{"id":4906,"date":"2021-08-22T21:04:59","date_gmt":"2021-08-22T12:19:59","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=4906"},"modified":"2021-09-02T11:50:12","modified_gmt":"2021-09-02T03:05:12","slug":"%e3%80%90inforsecbcs2021%e7%b3%bb%e5%88%97%e8%ae%ba%e5%9d%9b%e3%80%91%e7%bd%91%e7%bb%9c%e7%a9%ba%e9%97%b4%e5%ae%89%e5%85%a8%e5%9b%bd%e9%99%85%e5%ad%a6%e6%9c%af%e6%88%90%e6%9e%9c%e5%88%86%e4%ba%ab","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=4906","title":{"rendered":"\u3010InForSec@BCS2021\u7cfb\u5217\u8bba\u575b\u3011\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e2d\uff09\u5c06\u4e8e8\u670827\u65e5\u4e3e\u529e"},"content":{"rendered":"\n

InForSec\u5b9a\u4e8e2021\u5e748\u670827\u65e5(\u5468\u4e94)\u4e0b\u5348\u5728\u7ebf\u76f4\u64ad\u201c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e2d\uff09\u201d\u6d3b\u52a8\u3002\u672c\u6b21\u5b66\u672f\u6d3b\u52a8\u5c06\u9080\u8bf7\u5728\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u9876\u7ea7\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u6587\u7684\u7814\u7a76\u8005\u5206\u4eab\u4ed6\u4eec\u7684\u6700\u65b0\u7814\u7a76\u6210\u679c\uff0c\u5e76\u5c31\u7814\u7a76\u8fc7\u7a0b\u4e2d\u7684\u7075\u611f\u3001\u7ecf\u9a8c\u548c\u4f53\u4f1a\u8fdb\u884c\u6df1\u5165\u4ea4\u6d41\u3002\u6b64\u6b21\u9080\u8bf7\u7684\u8bae\u9898\u8986\u76d6\u7f51\u5b89\u7814\u7a76\u9886\u57df\u7684\u8bf8\u591a\u524d\u6cbf\u95ee\u9898\uff0c\u5305\u62ec\u201c\u4fe1\u606f\u7269\u7406\u7cfb\u7edf\u5b89\u5168\uff08Cyber Physical System Security\uff09\u201d\u4ee5\u53ca\u201c\u8f6f\u4ef6\u5b89\u5168\uff08Software Security\uff09\u201d\u3002<\/p>\n\n\n\n

\u4e3b\u9898\uff1a<\/strong>\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e2d\uff09<\/p>\n\n\n\n

\u65f6\u95f4\uff1a2021\u5e748\u670827\u65e5 13\uff1a30-18\uff1a00<\/p>\n\n\n\n

\u4e3b\u529e\uff1a<\/strong><\/p>\n\n\n\n

\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u56fd\u9645\u5b66\u672f\u8bba\u575b\uff08InForSec\uff09<\/p>\n\n\n\n

\u627f\u529e\uff1a<\/strong><\/p>\n\n\n\n

\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n\n\n\n

\u590d\u65e6\u5927\u5b66\u7cfb\u7edf\u8f6f\u4ef6\u4e0e\u5b89\u5168\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

\u534f\u529e\uff1a<\/p>\n\n\n\n

\u5317\u4eac\u4fe1\u606f\u79d1\u5b66\u4e0e\u6280\u672f\u56fd\u5bb6\u7814\u7a76\u4e2d\u5fc3<\/p>\n\n\n\n

\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u56fd\u5bb6\u8ba1\u7b97\u673a\u7f51\u7edc\u5165\u4fb5\u9632\u8303\u4e2d\u5fc3<\/p>\n\n\n\n

\u4e2d\u56fd\u79d1\u5b66\u9662\u8ba1\u7b97\u6280\u672f\u7814\u7a76\u6240\u8ba1\u7b97\u673a\u4f53\u7cfb\u7ed3\u6784\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

\u767e\u5ea6\u5b89\u5168<\/p>\n\n\n\n

\u5947\u5b89\u4fe1\u96c6\u56e2<\/p>\n\n\n\n

\u8682\u8681\u96c6\u56e2<\/p>\n\n\n\n

\u76f4\u64ad\u5730\u5740\uff1a<\/strong><\/p>\n\n\n\n

https:\/\/www.inforsec.org\/live<\/a><\/p>\n\n\n\n

https:\/\/bcs.qianxin.com\/live\/<\/a><\/p>\n\n\n\n

BCS2021\u5927\u4f1a\u5728\u7ebf\u76f4\u64ad\u4e8c\u7ef4\u7801<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

\u4f1a\u8bae\u65e5\u7a0b<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5609\u5bbe\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n

\u9648\u9f50   \u52a0\u5dde\u5927\u5b66\u5c14\u6e7e\u5206\u6821\u52a9\u7406\u6559\u6388<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>Towards Secure and Robust AI Stack in Autonomous CPS<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981:<\/strong><\/p>\n\n\n\n

