永恒之石EternalRocks蠕虫病毒处置手册

近期,安全研究人员发现了一款新的恶意软件。这款恶意软件与 WannaCry勒索软件一样,通过利用Windows SMB文件共享协议中的漏洞自行传播,但是与后者不同的是,它使用了近期泄露的美国国家安全局(NSA)的多种黑客工具,而Wannacry仅使用了2种!

绿盟科技的安全专家在对其进行分析之后发现,EternalRocks具有病毒的特征,而且能够进行自我传播,其危害性需要引起各单位的重视,本文即是对该蠕虫病毒给出了企业内的应急处置方案。 阅读全文 “永恒之石EternalRocks蠕虫病毒处置手册” »

Analysis on Exposed IoT Assets in China

With the maturity of sensing, computing, and communication technologies, the Internet of Things (IoT) will be more and more widely used in various industries. Gartner, a market research agency, predicts that endpoints of the IoT will grow at a 33% CAGR from 2015 through 2020, reaching an installed base of 20.4 billion units, with almost two-thirds of them consumer applications. Spending on networked consumer and business endpoints will displace non-networked, growing at a 20% CAGR to $2.9 trillion. 阅读全文 “Analysis on Exposed IoT Assets in China” »

Analysis Report on the WannaCry Sample

The sample exploits the ETERNALBLUE SMB vulnerability or DOUBLEPULSAR backdoor for propagation and infection of the ransomware. The sample first connects to the domain name http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com, to test network connectivity. If the network is reachable, the sample exits; otherwise, the sample carries out subsequent behaviors. Therefore, a reachable domain name can be registered to stop further attacks. 阅读全文 “Analysis Report on the WannaCry Sample” »

Blackmoon银行木马新样本技术分析与防护方案

在2016年报道的盗取超过15万韩国用户银行信息的Blackmoon银行木马于2017年又被发现采用了全新的框架模式来对网络银行进行攻击,通过三个分开但又彼此联系的步骤来部署该木马,并进行后续的攻击。这与在2016年的以adware和exploit kits为传播方式的框架完全不同。 阅读全文 “Blackmoon银行木马新样本技术分析与防护方案” »