命令注入ISO：Basilic 1.5.14利用
命令注入是一种攻击，攻击者试图传递恶意载荷，这些载荷会被应用程序不当处理并在系统shell里执行。此漏洞会导致脆弱应用程序的宿主机上出现远程代码执行。
Petya — Technologically Challenging and Imaginative Ransomware
The malware uses the following icons to disguise its EXE files as PDF and RAR executables. The attacker then sends malicious code to the target via email, tricking the victim into executing it. In this way, an attack is successfully launched via social engineering.
Petya Variant Sample Technical Analysis
On the evening of June 27, 2017, multiple enterprises were attacked by ransomware, hence service interruption was caused. The first infections were identified in Ukraine. Since then, it has spread to many countries, including Brazil, Germany, Russia, and the US. This event had such an extensive and significant impact that technical support personnel of NSFOCUS paid close attention to it, and captured and analyzed the sample immediately.
2016 DDoS Threat Trend
In this report, we present a multi-dimensional analysis of DDoS attack data and botnet data and summarize and analyze typical attack events in 2016, revealing threats of DDoS attacks and the overall threat trend in 2016.
Microsoft Windows Server 2003 R2 IIS 6.0 Remote Code Execution Technical Analysis and Solution
On March 37, Zhiniang Peng and Chen Wu disclosed the Internet Information Services (IIS) 6.0 WebDAV remote code execution vulnerability, which has been assigned CVE-2017-7269 and CNNVD-201703-1151. This vulnerability, which could cause buffer overflows, is associated with the ScStoragePathFromUrl function in the WebDAV service in IIS 6.0 in Microsoft Windows Server 2003 R2.
Dridex Banking Malware Sample Technical Analysis and Solution
IBM’s X-Force security team recently discovered an updated version of Dridex, called Dridex v4. Dridex is one of the most popular banking trojans. It was first spotted in 2014 when it was viewed as the successor of GameOver ZeuS (GoZ) because it uses GoZ-related techniques. An important improvement in Dridex v4 is that it evades detection antivirus software by introducing the AtomBoming technique for malicious code injection.
ElasticSearch Hit by Ransom Attack
Over 34,000 vulnerable MongoDB databases were hit by a ransom attack. Data were erased from these databases and ransoms were requested for returning data. Then on Jan 18th 2017, several hundreds of ElasticSearch servers were hit by a ransom attack within a few hours.
Power Outage Caused by the Cyber Attack on Ukrenergo Technical Analysis and Solution
Ukrenergo, a major energy provider in Ukraine, experienced a power failure on the night of December 17, 2016, which involved the automatic control system of the “North” substation in New Petrivtsi close to Kiev. The blackout affected the northern part of Kiev, the country’s capital, and surrounding areas.
“Shifu” Banking Trojan Technical Analysis and Solution
The banking trojan “Shifu” was discovered by the IBM counter fraud platform in April, 2015. Built based on the Shiz source code, this trojan employs techniques adopted by multiple notorious trojans such as Zeus, Gozi, and Dridex.
German Internet Outage on November 27 Technical Analysis and Solution
On November 27 (Sunday), at around 17:00 (local time), Deutsche Telekom was hit by a cyberattack, resulting in more than 900,000 routers getting disconnected, as confirmed by the company. The outage lasted several hours. Later, the problems continued on Monday morning from 08:00. Besides network access, the affected routers are used by Deutsche Telekom customers for fixed telephony and TV services.