DevNull
KingTuna
WELCOME TO DEF CON
HighWiz @highwiz
Will @bsummerz
Niki7a @Niki7a
Magen Wu @magen_wu
SecBarbie @SecBarbie
Shaggy @ShaggyMcG
n00bz @n00bznet
MEET THE PANEL
WELCOME TO LAS VEGAS
Pace Yourself
THIS IS DEF CON
DGAF
Everyone was a
n00b once.
All of us are still
n00bs at something.
THE COUNTDOWN
Simple rules for surviving DEF CON
Wash your hands, too
Three Hours Daily
Two meals daily
Once Per Day
THIS IS THE DESERT
Stay hydrated
All Good
Sit Down
And Drink
Water
Grab A
Glass of
Water
Call A
Doctor
THE DEF CON CRUD
Fist your friends
Fist them often
Seriously, wash your damn hands
THIS IS DICK
DON’T.
BE.
A.
DICK.
THE BASICS
Hold the door.
Keep your head up.
Pay attention.
Don’t block the hallway.
DON’T BA AN ASSHAT
Don’t ruin everyone’s time
DON’T HECKLE
If you don’t agree, talk
afterwards.
See the previous slide.
PHONES AND WIRELESS
Seriously?
This is a hacker convention.
Use your head.
ASK PERMISSION
Personal Space
PICTURES
Be Polite – Ask first
Still, expect to be in a picture or two.
Ask nicely if you don’t want to be in one.
NOT EVERYTHING IS FREE
Just because you see it laying
out, does not mean you can
take it.
HAVE A PLAN
Read the program.
HACKER TRACKER!
Talks fill up quickly.  Consider purchasing the videos from
TSOK.
HACKER TRACKER
• The official schedule app for
DEF CON
• Lots of good info about
DC27
• Available on the App Store
and Google Play
• You should have
downloaded it before now
THE TALKS
VILLAGES
AI Village
AppSec Village
Aviation Village
BCOS Block Chain Village
Bio Hacking Village
Blue Team Village
Car Hacking Village
Cloud Village
Crypto & Privacy Village
Data Duplication Village
Hardware Hacking Village
DroneWarz Village
Ethics Village
Hack the Sea Village
Ham Village
ICS Village
Internet of Things Village
Lock Bypass Village
Lock Pick Village
Monero Village
Packet Hacking Village
r00tz Asylum
Recon Village
Red Team Offense Village
Rogue’s Village
Social Engineering Village
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sniper Forensics
“One Shot, One Kill”
Christopher E. Pogue - Trustwave
Copyright Trustwave 2009
Confidential
Thank You Dan Christensen!
http://dcdrawings.blogspot.com/
Copyright Trustwave 2009
Confidential
Who Am I?
•
Senior Security Consultant for the Trustwave SpiderLabs
•
Master’s degree in Information Security
•
Author of “Unix and Linux Forensic Analysis” by Syngress
•
Author of the blog, “The Digital Standard”
•
Board of Governors for the HTCIA
•
Member of the USSS Miami Electronic Crimes Task Force
•
Speaker @ SANS “What Works in Incident Response” ‘09 and ‘10, The
Computer Forensics Show ‘09 and ‘10, Direct Response Forum, SecTor
‘09 and ‘10, USSS ECTF - Miami Conference, The Next HOPE,
BSIDESLV, and most recently, DEF CON 18.
•
Former US Army Signal Corps Warrant Officer
•
Former CERT team member – SEI at CMU
Copyright Trustwave 2009
Confidential
Agenda
• What is Shotgun Forensics?
• What is Sniper Forensics?
• Guiding Principles
• Create an Investigation Plan
• Data Reduction
• Volatile Data Gathering and Analysis
• Data Correlation
• Tools
• Case Studies
• Bring it All Together
• Conclusion
Copyright Trustwave 2009
Confidential
Shotgun Forensics
The process of taking a haphazard, unguided approach to
forensic investigations:
• “Old school”
• Image everything
• Reliance on tools –
autopilot