Autonomous CPS (Cyber-Physical System) systems consist of both cyber and physical components working jointly to achieve highly automated operations in the physical world. Notable examples of such systems include Autonomous Driving (AD) vehicles and delivery drones\/robots, which are increasingly deployed and commercialized in the real world. Specifically, AD technology has always been an international pursuit due to its significant benefit in driving safety, efficiency, and mobility. Over 15 years after the first DARPA Grand Challenge, its development and deployment are becoming increasingly mature and practical, with some AD vehicles already providing services on public roads (e.g., Google Waymo in Phoenix and Baidu Apollo in China). In AD technology, the AI stack, or the AD software, is highly security critical: it is in charge of safety-critical driving decisions such as collision avoidance and lane keeping, and thus any security problems in it can directly impact road safety. In this talk, I will describe my recent research that initiates the first systematic effort towards understanding and addressing the security problems in industry-grade AD software. I will be focusing on two critical modules: perception and localization, and talk about how we are able to discover novel and practical sensor\/physical-world attacks that can cause end-to-end safety impacts such as crashing into obstacles or driving off road. I will also briefly talk about my recent research on AI stack security in smart transportation in general, especially those enabled by Connected Vehicle (CV) technology. I will conclude with a discussion on defense and future research directions.<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

Qi Alfred Chen is an Assistant Professor in the Department of Computer Science at the University of California, Irvine. His research interest spans software security, systems security, and network security. Currently, his research focuses on security problems in autonomous CPS and IoT systems (e.g., autonomous driving and intelligent transportation). His works have high impacts in both academic and industry with over 30 research papers in top-tier venues in security, mobile systems, transportation, software engineering, and machine learning; a nationwide USDHS US-CERT alert, and multiple CVEs; over 50 news articles by major news media such as Forbes, Fortune, and BBC News; and vulnerability report acknowledgments from USDOT, Apple, Microsoft, Comcast, Daimler, etc. Recently, his research triggered over 25 autonomous driving companies to start security vulnerability investigations; some confirmed to work on fixes. He serves as reviewers for various top-tier venues such as Usenix Security, ACM CCS, NDSS, TIFS, TDSC, T-ITS, etc., and co-found the AutoSec workshop (co-located with NDSS\u201921). He received various awards such as NSF CRII Award, NDSS\u201919 and NDSS\u201920 best poster awards, UCI Chancellor\u2019s Award for mentoring, and UM Distinguished Dissertation Award. His group won the 1st place in the first AutoDriving Security CTF (part of BCTF) in 2020. Chen received his Ph.D. from the University of Michigan in 2018.<\/p>\n\n\n\n

\u5434\u806a  \u6b66\u6c49\u5927\u5b66\u56fd\u5bb6\u7f51\u7edc\u5b89\u5168\u5b66\u9662\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>Liveness is Not Enough: Enhancing Fingerprint Authentication with Behavioral Biometrics to Defeat Puppet Attacks<\/p>\n\n\n\n

\u6d3b\u4f53\u662f\u4e0d\u591f\u7684\uff0c\u4f7f\u7528\u884c\u4e3a\u7279\u5f81\u6280\u672f\u589e\u5f3a\u6307\u7eb9\u8ba4\u8bc1\u4ee5\u62b5\u5fa1\u6728\u5076\u653b\u51fb<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

Fingerprint authentication has gained increasing popularity on mobile devices in recent years. However, it is vulnerable to presentation attacks, which include that an attacker spoofs with an artificial replica. Many liveness detection solutions have been proposed to defeat such presentation attacks; however, they all fail to defend against a particular type of presentation attack, namely puppet attack, in which an attacker places an unwilling victim\u2019s finger on the fingerprint sensor. In this paper, we propose FINAUTH, an effective and efficient software-only solution, to complement fingerprint authentication by defeating both synthetic spoofs and puppet attacks using fingertip-touch characteristics. FINAUTH characterizes intrinsic fingertip-touch behaviors including the acceleration and the rotation angle of mobile devices when a legitimate user authenticates. FINAUTH only utilizes common sensors equipped on mobile devices and does not introduce extra usability burdens on users. To evaluate the effectiveness of FINAUTH, we carried out experiments on datasets collected from 90 subjects after the IRB approval. The results show that FINAUTH can achieve the average balanced accuracy of 96.04% with 5 training data points and 99.28% with 100 training data points. Security experiments also demonstrate that FINAUTH is resilient against possible attacks. In addition, we report the usability analysis results of FINAUTH, including user authentication delay and overhead.<\/p>\n\n\n\n

