Aggregator

HackerNews 编译，转载请注明出处： Proofpoint安全研究人员发现一种新型凭证钓鱼攻击手段，黑客通过恶意OAuth应用结合多重重定向链劫持Microsoft账户，成功率超50%。2025年至今，该攻击已影响超900个Microsoft 365环境中的近3000个账户。 攻击流程解析 钓鱼邮件启动：攻击者利用被入侵邮箱发送伪装成商业合作请求的钓鱼邮件（如报价申请、合同协议），内容针对目标行业定制化设计，曾仿冒RingCentral、DocuSign等企业服务，甚至伪装小型航空企业ILSMart。 恶意应用授权陷阱：邮件内链接导向真实的Microsoft登录授权页面，诱导用户批准伪装成Adobe、DocuSign等合法服务的恶意OAuth应用请求。这些应用仅申请基础权限（如查看个人资料），以降低用户警惕性。 多重重定向劫持：无论用户点击“接受”或“取消”授权，均被重定向至验证码中间页，随后跳转至伪造的Microsoft登录页面。该页面实时窃取输入的凭证及双重认证会话令牌。 技术特征与规模 攻击链依赖钓鱼即服务（PhaaS）平台Tycoon构建，已发现超50个恶意应用参与攻击，其中4个仿冒Adobe、5个仿冒DocuSign，其余使用无关名称混淆视听。 恶意应用在授权后配置重定向规则，通过中间域名隐藏最终钓鱼页面，利用CAPTCHA页面增强欺骗性，诱使用户误认为处于合法流程中。 防御措施与行业响应 微软宣布调整Microsoft 365默认设置：普通用户向第三方应用授予账户权限需经管理员审批，以阻断恶意应用的权限获取路径。Proofpoint强调用户需时刻验证当前域名真实性，避免在重定向过程中提交敏感信息。 趋势警示：此类结合合法OAuth框架与社交工程的攻击链正成为犯罪团伙新标准，未来或将持续演化以绕过检测机制。       消息来源：cybernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文  

A vulnerability classified as critical was found in Linux Kernel up to 6.12.9/6.13-rc6. This vulnerability affects the function netfs_extract_user_iter. The manipulation leads to buffer overflow. This vulnerability was named CVE-2025-21643. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.71/6.12.9/6.13-rc6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component sysctl. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2025-21642. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.9/6.13-rc6. Affected by this issue is some unknown functionality of the component sysctl. The manipulation leads to null pointer dereference. This vulnerability is handled as CVE-2025-21641. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6. Affected is an unknown function of the component sysctl. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-21639. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6. Affected by this vulnerability is an unknown functionality of the component cookie_hmac_alg. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2025-21640. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

“ 特别声明：本公众号文章只作为学习交流，不可用作其他商业和不法用途；如有侵权请联系作者删除。”01—字符串

当前环境异常，请完成验证以继续访问。

Sandfly 5.0.6作为维护更新发布，修复了操作系统侦察数据大小增加和扫描日志错误报告改进的问题。非关键更新，建议有需要的用户参考文档升级。

作者分享了一个早期AI项目的构想,涉及深度网络架构、隐私和大语言模型等非传统方向,并寻求具备相关技术背景且乐于探索创新方法的合作者共同推进这一项目。

最近因为一些原因，重新玩DC系列靶机。在几个小伙伴的讨论下有把DC-9靶机弄出了两种解题方法

A vulnerability was found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6. It has been classified as critical. This affects an unknown part of the component sysctl. The manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2025-21638. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.9/6.13-rc6. Affected is an unknown function. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-21635. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component sctp. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2025-21636. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6 and classified as critical. Affected by this issue is some unknown functionality of the component sysctl. The manipulation leads to null pointer dereference. This vulnerability is handled as CVE-2025-21637. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.12.9/6.13-rc6. This affects the function thread_group_cputime of the component sqpoll. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2025-21633. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.9/6.13-rc6. It has been classified as critical. Affected is the function get_online_cpus of the component cpuset. The manipulation leads to deadlock. This vulnerability is traded as CVE-2025-21634. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6. This issue affects the function bfq_split_bfqq of the component block. The manipulation leads to use after free. The identification of this vulnerability is CVE-2025-21631. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.71/6.12.9/6.13-rc6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component fpu. The manipulation leads to buffer overflow. This vulnerability is known as CVE-2025-21632. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.124/6.6.71/6.12.9/6.13-rc6. It has been declared as problematic. Affected by this vulnerability is the function dm_bm_read_lock of the file /dev/sdc. The manipulation leads to improper initialization. This vulnerability is known as CVE-2024-57929. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.