• Pull the plug
Copyright Trustwave 2009
Confidential
Sniper Forensics
The process of taking a targeted, deliberate approach to
forensic investigations:
• Create an investigation plan
• Apply sound logic
−
Locard
−
Occam
−
Alexiou
• Extract what needs to be extracted, nothing more
• Allow the data to provide the answers
• Report on what was done
• Answer the questions
Copyright Trustwave 2009
Confidential
Three Round Shot Group
Infiltration
• How did the bad guy(s) get onto the system(s)
Aggregation
• What did they do
−
What did they steal
Exfiltration
• How did they get off the system
−
How did they get stolen data off the system
* This is commonly referre...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Go With the Flow
Enforcing Program Behavior Through Syscall Sequences and Origins
Claudio Canella (@cc0x1f)
August 11, 2022
Graz University of Technology
Who am I?
Claudio Canella
PhD Candidate @ Graz University of Technology
 @cc0x1f
 claudio.canella@iaik.tugraz.at
1
Claudio Canella (@cc0x1f)
2002 2004 2006 2008 2010 2012 2014 2016 2018 2020 2022
0
0.5
1
1.5
2
·104
2,1561,527
2,451
4,935
6,6106,520
5,6325,736
4,6534,155
5,2975,191
7,939
6,5046,454
14,714
16,55717,344
18,325
20,149
15,044
Year
Vulnerabilities1
1Source: http://www.cvedetails.com/vulnerabilities-by-types.php
2
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
3
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
Limit Post-Exploitation Impact
3
Claudio Canella (@cc0x1f)
What to do?
Eliminate bugs
Limit Post-Exploitation Impact
3
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
control ﬂow
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
malicious ﬂow
4
Claudio Canella (@cc0x1f)
Control-Flow Integrity
1
2
3
4
5
6
Allow: 3 → [5,6]
Deny: 3 → ![5,6]
control ﬂow
CFI check
malicious ﬂow
4
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
5
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
Filter
install
5
Claudio Canella (@cc0x1f)
Linux Seccomp
Kernel
App.
Filter
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
System Call
5
Claudio Canella (@cc0x1f)
Linux Seccomp
no
Kernel
App.
Filter
terminate
System Call
System Call
return
5
Claudio Canella (@cc0x1f)
Sample
6
Claudio Canella (@cc0x1f)
Sample
Syscalls: 0 1 2 3 16 19 20 60 72 202 231
6
Claudio Canella (@cc0x1f)
Syscall-Flow-Integrity Protection
7
Claudio Canella (@cc0x1f)
Syscall-Flow-Integrity Protection
State Machine...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bugscan
发展历程
01
圈子成员
02
框架改进
03
发展历程
2015.2
正式发布
2011
诞生
历时四年，五次重构
2015.5
圈子发布
2015.8
Bugscan
沙龙
圈子人数增加到5000多人，插件由90个增加到600多
目前可针对20多种系统服务进行识别，弱口令破解；
可识别，扫描80多种主流web程序，网络设备的漏洞。
目前已扫描超过100万的目标，600万余条漏洞记录
圈子成员
圈子（社区）
圈子成员
圈子（社区）核心成员
各种通用型插件，数量最多，质量最高
快速跟踪热点漏洞
发现Xx狗拒绝服务漏洞
各种系统服务，协议漏洞
插件审核，圈子商城
插件审核，插件编写教程
Zero
星光点亮◇天
range
Medici.Yan
不流畅
LinE
框架改进-curl的改进
Curl的改进
框架改进-过滤插件
过滤插件的改进
爬虫插件
curl
目标
新目标
过滤型插件
主动插件
curl
目标
过滤型插
件
1.比如检测注入插件中，报错了，过滤型插件就能抓取到
2.比如其他插件在调用curl的时候，过滤型插件发现新的表单
框架改进-日志
日志的改进
服务器与节点通信
爬虫的网址的tree
插件的选派(assign)
插件的验证(audit)
插件调用curl
插件调用debug
task的分发
框架插件异常日志
通信
Task分发
选派assign
验证audit
Curl的调用
Debug日志
框架改进-日志
日志的改进
服务器与节点通信
爬虫的网址的tree
插件的选派(assign)
插件的验证(audit)
插件调用curl
插件调用debug
task的分发
框架插件异常日志
快速定位误报，漏报问题，
定位复杂的综合性bug
发现耗时的插件加以改进。
框架改进-任务分发时的优先级
爬虫插件会推送大量www的task
需要将task普通队列变成优先级队列。
将cms识别。cms类插件，系统插件等重要的插件级别设高。
THANKS FOR YOUR WATCHING