\u8fd1\u5e74\u6765\uff0c\u6307\u7eb9\u8ba4\u8bc1\u5728\u79fb\u52a8\u8bbe\u5907\u8d8a\u6765\u8d8a\u53d7\u6b22\u8fce\uff0c\u88ab\u79f0\u4e3a\u6700\u53d7\u7528\u6237\u9752\u7750\u7684\u8eab\u4efd\u8ba4\u8bc1\u65b9\u5f0f\u3002\u7136\u800c\uff0c\u5728\u5b9e\u9645\u4f7f\u7528\u7684\u73af\u8282\u4e2d\uff0c\u5b83\u6613\u53d7\u5230\u5c55\u793a\u653b\u51fb\uff08Presentation attack\uff09\u7684\u5a01\u80c1\uff0c\u4f8b\u5982\u653b\u51fb\u8005\u5229\u7528\u4eba\u5de5\u590d\u5236\u54c1\uff08\u7845\u80f6\u8102\u7b49\uff09\u6b3a\u9a97\u6307\u7eb9\u4f20\u611f\u5668\u4ee5\u7ed5\u8fc7\u6307\u7eb9\u8ba4\u8bc1\u7cfb\u7edf\u7684\u68c0\u6d4b\u3002\u5bf9\u6b64\uff0c\u4f17\u591a\u7814\u7a76\u5b66\u8005\u63d0\u51fa\u4e86\u57fa\u4e8e\u8f6f\u4ef6\u548c\u786c\u4ef6\u7684\u65b9\u6cd5\u4ee5\u9632\u5fa1\u5c55\u793a\u653b\u51fb\uff0c\u8fd9\u4e9b\u65b9\u6cd5\u7684\u5173\u6ce8\u66f4\u591a\u7684\u662f\u6307\u7eb9\u6d3b\u4f53\u68c0\u6d4b\uff0c\u5373\u68c0\u6d4b\u8f93\u5165\u7684\u6307\u7eb9\u662f\u5426\u6709\u751f\u547d\u7279\u5f81\u3002\u7136\u800c\uff0c\u73b0\u6709\u7684\u6d3b\u4f53\u68c0\u6d4b\u65b9\u6cd5\u65e0\u6cd5\u9632\u5fa1\u6307\u7eb9\u8ba4\u8bc1\u4e2d\u88ab\u5ffd\u89c6\u7684\u6728\u5076\u653b\u51fb\uff1a\u653b\u51fb\u8005\u5728\u7528\u6237\u65e0\u610f\u8bc6\u7684\u60c5\u51b5\uff08\u5982\u719f\u7761\u6216\u660f\u53a5\uff09\u4e0b\uff0c\u5c06\u7528\u6237\u7684\u771f\u5b9e\u6307\u7eb9\u653e\u5728\u6307\u7eb9\u4f20\u611f\u5668\u4e0a\u4ee5\u7ed5\u8fc7\u6307\u7eb9\u8ba4\u8bc1\u7cfb\u7edf\u3002\u9488\u5bf9\u8be5\u95ee\u9898\uff0c\u6211\u4eec\u8bbe\u8ba1\u4e86\u4e00\u79cd\u57fa\u4e8e\u884c\u4e3a\u7279\u5f81\u7684\u6307\u7eb9\u8ba4\u8bc1\u589e\u5f3a\u65b9\u6848FINAUTH\u3002\u5f53\u7528\u6237\u5728\u6267\u884c\u6307\u7eb9\u8ba4\u8bc1\u7684\u65f6\u5019\uff0c\u901a\u8fc7\u5206\u6790\u6307\u5c16\u89e6\u6478\uff08fingertip-touch\uff09\u7684\u884c\u4e3a\u7279\u5f81\u5224\u65ad\u5f53\u524d\u8f93\u5165\u6307\u7eb9\u7684\u7528\u6237\u662f\u5426\u4e3a\u5408\u6cd5\u7528\u6237\u3002FINAUTH\u4ec5\u4f9d\u8d56\u4e8e\u7684\u79fb\u52a8\u8bbe\u5907\u4e0a\u5e38\u89c1\u4f20\u611f\u5668\uff0c\u4e0d\u4f1a\u7ed9\u7528\u6237\u5e26\u6765\u989d\u5916\u7684\u64cd\u4f5c\u8d1f\u62c5\u3002\u5b9e\u9a8c\u8868\u660e\uff0c\u672c\u65b9\u6848\u80fd\u591f\u4ee5\u8f83\u9ad8\u7684\u51c6\u786e\u5ea6\u8fdb\u884c\u7528\u6237\u8eab\u4efd\u8ba4\u8bc1\uff0c\u540c\u65f6\u5728\u4e0d\u7834\u574f\u5b9e\u7528\u6027\u7684\u60c5\u51b5\u4e0b\uff0c\u8fbe\u5230\u6709\u6548\u9632\u5fa1\u6728\u5076\u653b\u51fb\u7684\u76ee\u6807\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u6b66\u6c49\u5927\u5b66\u56fd\u5bb6\u7f51\u7edc\u5b89\u5168\u5b66\u96622017\u7ea7\u535a\u58eb\u751f\uff0c\u76ee\u524d\u7814\u7a76\u65b9\u5411\u4e3a\u79fb\u52a8\u7ec8\u7aef\u8eab\u4efd\u8ba4\u8bc1\u3001\u751f\u7269\u8ba4\u8bc1\u3002<\/p>\n\n\n\n

