十二月安全舆情报告
20181月第2周舆情周报:安卓恶意软件、新欺诈样本、重大缺陷、其他安全事项等FakeBank恶意软件获取敏感的银行短信新闻
https://www.scmagazine.com/fakebank-malware-accesses-sensitive-sms-banking-messages/article/736311/
MaMiMac木马挟制DNS设置，安装root攻击者可以攻击中间人
http://www.securityweek.com/mami-mac-malware-hijacks-dns-settings
APT新动向|揭示金鼠组织的三次攻击
http://www.freebuf.com/news/159750.html
iCloud艳照门黑客被FBI抓捕
https://thehackernews.com/2018/01/celebgate-fappening-hacker.html
一个挖矿样本的详细剖析
https://secrary.com/ReversingMalware/CoinMiner/
儿童app潜伏色情软件
https://www.hackread.com/android-apps-for-kids-with-pornographic-malware/
遐想研究人员发现网络交换机换机的后门和隐藏的账户
https://www.bleepingcomputer.com/news/security/lenovo-discovers-and-removes-backdoor-in-networking-switches/
#malspampushing#NanoCore#RAT
http://malware-traffic-analysis.net/2018/01/12/index.html
虚伪Spectre和Meltdown补丁，Smokeloader恶意软件
https://blog.malwarebytes.com/cybercrime/2018/01/fake-spectre-and-meltdown-patch-pushes-smoke-loader/
英特尔Broadwell和HaswellCPU在固件更新后遇到重新启动
https://www.bleepingcomputer.com/news/hardware/intel-broadwell-and-haswell-cpus-experiencing-reboots-after-firmware-updates/
2018冬奥会被用作钓鱼攻击诱饵
https://www.scmagazine.com/2018-winter-olympics-being-used-as-phishing-attack-bait/article/735639/
JuniperJunos平安绕过破绽CVE-2018-0009影响多个版本
http://toutiao.secjia.com/cve-2018-0009
WhatsApp攻击者可能会破解群组新闻效果
https://threatpost.com/whatsapp-downplays-damage-of-a-group-invite-bug/129387/
Ursnif恶意软件的新变体接受了新的逃避技术——doubleprocesshollowing”
http://securityaffairs.co/wordpress/67636/malware/process-hollowing-ursnif-malware.html
Cryptominer恶意软件通过恶意广告传播
https://www.scmagazine.com/researchers-spotted-malware-coin-miners-in-malvertising-campaigns/article/736315/
#Malspampushingfakeinvoicedelivers#AgentTesla#Keylogger
https://malwarebreakdown.com/2018/01/11/malspam-entitled-invoice-attched-for-your-reference-delivers-agent-tesla-keylogger/
Jackson-databind爆出远程代码执行破绽CVE-2017-17485
http://toutiao.secjia.com/cve-2017-17485
2017数字加密货币安全报告
苹果系统HighSierra10.13.2又爆0Day修改你的设置没有密码的缺陷
http://toutiao.secjia.com/high-sierra-10-13-0day
Campaign使用最近公布的WebLogic破绽来部署Monero矿工
https://isc.sans.edu/forums/diary/Campaign is using a recently released WebLogic exploit to deploy a Monero miner/23191/
思科统一通讯管理器爆出跨站剧本破绽CVE-2018-0118还没有补丁
http://toutiao.secjia.com/cve-2018-0118
SAP内核身份验证爆发，绕过缺陷CVE-2018-2360可执行未授权操作
http://toutiao.secjia.com/cve-2018-2360
微软office内存损伤缺陷爆发CVE-2018-0812可以执行任何代码DoS
http://toutiao.secjia.com/cve-2018-0802
VirusTotal宣布推出一款名为VirusTotalGraph可视化工具旨在协助恶意软件分析
http://securityaffairs.co/wordpress/67572/malware/virustotal-graph.html
研究人员在西部数字存储设备中发现了硬编码后门
https://hotforsecurity.bitdefender.com/blog/researcher-finds-hardcoded-backdoor-in-western-digital-storage-devices-19417.html
新的加密硬币挖掘恶意软件与朝鲜有关
https://www.darkreading.com/attacks-breaches/new-cryptocurrency-mining-malware-has-links-to-north-korea/d/d-id/1330773?_mc=sm_dr&hootPostID=84b426c3671aee590247b40242dcd6c0
新时代网络安全新常态：2018展望中国网络安全十大趋势
http://www.freebuf.com/articles/network/159145.html
2018年1月安卓平安通知，谷歌修复5个要害BUG和33个高危破绽
http://www.freebuf.com/news/159472.html
攻击者行使GoogleAppscript恶意软件的传播PoC已公然
http://toutiao.secjia.com/google-app-script-phishing-attacks
Meltdown/Spectre
https://react-etc.net/entry/exploiting-speculative-execution-meltdown-spectre-via-javascript
Spectre_Meltdown_vulnerabilities
https://github.com/jfdelnero/TrucsEnVrac/tree/master/Spectre_Meltdown_vulnerabilities
平昌奥运会鱼叉网络钓鱼攻击
http://securityaffairs.co/wordpress/67461/hacking/pyeongchang-olympic-games-hacking.html
Hijack微软数字签名
https://twitter.com/mattifestation/status/950103378360700935
专家发现了一个zeus银行木马病毒通过合法的开发者网站扩展
http://securityaffairs.co/wordpress/67475/malware/zeus-banking-trojan.html
2017年Q4季度安全报告