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tuning Your Brain
Tuning Your Brain
 Why does certain music get you out of a black
hole?
 Often when we're stuck in a black hole,  or just can't
figure the problem out - the right music will get us out
of it. Why does this work?  It seems motivating, and it
seems like we solve problems easier, and it seems to
create a flow.  I'll be going over the basics of the brain
structures, neurons, synapses and neurotransmitters,
before getting to how music effects the brain, and how
we think.
Your Brain
 Your brain is made of cells called neurons
 Neurons are in 3 basic parts

cell body

 dendrites [input]

presynaptic membrane is
polarized.

axon [output] –

movement along axon weakens
as it travels

Could be seen as analog
Your Brain
 Neuron cells are cells are interconnected  by
synapses.  from the neuron terminals [axon] to
the membrane of the  dendrite.
 Between the terminal of the axon and
membrane of the dendrite is known as the pre-
synaptic gap
Your Brain
 Neurotransmitters

First discovered by Otto Loewi

There are approximately 100 billion neurons in the human brain.

Neurotransmitters are released from presynaptic terminal  and across to the
receptor membrane on the dendrite.

This causes either depolarization (excitatory – increased likelihood of firing ) or
hyperpolarization (inhibitory- decreased likelihood of firing) of the membrane. If
there is enough (action potential)– the charge passes along the axon to the
terminal and the process repeats. Neurotransmitters  are inactivated after release
– either through re-uptake mechanisms or enzyme action.

Neurotransmitters  are inactivated after release – either through re-uptake
mechanisms or enzyme action.
Your Brain
  Major Brain Structures

Frontal Lobe

Parietal Lobe

Occipital Lobe

Temporal Lobe
[From Neuroscience For Kids]
Brainwaves

What are brainwaves? How are they  made?

 Records of the electrochemical transmission – polarization/ depolarization at t...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

POS SYSTEMSED
   Romantically available
   Hacker
   Outdoor day drinker
  Sort of an adrenaline junkie
Our Target
Motivation
Very common high security device
Companies often use on terminal encryption to justify

   weak security elsewhere.
The companies that do care often don’t have the resources

   to validate any security claims vendors make.
What this talk is not
Exhaustive comparison of all Pinpads / Card terminals
Endorsement or indictment of any speciﬁc vendor
Conﬁguration or Compliance Guide
What this talk is
In depth dive into one line of devices
Exploits!
Previous Work
Skimmers
Previous Work
Pong on payment terminals1
Previous Work
Tamper resistant bypasses

and emv protocol exploits2
Previous Work
2015 Survey of POS attacks

(90% use default PIN)3
Previous Work
Breaches
Device Overview
Linux under the hood (V/OS)
400 MHz, ARM11 32-bit RISC processor
ARMv6 instruction set :(
512MB (256MB Flash, 256MB SDRAM)
4 or 7 inch display!!! !
Connectivity
Varies by device conﬁguration
-Ethernet (optional)
-Wiﬁ (optional)
-Bluetooth (optional)
-USB host (optional)
-RS-232 (optional)
-Old IO methods from mx800 series
Generally expose similar functionality
Remote Attack Surface
2 TCP ports open
-Services expect XML messages
DHCP (sometimes)
Normal Operation
Generally frmAgent.exe running as usr1
Only communicates over conﬁgured interfaces