\u738b\u57fa\u7b56 \u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>Understanding Malicious Cross-library Data Harvesting on Android<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981:<\/strong><\/p>\n\n\n\n

Recent years have witnessed the rise of security risks of libraries integrated in mobile apps, which are reported to steal private user data from the host apps and the app backend servers. Their security implications, however, have never been fully understood. In our research, we brought to light a new attack vector long been ignored yet with serious privacy impacts \u2013 malicious libraries strategically target other vendors\u2019 SDKs integrated in the same host app to harvest private user data (e.g., Facebook\u2019s user profile). Using a methodology that incorporates semantic analysis on an SDK\u2019s Terms of Services (ToS, which describes restricted data access and sharing policies) and code analysis on cross-library interactions, we were able to investigate 1.3 million Google Play apps and the ToSes from 40 highly-popular SDKs, leading to the discovery of 42 distinct libraries stealthily harvesting data from 16 popular SDKs, which affect more than 19K apps with a total of 9 billion downloads. Our study further sheds light on the underground ecosystem behind such library-based data harvesting (e.g., monetary incentives for SDK integration), their unique strategies (e.g., hiding data in crash reports and using C2 server to schedule data exfiltration) and significant impacts.<\/p>\n\n\n\n

\u79fb\u52a8\u5e94\u7528\u5f00\u53d1\u8fc7\u7a0b\u4e2d\u5d4c\u5165\u4e86\u5927\u91cf\u7684\u7b2c\u4e09\u65b9\u5e93\uff0c\u5b83\u4eec\u4e30\u5bcc\u4e86\u79fb\u52a8\u5e94\u7528\u7684\u529f\u80fd\uff0c\u4f46\u662f\u4e5f\u5f15\u5165\u4e86\u8bb8\u591a\u5b89\u5168\u98ce\u9669\uff0c\u4f8b\u5982\u4ece\u79fb\u52a8\u8bbe\u5907\u53ca\u5e94\u7528\u540e\u7aef\u670d\u52a1\u5668\u7a83\u53d6\u7528\u6237\u9690\u79c1\u6570\u636e\u3002\u7136\u800c\uff0c\u73b0\u6709\u7814\u7a76\u5e76\u4e0d\u5145\u5206\uff0c\u6211\u4eec\u7684\u7814\u7a76\u63ed\u793a\u4e86\u4e00\u4e2a\u65b0\u7684\u4e25\u91cd\u5a01\u80c1\u7528\u6237\u9690\u79c1\u7684\u653b\u51fb\u5411\u91cf\u2014\u2014\u6076\u610f\u7b2c\u4e09\u65b9\u5e93\u653b\u51fb\u96c6\u6210\u4e8e\u540c\u4e00\u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u5176\u4ed6\u7b2c\u4e09\u65b9\u5e93\uff0c\u4ee5\u83b7\u53d6\u7528\u6237\u9690\u79c1\u6570\u636e\uff08Malicious Cross-library Data Harvesting\uff09\u3002\u901a\u8fc7\u5206\u6790\u76ee\u6807\u7b2c\u4e09\u65b9\u5e93\u7684\u670d\u52a1\u6761\u6b3e\uff08ToS, \u63cf\u8ff0\u4e86\u6570\u636e\u8bbf\u95ee\u4e0e\u5171\u4eab\u653f\u7b56\uff09\u4ee5\u53ca\u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u8de8\u5e93\u4ea4\u4e92\u884c\u4e3a\uff0c\u6211\u4eec\u68c0\u6d4b\u4e86Google Play\u5e02\u573a\u4e0a\u7684130\u4e07\u4e2a\u79fb\u52a8\u5e94\u7528\u3002\u7ed3\u679c\u53d1\u73b0\uff0c42\u4e2a\u6076\u610f\u5e93\u4ece16\u4e2a\u6d41\u884c\u7684\u7b2c\u4e09\u65b9\u5e93\u4e2d\u7a83\u53d6\u6570\u636e\uff0c\u5f71\u54cd\u4e86\u8d85\u8fc719K\u4e2a\u5e94\u7528\uff0c\u7814\u7a76\u8fdb\u4e00\u6b65\u63ed\u793a\u4e86\u8fd9\u79cd\u6570\u636e\u6536\u96c6\u884c\u4e3a\u80cc\u540e\u7684\u5730\u4e0b\u751f\u6001\u7cfb\u7edf\uff0c\u5b83\u4eec\u72ec\u7279\u7684\u6570\u636e\u6536\u96c6\u7b56\u7565\u53ca\u5176\u91cd\u8981\u5f71\u54cd\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u535a\u58eb\u751f\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u79fb\u52a8\u5b89\u5168\uff0c\u6f0f\u6d1e\u6316\u6398\u7b49\u3002<\/p>\n\n\n\n

