漏洞 Vulnerability FreeBSD ftpd chroot 本地提权漏洞分析（CVE-2020-7468） https://www.zerodayinitiative.com/blog/2020/12/21/cve-2020-7468-turning-imprisonment-to-advantage-in-the-freebsd-ftpd-chroot-jail MICROSOFT EXCHANGE远程执行代码-CVE-2020-16875补丁绕过 https://www.x41-dsec.de/security/advisory/exploit/research/2020/12/21/x41-microsoft-exchange-rce-dlp-bypass/ 安全工具 Security Tools FORESCOUT RESEARCH LABS发布了PROJECT MEMORIA TCP / IP堆栈检测器 https://www.forescout.com/company/blog/forescout-research-labs-releases-the-project-memoria-tcpip-stack-detector/ 安全报告 Security Report NCCGroup 对多款智能门铃 IoT 设备的安全分析报告 https://research.nccgroup.com/2020/12/18/domestic-iot-nightmares-smart-doorbells/ 安全事件 Security Incident 印度Telangana政府站点因配置错误导致13万份文件泄露 https://gadgets.ndtv.com/internet/news/telangana-government-data-leak-breach-employees-pensioners-privacy-2340513 政府工作人员使用NSO Group的Pegasus间谍软件入侵半岛电视台记者 https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ Facebook Business Suite应用程序漏洞可导致在Instagram上查看任何人的私人电子邮件和生日 https://medium.com/nassec-cybersecurity-writeups/this-is-how-i-was-able-to-view-anyones-private-email-and-birthday-on-instagram-1469f44b842b 黑客免费公布 27 万加密货币钱包 Ledger 用户信息 http://hackernews.cc/archives/34244 安全研究 Security Research Android Kernel Exploitation Workshop https://cloudfuzz.github.io/android-kernel-exploitation/chapters/exploitation.html 绕过cobalt strike在使用.NET assemblies时的大小限制 https://redteamer.tips/a-tale-of-net-assemblies-cobalt-strike-size-constraints-and-reflection/ 通过嗅探 TPM SPI 接口的流量泄漏 BitLocker 全盘加密 Key https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/