Aggregator

error code: 521

网络安全研究人员发现，可以使用大型语言模型 (LLM) 大规模生成恶意 JavaScript 代码的新变种，以更好地逃避检测。 Palo Alto Networks Unit 42 研究人员在一项新报告中表示： “尽管 LLM 很难从头开始创建恶意软件，但犯罪分子可以很容易地使用它们来重写或混淆现有的恶意软件，使其更难检测。” “犯罪分子可以促使 LLM 执行看起来更自然的转换，这使得检测这种恶意软件更具挑战性。” 随着时间的推移，经过足够多的转换，该方法可以降低恶意软件分类系统的性能，诱使它们相信一段恶意代码实际上是良性的。 尽管 LLM 提供商已不断加强安全防护，以防止其出轨并产生意外输出，但恶意开发人员却宣传使用WormGPT等工具来自动编写令人信服的网络钓鱼电子邮件，这些电子邮件针对潜在目标，甚至会创建新的恶意软件。 早在 2024 年 10 月，OpenAI就披露它阻止了 20 多项试图使用其平台进行侦察、漏洞研究、脚本支持和调试的操作和欺骗网络。 Unit 42 表示，它利用 LLM 的强大功能迭代重写现有的恶意软件样本，目的是绕过“无罪推定”（IUPG）或PhishingJS等机器学习（ML）模型的检测，从而有效地为创建 10,000 种新型 JavaScript 变体铺平了道路，同时又不改变其功能。 对抗性机器学习技术旨在每次将恶意软件作为输入输入系统时，使用各种方法对其进行转换——即变量重命名、字符串拆分、垃圾代码插入、删除不必要的空格以及完全重新实现代码。 该公司表示：“最终的输出是恶意 JavaScript 的新变种，它保持了与原始脚本相同的行为，但恶意分数几乎总是低得多。”并补充说，算法在 88% 的时间内将其恶意软件分类器模型的判定从恶意转变为良性。 更糟糕的是，这些重写的 JavaScript 工件在上传到 VirusTotal 平台时也会逃避其他恶意软件分析器的检测。 基于 LLM 的混淆提供的另一个关键优势是，它的大量重写看起来比 obfuscator.io 等库实现的重写自然得多，后者由于它们对源代码引入更改的方式，更容易可靠地检测和指纹识别。 Unit 42 表示：“在生成式人工智能的帮助下，新的恶意代码变种的规模可能会增加。不过，我们可以使用相同的策略来重写恶意代码，以帮助生成可以提高机器学习模型稳健性的训练数据。”       转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/iSCmefHzaCwcHO0tuNkk2w 封面来源于网络，如有侵权请联系删除

Ldapper A GoLang tool to enumerate and abuse LDAP. Made simple. Ldapper was created with for use in offensive security engagements for user enumeration, group enumeration, and more. Ldapper uses familiar “net” commands such as...

The post ldapper: A GoLang tool to enumerate and abuse LDAP appeared first on Penetration Testing Tools.

A vulnerability was found in Mozilla Firefox 27.0. It has been rated as problematic. Affected by this issue is the function nsHTMLDocument::Open of the component Popup Blocker. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2014-1511. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in WebkitGTK+ up to 2.22.6/2.23.90. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file UIProcess/API/gtk/WebKitScriptDialogGtk.cpp of the component UIProcess Subsystem. The manipulation leads to memory corruption. This vulnerability is known as CVE-2019-8375. The attack can be launched remotely. Furthermore, there is an exploit available.

我认为这是2024最好用的漏洞，你觉得呢？

我认为这是2024最好用的漏洞，你觉得呢？

0x01前言在前一篇文章中介绍了一个仍然可以用于最新版PbootCMS的老漏洞DVB-2021-2510,并对漏洞流程进行分析，给出了在有限条件下利用漏洞的方式。本文将在前一篇文章的基础上继续给出新的

我认为这是2024最好用的漏洞，你觉得呢？

apk.sh apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding, and patching an APK. Features apk.sh basically uses apktool to disassemble, decode and rebuild resources...

The post apk.sh: makes reverse engineering Android apps easier appeared first on Penetration Testing Tools.

A vulnerability was found in Microsoft Windows and classified as critical. Affected by this issue is some unknown functionality of the component GDI. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2017-0005. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Word and Excel 2007 SP3 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2017-0006. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft SharePoint Server 2007 SP3. It has been classified as critical. Affected is an unknown function. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2017-0006. It is possible to launch the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in FreeType up to 2.6. It has been classified as critical. This affects the function parse_charstrings of the file type1/t1load.c. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2016-10244. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in Microsoft Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component GDI. The manipulation leads to improper access controls. This vulnerability is known as CVE-2017-0001. It is possible to launch the attack on the local host. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical has been found in Apple Watch up to 1.0.2. Affected is an unknown function of the component ICU. The manipulation leads to numeric error. This vulnerability is traded as CVE-2014-8147. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

NimPlant – A light first-stage C2 implant written in Nim and Python   Feature Overview Lightweight and configurable implant wrote in the Nim programming language Pretty web GUI that will make you look cool...

The post NimPlant: light-weight first-stage C2 implant written in Nim appeared first on Penetration Testing Tools.

A vulnerability was found in Apple Watch up to 1.0.2. It has been rated as critical. This issue affects some unknown processing of the component ICU. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2014-8146. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in International Components for Unicode up to 55.0. Affected is the function resolveImplicitLevels of the file common/ubidi.c. The manipulation leads to numeric error. This vulnerability is traded as CVE-2014-8147. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in International Components for Unicode up to 55.0. It has been rated as critical. This issue affects the function resolveImplicitLevels of the file common/ubidi.c. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2014-8146. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.