\u6797\u4ee5\uff08@xwlin_roy\uff09 \u8682\u8681\u5b89\u5168\u5149\u5e74\u5b9e\u9a8c\u5ba4\u5b89\u5168\u7814\u7a76\u5458<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u66f2\u548c  \u8682\u8681\u5b89\u5168\u5bf9\u6297\u6280\u672f\u90e8\u8d1f\u8d23\u4eba<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>APICRAFT: Fuzz Driver Generation for Closed-source SDK Libraries
<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

\u9488\u5bf9\u5e94\u7528\u5e93\u7684 fuzzing \u9700\u8981 fuzz driver \u4f5c\u4e3a\u5165\u53e3\u3002fuzz driver \u4f5c\u4e3a fuzzing \u7684\u5165\u53e3\u7a0b\u5e8f\uff0c\u8c03\u7528\u9700\u8981\u88ab fuzzing \u7684\u5e94\u7528\u5e93\u7684 API\uff0c\u6765\u63a5\u6536\u6765\u81ea fuzzer \u7684\u8f93\u5165\u3002\u5b9e\u9645\u4e0a\uff0cfuzz driver \u5747\u662f\u7531\u5b89\u5168\u4e13\u5bb6\u6240\u6784\u5efa\uff0c\u5176\u8d28\u91cf\u53d6\u51b3\u4e8e\u4f5c\u8005\u7684\u4e13\u4e1a\u6027\u4ee5\u53ca\u5bf9\u76ee\u6807\u653b\u51fb\u9762\u7684\u719f\u6089\u5ea6\u3002\u4e1a\u754c\u5f53\u524d\u5df2\u7ecf\u63d0\u51fa\u4e86\u76f8\u5173\u7684\u6280\u672f\u6765\u81ea\u52a8\u5316\u751f\u6210 fuzz driver\u6765\u51cf\u8f7b\u4eba\u5de5\u5de5\u4f5c\u91cf\u5e76\u786e\u4fdd\u6d4b\u8bd5\u8d28\u91cf\u3002\u7136\u800c\uff0c\u73b0\u6709\u6280\u672f\u5927\u591a\u4f9d\u8d56\u4e8e\u6e90\u4ee3\u7801\u7684\u5206\u6790\uff0c\u4f7f\u5f97\u95ed\u6e90 SDK \u5e93\u7684 fuzz driver \u81ea\u52a8\u5316\u751f\u6210\u6210\u4e3a\u4e00\u4e2a\u60ac\u800c\u672a\u51b3\u7684\u95ee\u9898\u3002\u95ed\u6e90 SDK \u5e93\u7684 fuzz driver \u751f\u6210\u9762\u4e34\u4e24\u5927\u6311\u6218\uff1a<\/p>\n\n\n\n

\uff081\uff09\u95ed\u6e90 SDK \u5e93\u4ec5\u6709\u6709\u9650\u7684\u4fe1\u606f\u53ef\u88ab\u63d0\u53d6\uff1b<\/p>\n\n\n\n

\uff082\uff09API\u51fd\u6570\u4e4b\u95f4\u8bed\u4e49\u5173\u7cfb\u590d\u6742\uff0c\u4f46\u4ecd\u9700\u8981\u4fdd\u8bc1\u5176\u6b63\u786e\u6027\u3002<\/p>\n\n\n\n