    - Generally USB or Ethernet
Daemons provide IPC for privileged operations
Physical Attack Surface
Smart Card Reader / Mag
Usb (Host)
USB(9600 Baud Serial)
Com ports
SD card slot
BERG

Disassembly
Tamper resistant hardware
Likes to wipe itself when opened up
Not necessary to get ﬁrmware
Warranty Voided!
Administrator Mode
Press 1 + 5 + 9
Enter pin
Massively increased attack surface!
Diagnostic Info!
Install Software Updates!
Software Update
Manual Interaction required

    unless using PAYware :...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Project “The Interceptor”
 Avoiding counter-drone systems with nanodrones
David Melendez Cano
R&D Embedded Software Engineer
Introduction
With massive drone industry growth, comes antidrone systems industry. Due to multiple and even
classic vulnerabilities of communications now used by drones, antidrone industry can take down
those drones using well documented attacks.
State of the art
Drone-antidrone competition is already put into scene, and we can look at the state-of-the-art from
two points of view:
•
Anti-drone systems:
◦ Detection:
▪ Image/Thermal cameras, and radar
▪ Flight plan
▪ Motor noise signatures
▪ Image recognition
▪ Radio control and telemetry signature
◦ Actions:
▪ Radio protocol specific attacks (Deauth WiFi, etc)
▪ Vendor sub-protocol specific attacks (Command injection/manipulation)
▪ Radio jamming
▪ GPS spoofing
▪ Camera blinding
▪ Capture with other aircraft
•
Drone countermeasures
◦ Physical
▪ Surrounding protection nets
▪ Swarm attacks
◦ Logical
▪ Spread spectrum radio techniques
▪ Inertial navigation with drift correction using image recognition  (No GPS)
▪ Use 3G/4G networks to control and telemetry
The main point of this paper resides behind the fact that state-of-the-art antidrone mitigations
claim they are effective, just because the frequency bands they use for control and telemetry are
illegal to disturb: (3G/4G)
This a reasonable point considering that many antidrone systems are managed, indeed, with
3G/4G links, but it has obvious limitations.
New approach
Using a communication system that claims to be secure  and immune to jamming, because
jamming it would be illegal,  is simply not enough when we are talking about, for example,
government/army equipment. Not to mention that you cannot fly if no 3G/4G coverage is available.
Also, physical detection is key to antidrone systems, based mainly on the aircraft size and radar
signature.
This new approach offers three main points:
Drone size: Small drones are more difficult to detect...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
GoPro or GTFO
A Tale of Reversing an Embedded System
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Agenda
Intro
GoPro Overview
Previous Research
Methodology/Findings
Future Research/Next Steps
Conclusion
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
INTRO
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
About Us
•
Todd Manning a.k.a. “El Isleño”
•
Sr. Research Consultant, Accuvant LABS’ Applied Research
Consulting
•
Previously Mgr. of Security Research at BreakingPoint Systems
•
Zach Lanier a.k.a. “quine”
•
Sr. Research Consultant, Accuvant LABS’ Applied Research
Consulting
•
(Net | App | Web | Mobile) pen tester type
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
Why the GoPro?
•
Highly popular, consumer “rugged” camera
•
WiFi-enabled
•
Possible applicability to other Amberella-based
devices
•
Including commercial IP-enabled CCTV installations
•
We focused mainly on GoPro Hero3 Black Edition
•
So most details apply, but may be some HW differences
•
Plus: IT’S EXTREEEEEEEEEEEEEEME!
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
GOPRO OVERVIEW
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
•  Ambarella A770 camera SoC
•
ARMv6 1136J-S core (@528MHz)
•  Sitronix ST7585 LCD
•  Atheros AR6233GEAM2D 802.11n + BT
controller
•  and more...
GoPro Overview
Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved.
•
H3B runs two operating systems:
•
ITRON
•
Embedded RTOS
•
Manages most of the camera bits
•
Runs the “GoPro” Webserve...