Aggregator

威胁情报的体系思考

2021年10月，福布斯发布了一篇关于美国FBI秘密命令谷歌提供任何输入特定搜索词的人员数据，其中提及到多份

2021年10月，福布斯发布了一篇关于美国FBI秘密命令谷歌提供任何输入特定搜索词的人员数据，其中提及到多份

2021年10月，福布斯发布了一篇关于美国FBI秘密命令谷歌提供任何输入特定搜索词的人员数据，其中提及到多份

On September 29, Ash Daulton, along with the cPanel Security Team, reported a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.29 to the Apache security team. The issue was fixed within two days, under CVE-2021-41773, and the patch was released on October 4. Apache urged to deploy the fix, as it is already being actively exploited.

2021年10月，福布斯发布了一篇关于美国FBI秘密命令谷歌提供任何输入特定搜索词的人员数据，其中提及到多份

中秋翻完了《六神磊磊读金庸》，趁着国庆闭环输出些内容。

中秋翻完了《六神磊磊读金庸》，趁着国庆闭环输出些内容。

中秋翻完了《六神磊磊读金庸》，趁着国庆闭环输出些内容。

This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware and detection engineering.

Click the “ebpf” tag to see all relevant posts.

In the last few posts, we talked about a bpftrace and how attackers can use it to their advantage. This post is about my initial ideas and strategies to detecting malicious usage.

Detecting BPF misuse

There are a set of detection ideas for Blue Teams. Since we primarily talked about bpftrace so far, let’s explore that angle.

Every day, Akamai’s Threat Research team tracks and mitigates phishing attack campaigns to help keep our customers — and their reputations — protected. Recently, they tracked an orchestrated attack campaign comprising more than 9,000 domains and subdomains, mainly targeting victims located in China. The phishing scam was abusing more than 15 high-profile and trusted brands spanning ecommerce, travel, and food & beverage industries. By using well-known brand names, the threat actors attempted to engage victims to participate in a quiz that, once completed, would result in winning an attractive prize. Akamai refers to this malicious modus operandi as a “question quiz” phishing attack campaign.

DDoS and AppSec attacks impacting the ANZ region (Australia and New Zealand) have been in the headlines of late, with several high profile companies seeing prolonged outages and leading to speculation as to whether the region is being specifically targeted? Let’s take a closer look at the types of attack vectors and malicious activity we’ve seen focused on customers down under.

Think how many websites you visit or videos you stream. Do you check your bank account or transfer money, download apps, play music, share updates on social media, or use the internet for any of the thousands of other digital experiences it enables every day?

创造价值绝对是一件美好的事:-)

创造价值绝对是一件美好的事:-)

创造价值绝对是一件美好的事:-)

"任何职业都可以成为黑客。" ——引自《黑客伦理与信息时代精神》。线下就业班宽字节安全线下就业班 第二期，于

"任何职业都可以成为黑客。" ——引自《黑客伦理与信息时代精神》。线下就业班宽字节安全线下就业班 第二期，于

"任何职业都可以成为黑客。" ——引自《黑客伦理与信息时代精神》。线下就业班宽字节安全线下就业班 第二期，于

This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware and detection engineering. Click the “ebpf” tag to see all relevant posts.

In the last post we talked about a basic bpftrace script to install a BPF program that runs commands upon connecting from a specific IP with a specific magic source port.

This post will dive into this idea more by leveraging more a complex solution.