\u4e3a\u4e86\u89e3\u51b3\u8fd9\u4e9b\u6311\u6218\uff0c\u6211\u4eec\u63d0\u51fa\u4e86 APICRAFT\uff0c\u4e00\u79cd\u81ea\u52a8\u5316 fuzz driver \u751f\u6210\u6280\u672f\u3002APICRAFT \u7684\u6838\u5fc3\u7b56\u7565\u662f collect-combine\u3002\u9996\u5148\uff0cAPICRAFT \u5229\u7528\u7a0b\u5e8f\u7684\u9759\u6001\u548c\u52a8\u6001\u4fe1\u606f\u6765\u89e3\u6790\u51fa API \u51fd\u6570\u7684\u63a7\u5236\u548c\u6570\u636e\u4f9d\u8d56\u5173\u7cfb\u3002\u7136\u540e\uff0cAPICRAFT \u4f7f\u7528\u591a\u76ee\u6807\u9057\u4f20\u7b97\u6cd5\u7ec4\u5408\u6765\u5bf9\u6536\u96c6\u5230\u7684\u4f9d\u8d56\u9879\u8fdb\u884c\u53d8\u5f02\u8fdb\u5316\u6765\u6784\u5efa\u9ad8\u8d28\u91cf\u7684 fuzz driver\u3002\u6211\u4eec\u5c06 APICRAFT \u5b9e\u73b0\u4e3a fuzz driver\u81ea\u52a8\u5316\u751f\u6210\u6846\u67b6\uff0c\u5e76\u4f7f\u7528\u6765\u81ea macOS SDK \u7684\u4e94\u4e2a\u653b\u51fb\u9762\u5bf9\u5176\u8fdb\u884c\u8bc4\u4f30\u3002\u5728\u8bc4\u4f30\u4e2d\uff0cAPICRAFT \u751f\u6210\u7684 fuzz driver \u8868\u73b0\u51fa\u6bd4\u624b\u52a8\u7f16\u5199\u7684\u66f4\u51fa\u8272\u7684\u4ee3\u7801\u8986\u76d6\u7387\uff0c\u5e73\u5747\u63d0\u9ad8\u4e86 64%\u3002\u6211\u4eec\u8fdb\u4e00\u6b65\u4f7f\u7528 APICRAFT \u751f\u6210\u7684 fuzz driver \u8fdb\u884c\u4e86\u957f\u671f\u7684 fuzzing\u3002\u7ecf\u8fc7\u5927\u7ea6 8 \u4e2a\u6708\u7684 fuzzing\u8fc7\u7a0b\uff0c\u6211\u4eec\u8fc4\u4eca\u4e3a\u6b62\u5728 macOS SDK \u4e2d\u53d1\u73b0\u4e86 142 \u4e2a\u6f0f\u6d1e\u548c 54 \u4e2a\u5206\u914d\u7684 CVE\uff0c\u8fd9\u4e9b\u6f0f\u6d1e\u4f1a\u5f71\u54cd\u6d41\u884c\u7684 Apple \u4ea7\u54c1\uff0c\u4f8b\u5982 Safari\u3001Messages\u3001Preview \u7b49\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u6797\u4ee5\uff08@xwlin_roy\uff09\uff0c\u8682\u8681\u5b89\u5168\u5149\u5e74\u5b9e\u9a8c\u5ba4\u5b89\u5168\u7814\u7a76\u5458\uff0c\u4ed6\u7684\u7814\u7a76\u9886\u57df\u5305\u62ec\u865a\u62df\u5316\u5b89\u5168\u3001macOS&Windows\u7cfb\u7edf\u5b89\u5168\uff0c\u7a0b\u5e8f\u5206\u6790\u4ee5\u53ca fuzzing\u3002\u4ed6\u66fe\u5728\u5b66\u672f\u754c\u4ee5\u53ca\u5de5\u4e1a\u754c\u9876\u7ea7\u5b89\u5168\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u6587\u4e0e\u6f14\u8bb2\uff0c\u5305\u62ec CCS\uff0cUsenix Security\u4ee5\u53ca BlackHat Asia\u3002\u4ed6\u83b7\u5f97\u8fc7\u6765\u81ea Apple\u3001Qemu\u3001Microsoft\u4ee5\u53ca Oracle\u7b49\u5382\u5546\u7684\u81f4\u8c22\u3002<\/p>\n\n\n\n

\u66f2\u548c\uff0c\u8682\u8681\u5b89\u5168\u5bf9\u6297\u6280\u672f\u90e8\u8d1f\u8d23\u4eba\uff0c\u4ece 0 \u7ec4\u5efa\u5149\u5e74\u5b9e\u9a8c\u5ba4\uff0c\u4e3b\u8981\u7ecf\u9a8c\u5728\u6f0f\u6d1e\u6316\u6398\u3001\u79fb\u52a8\u5b89\u5168\u7b49\u4e0a\u3002<\/p>\n\n\n\n

\u5415\u6d9b   \u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u7814\u7a76\u751f<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>RTFM! Automatic Assumption Discovery and Verification Derivation from Library Document for API Misuse Detection<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

\u5728\u5f53\u524d\u7684\u8f6f\u4ef6\u5f00\u53d1\u8fc7\u7a0b\u4e2d\uff0c\u5f00\u53d1\u8005\u901a\u5e38\u4f1a\u4f7f\u7528\u8f6f\u4ef6\u5e93\u6240\u63d0\u4f9b\u7684API\u4ee5\u63d0\u9ad8\u5f00\u53d1\u6548\u7387\u3002\u5f00\u53d1\u8005\u5728\u8c03\u7528API\u65f6\uff0c\u9700\u8981\u9075\u5b88\u8f6f\u4ef6\u5e93\u6587\u6863\u4e2d\u6240\u89c4\u5b9a\u7684\u7ea6\u675f\uff08\u6211\u4eec\u79f0\u4e4b\u4e3a\u201c\u8c03\u7528\u5047\u8bbe\u201d\uff09\u3002\u8fdd\u80ccAPI\u7684\u8c03\u7528\u5047\u8bbe\u88ab\u79f0\u4e4b\u4e3aAPI\u8bef\u7528\uff0c\u5176\u4f1a\u9020\u6210\u4e25\u91cd\u7684\u8f6f\u4ef6\u5b89\u5168\u95ee\u9898\uff0c\u4f8b\u5982\u91ca\u653e\u540e\u4f7f\u7528\uff0c\u7a7a\u6307\u9488\u89e3\u5f15\u7528\u4ee5\u53ca\u6743\u9650\u8ba4\u8bc1\u9519\u8bef\u7b49\u3002<\/p>\n\n\n\n

