Android安全技術周報 10.20 - 10.26

System

1. Samsung TEEgris - 三星提供的系統級安全解決方案，為 APP 提供基於 TrustZone 的 TEE 執行環境

http://developer.samsung.com/teegris

2. NowSecure 發布移動開發（安全編碼）最佳實踐

https://info.nowsecure.com/rs/201-XEW-873/images/secure-mobile-development.pdf

3. Android獲得「DNS over TLS」支持，以阻止ISP獲取到您訪問的網站信息

https://www.xda-developers.com/android-dns-over-tls-website-privacy/amp/

Malware

1. JadeRAT mobile surveillanceware spikes in espionage activity

https://blog.lookout.com/mobile-threat-jaderat

2. LOKIBOT - 第一款混合型 ANDROID 惡意軟體

https://clientsidedetection.com/lokibot___the_first_hybrid_android_malware.html

3. Fake cryptocurrency trading apps on Google Play

https://www.welivesecurity.com/2017/10/23/fake-cryptocurrency-apps-google-harvesting-credentials/

4. 驗證Zimperium移動端機器學習惡意軟體檢測的結果

https://blog.zimperium.com/validating-machine-learning-detection-mobile-malware/

Tech

1. MalwareAnalysis - 惡意軟體分析工具及資源集合

https://github.com/recodeking/MalwareAnalysis

2. 《惡意樣本分析手冊》合輯

http://blog.nsfocus.net/malware-sample-analysis-summary/

3. 安全客2017季刊-第3期，你想要的乾貨全都有！

http://bobao.360.cn/news/detail/4352.html

4. 在Android 手機上安裝 Frida 框架，篡改 SSLContext，Bypass Certificate Pinning 特性：

https://blog.it-securityguard.com/the-stony-path-of-android-%F0%9F%A4%96-bug-bounty-bypassing-certificate-pinning/

5. 利用Frida 框架提高逆向工程中的工作效率

https://github.com/DigitalInterruption/DigitalInterruption.github.io/blob/master/Prototyping%20and%20reverse%20engineering%20with%20frida_hacklu.pdf https://github.com/DigitalInterruption/FridaWorkshop

6. An Obfuscating Compiler

https://eprint.iacr.org/2017/050

7. Hack.lu 2017 會議PPT和演講視頻

https://2017.hack.lu/archive/2017/

https://www.youtube.com/playlist?list=PLCxOaebc_2yNlOGhuOjInlJvr0Ktb_FYz

8. Digging Deeper - An In-Depth Analysis of a Fast Flux Network

https://www.akamai.com/us/en/multimedia/documents/white-paper/digging-deeper-in-depth-analysis-of-fast-flux-network.pdf

9. 防止SSL被取消：簡單入門

https://blog.cloudflare.com/performing-preventing-ssl-stripping-a-plain-english-primer/

http://bobao.360.cn/learning/detail/4600.html

10. 軟體安全構建成熟度模型演變與分析

http://bobao.360.cn/learning/detail/4596.html

11. 國內頂尖團隊的開源地址

https://github.com/niezhiyang/open_source_team

12. 揭秘美國黑產，購物券欺詐對商業活動的危害

http://www.freebuf.com/articles/es/151807.html

13. 斯坦福大學的應用密碼學課程：

https://crypto.stanford.edu/ https://crypto.stanford.edu/~dabo/cryptobook/draft_0_2.pdf

14. 機器學習及深度學習速查手冊：

https://startupsventurecapital.com/essential-cheat-sheets-for-machine-learning-and-deep-learning-researchers-efb6a8ebd2e5

Tool

1. Assemblyline - 分散式惡意軟體自動化分析框架

https://bitbucket.org/cse-assemblyline/assemblyline

2. 開源JA3——用於惡意軟體檢測的SSL/TLS指紋識別

https://engineering.salesforce.com/open-sourcing-ja3-92c9e53c3c41

3. uncaptcha - 對抗 Google 音頻驗證碼的工具，介紹中稱有85% 的正確率：

https://github.com/ecthros/uncaptcha

4. relative-url-extractor：A small tool that extracts relative URLs from a file.

https://github.com/jobertabma/relative-url-extractor

5. FindCrypt：A Python implementation of IDA FindCrypt/FindCrypt2 plugin

https://github.com/you0708/ida/tree/master/idapython_tools/findcrypt

6. awesome-yara：A curated list of awesome YARA rules, tools, and people.

https://github.com/InQuest/awesome-yara

7. pcap2curl：Read a packet capture, extract HTTP requests and turn them into cURL commands for replay.

https://github.com/jullrich/pcap2curl

8. JByteMod is a multifunctional bytecode editor. Including syntax highlighting and live decompiling.

https://github.com/GraxCode/JByteMod-Beta

9. Reptile - LKM Linux Rootkit：

http://www.kitploit.com/2017/10/reptile-lkm-linux-rootkit.html

10. rev.ng : a suite of tools for binary analysis based on QEMU and LLVM

https://rev.ng/

Vulnerability

1. 卡巴斯基對幾款流行在線約會APP 的安全測試報告，主要是從隱私泄露和流量加密傳輸兩個角度

https://securelist.com/dangerous-liaisons/82803/

2. Mobile X-Ray：在線移動應用安全測試 Free online service to audit iOS or Android apps

https://www.htbridge.com/mobile/

3. 關於空指針的內核利用

https://0x00sec.org/t/kernel-exploitation-dereferencing-a-null-pointer/3850

http://bobao.360.cn/learning/detail/4594.html

4. DUHK攻擊相關

The DUHK (Dont Use Hard-coded Keys) Attack is a vulnerability that affects devices using the ANSI X9.31 Random Number Generator (RNG) in conjunction with a hard-coded seed key.

https://duhkattack.com/

https://blog.cryptographyengineering.com/2017/10/23/attack-of-the-week-duhk/

http://www.freebuf.com/articles/database/151839.html

5. WPA2相關

WPA2密鑰重裝攻擊原理分析：

http://www.freebuf.com/news/150991.html

無線網路（WI-FI）保護協議標準WPA2漏洞綜合分析報告

https://paper.seebug.org/420/

6. PoC code of BlueBornes Android RCE vulnerability (CVE-2017-0781)

https://github.com/ArmisSecurity/blueborne

7. 大文件下載會使VPN服務提供商PIA的安卓版app崩潰（CVE-2017-15882），版本 v1.3.3.1修復

https://wwws.nightwatchcybersecurity.com/2017/10/25/advisory-pia-android-app-cve-2017-15882/

8. Samsung Galaxy Note 8 (Snapdragon) rooted without tripping KNOX

https://forum.xda-developers.com/galaxy-note-8/development/root-samfail-galaxy-note8-t3685340

9. 分享一個近期遇到的邏輯漏洞案例

http://www.freebuf.com/vuls/151196.html

10. Recorded Future 通過對比 NVD 和 CNNVD 的漏洞情況，稱美國在漏洞報告方面落後中國：《The Dragon Is Winning：Lags Behind Chinese Vulnerability Reporting》

https://go.recordedfuture.com/hubfs/reports/cta-2017-1019.pdf

11. 在 S2E 中利用定向符號執行的方法處理文件 Parsers，解決路徑爆炸的問題：

Combining S2E and Kaitai Struct for "targeted" symbolic execution of file parsers

https://adrianherrera.github.io/post/kaitai-s2e/

12. SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept Exploits

https://drive.google.com/file/d/0B8Y63-uONPJSNHB6UUxtSUNBdlU/view