从公众号获取到一份“ATT&CK手册”，看到了这个漏洞CVE-2018-4878，但是一直没实操，今天刚好有点时间记录下，但是内容基本和网上的资料差不多，，，利用场景：攻击者通过构造特殊的 Flash 链接，当用户用浏览器/邮件/Office 访问此 Flash 链接时，会被“远程代码执行”，并且直接被 getshell。一般来说可以配合社工，如果在内网环境可以配合arp欺骗一起利用，效果更佳。
2020-11-09 07:15
大家好，我通过I2C将STEVAL-MKI137V1（万用表传感器）连接到STM32L152D-EVAL。我使用的库来自STM32CubeExpansion_MEMS1_V4.0.0。我将I2C引脚连接到PB11和PB10，没有任何外部电阻STEVAL-MKI137V1侧面。这个问题对我来说很奇怪。大多数情况下代码不起作用，它会产生类似Acknowledge Failure的错误，有时代码运行良好而没有任何错误！这个问题的预期原因是什么？我该如何解决？注意：与外部上拉电阻有关的问题是什么？因为我没有使用它们。提前致谢。 #steval-mki137v1＃i2c以上来自于谷歌翻译以下为原文 Hi all,I connected STEVAL-MKI137V1 (Magnometer sensor) to STM32L152D-EVAL through I2C. The library I am using is from STM32CubeExpansion_MEMS1_V4.0.0.I connected I2C pins to PB11 and PB10 without any external resistors on STEVAL-MKI137V1 side.The problem is weird for me. Most of the times the code do not work, it give error like Acknowledge Failure, and sometimes the code works very well without any error!What is the expected reason of this problem? How can I solve it?Note: is the problem related to external pull-up resistors? Because I did not use them.Thanks in advance. #steval-mki137v1 #i2c
2019-03-14 10:49
大约6个月前，有人发布了PSoC 4设备中明显漏洞的全面解释。该漏洞将允许攻击者将恶意代码加载到Flash中，然后将其标记为保留给监控器，从而允许代码在芯片擦除中生存，并且几乎没有被检测到运行。正如他所解释的那样，这可能导致各种攻击向量，比如触摸屏设备的重放攻击。为乐趣和利润开发PSoC4——Dmitry Grinberg阅读不可读的SROM：在PSoC4 HKADADY内部据作者说，柏树还没有对此问题作出回应。那是6个月前的事了。柏树做了什么来减轻或消除这种脆弱性？这将严重减少适用于该芯片的应用范围，因此似乎不可能做任何事情。 以上来自于百度翻译 以下为原文About 6 months ago, someone posted a comprehensive explanation of an apparent vulnerability in PSoC 4 devices. The vulnerability would allow attackers to load malicious code to flash and then mark it as reserved for supervisor, allowing the code to survive chip erases and to run pretty much undetected. As he explains well, this potentially leads to all sorts of attack vectors, like replay attacks for touch screen devices. Exploiting PSoC4 for fun and profit - Dmitry Grinberg Reading the Unreadable SROM: Inside the PSoC4 | Hackaday According to the author, Cypress has not responded to the problem. That was 6 months ago. Has anything been done by Cypress to mitigate or remove this vulnerability? It would seriously reduce the range of suitable applications for this chip, so it seems unlikely nothing was done.
2019-01-09 13:58
针对工控系统上位机操作系统攻防案例有哪些？分别有哪些步骤？
2021-07-15 06:57
你知道在工控安全项目中进行攻防演示的案例有哪些吗？
2021-09-29 06:46
嗨， 我需要从LSM303DLHC读取加速度计数据。我使用STM32F401 Discovery板和''stm32f401_discovery_lsm303dlhc.c''库。我仔细阅读了数据表，特别是第24页的7.1节，注册设置，但我想知道是否有人有任何项目示例可以帮助我理解如何使用传感器。 先谢谢你。 亲切的问候， Antho以上来自于谷歌翻译以下为原文 Hi, I need to read the accelerometer data from LSM303DLHC. I use the STM32F401 Discovery board and the ''stm32f401_discovery_lsm303dlhc.c'' library. I read carefully the datasheet, especially the section 7.1 in page 24 with the register setup but I would like to know if someone has any project example that could help me to understand how to use the sensor. Thank you in advance. Kind regards, Antho
2018-09-29 11:07