\u672c\u9879\u5de5\u4f5c\u4e3b\u8981\u7814\u7a76\u5982\u4f55\u66f4\u52a0\u9ad8\u6548\u5730\u68c0\u6d4bAPI\u8bef\u7528\u3002\u8003\u8651\u5230\u81ea\u7136\u8bed\u8a00\u5904\u7406\u6280\u672f\u7684\u5feb\u901f\u53d1\u5c55\u4ee5\u53ca\u5176\u5728\u5404\u4e2a\u9886\u57df\u4ea7\u751f\u7684\u663e\u8457\u6548\u679c\uff0c\u6211\u4eec\u57fa\u4e8e\u8be5\u6280\u672f\uff0c\u63d0\u51fa\u4e86\u4e00\u5957\u7cfb\u7edf\u6027\u7684\u65b9\u6cd5\u6765\u81ea\u52a8\u5316\u5730\u63d0\u53d6\u8c03\u7528\u5047\u8bbe\u5e76\u5c06\u5176\u8f6c\u5316\u4e3a\u9a8c\u8bc1\u4ee3\u7801\uff0c\u4ee5\u53d1\u73b0\u4e0e\u8c03\u7528\u5047\u8bbe\u76f8\u8fdd\u80cc\u7684\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\uff08\u5373API\u8bef\u7528\uff09\u3002<\/p>\n\n\n\n

\u672c\u6587\u5b9e\u73b0\u4e86\u4e0a\u8ff0\u65b9\u6cd5\u7684\u539f\u578bAdvance\uff0c\u5e76\u4e14\u57285\u4e2a\u5e38\u7528\u8f6f\u4ef6\u5e93\u4ee5\u53ca39\u4e2a\u8f6f\u4ef6\u96c6\u5408\u4e0a\u6d4b\u8bd5\u4e86\u5176\u6709\u6548\u6027\u3002\u6700\u7ec8Advance\u53d1\u73b0\u4e86193\u4e2aAPI\u8bef\u7528\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u5415\u6d9b\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u7814\u7a76\u751f\u3002\u7814\u7a76\u65b9\u5411\u4e3a\u6f0f\u6d1e\u68c0\u6d4b\uff0c\u5305\u62ec\u6a21\u7cca\u6d4b\u8bd5\u4ee5\u53ca\u667a\u80fd\u5316\u6f0f\u6d1e\u53d1\u73b0\u6280\u672f\u7814\u7a76\u3002\u7814\u7a76\u6210\u679c\u53d1\u8868\u4e8eCCS\u4ee5\u53caUSENIX Security\u7b49\u4fe1\u606f\u5b89\u5168\u4f1a\u8bae\u3002<\/p>\n\n\n\n

\u738b\u529b \u8682\u8681\u91d1\u670d\u9690\u79c1\u8ba1\u7b97\u9ad8\u7ea7\u7b97\u6cd5\u4e13\u5bb6<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>\u9ad8\u6027\u80fd\u9690\u79c1\u4fdd\u62a4\u673a\u5668\u5b66\u4e60\u7b97\u6cd5<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

\u6f14\u8bb2\u4e3b\u8981\u4ecb\u7ecd\u9690\u79c1\u4fdd\u62a4\u673a\u5668\u5b66\u4e60\u7684\u76f8\u5173\u80cc\u666f\u4e0e\u96be\u70b9\uff0c\u6700\u8fd1\u51e0\u5e74\uff0c\u5728\u591a\u65b9\u5b89\u5168\u8ba1\u7b97\u548c\u540c\u6001\u52a0\u5bc6\u65b9\u5411\u7684\u6f14\u8bb2\u9010\u6e10\u589e\u591a\uff0c\u4f46\u662f\uff0c\u7531\u4e8e\u5bc6\u6001\u8ba1\u7b97\u7684\u590d\u6742\u5ea6\u9ad8\uff0c\u901a\u4fe1\u91cf\u5927\uff0c\u5bfc\u81f4\u5728\u5b9e\u9645\u5e94\u7528\u4e2d\u6027\u80fd\u96be\u4ee5\u7b26\u5408\u8981\u6c42\uff0c\u672c\u6b21\u6f14\u8bb2\u8bb2\u4ecb\u7ecd\u5982\u4f55\u7ed3\u5408\u673a\u5668\u5b66\u4e60\u548c\u591a\u65b9\u5b89\u5168\u8ba1\u7b97\u7684\u8ba1\u7b97\u7279\u6027\uff0c\u63d0\u5347\u9690\u79c1\u4fdd\u62a4\u673a\u5668\u5b66\u4e60\u7684\u5b89\u5168\u6027\u548c\u8ba1\u7b97\u6027\u80fd\uff0c\u5728\u4fdd\u8bc1\u7b97\u6cd5\u5b9e\u7528\u6027\u7684\u60c5\u51b5\u4e0b\uff0c\u505a\u5230\u53ef\u8bc1\u5b89\u5168\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u738b\u529b \u8682\u8681\u91d1\u670d\u9690\u79c1\u8ba1\u7b97\u9ad8\u7ea7\u7b97\u6cd5\u4e13\u5bb6\uff0c2010\u5e74\u52a0\u5165\u963f\u91cc\u4e91\u4ece\u4e8b\u641c\u7d22\u7b97\u6cd5\u7814\u7a76\u5de5\u4f5c\uff1b2016\u5e74\u52a0\u5165\u8682\u8681\u91d1\u670d\uff0c\u4ece\u4e8b\u9690\u79c1\u4fdd\u62a4\u673a\u5668\u5b66\u4e60\u6280\u672f\u7684\u7814\u7a76\u4e0e\u5e94\u7528\u5de5\u4f5c\uff0c\u5e26\u9886\u56e2\u961f\uff0c\u5728\u591a\u65b9\u5b89\u5168\u8ba1\u7b97\u3001\u53ef\u4fe1\u6267\u884c\u73af\u5883\u3001\u540c\u6001\u52a0\u5bc6\u7b49\u9886\u57df\u8fdb\u884c\u6df1\u5165\u7684\u7814\u7a76\u63a2\u7d22\uff0c\u521b\u5efa\u4e86\u5de5\u4e1a\u7ea7\u53ef\u7528\u7684\u3001\u9002\u914d\u4e0d\u540c\u573a\u666f\u7684\u591a\u9879\u9690\u79c1\u4fdd\u62a4\u673a\u5668\u5b66\u4e60\u65b9\u6848\uff0c\u5e76\u5728\u5b9e\u9645\u4e1a\u52a1\u573a\u666f\u4e2d\u53d6\u5f97\u6210\u529f\u3002<\/p>\n\n\n\n

\u4e50\u6cf0   \u56fd\u9632\u79d1\u6280\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u535a\u58eb\u7814\u7a76\u751f<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing as a Variant of the Adversarial Multi-Armed Bandit<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

Fuzzing\u4f5c\u4e3a\u4e00\u79cd\u9ad8\u6548\u7684\u6f0f\u6d1e\u6316\u6398\u6280\u672f\uff0c\u53d7\u5230\u4e86\u5f88\u591a\u7814\u7a76\u4eba\u5458\u7684\u5173\u6ce8\uff0c\u7279\u522b\u662f\u8fd1\u4e9b\u5e74\u5174\u8d77\u7684\u4ee5AFL\u4e3a\u4ee3\u8868\u7684Coverage-based Greybox Fuzzing\u6280\u672f\u3002\u7136\u800c\uff0cAFL\u5728\u6d4b\u8bd5\u65f6\u4f1a\u5206\u914d\u8fc7\u591a\u7684\u80fd\u91cf\uff08\u5373\u79cd\u5b50\u53d8\u5f02\u4ea7\u751f\u7684\u6d4b\u8bd5\u7528\u4f8b\u7684\u6570\u91cf\uff09\u7ed9\u6267\u884c\u9ad8\u9891\u8def\u5f84\u7684\u4f4e\u8d28\u91cf\u79cd\u5b50\uff0c\u4ece\u800c\u6d6a\u8d39\u4e86\u5927\u91cf\u7684\u8ba1\u7b97\u8d44\u6e90\u3002\u6b64\u5916\uff0c\u5f53\u524d\u7814\u7a76\u9886\u57df\u5bf9Coverage-based Greybox Fuzzing\u6280\u672f\u7684\u8c03\u5ea6\u7b97\u6cd5\u65b9\u9762\u7684\u7814\u7a76\u8fd8\u4e0d\u591f\u6df1\u5165\u3002<\/p>\n\n\n\n

\u9488\u5bf9\u4e8e\u8fd9\u4e9b\u95ee\u9898\uff0c\u672c\u6587\u63d0\u51fa\u4e86\u4e00\u79cd\u57fa\u4e8eAdversarial Multi-Armed Bandit\u7684\u53d8\u5f02\u5f0f\u6a21\u578b\u6765\u5bf9Coverage-based Greybox Fuzzing\u4e2d\u7684\u8c03\u5ea6\u8fc7\u7a0b\u8fdb\u884c\u5efa\u6a21\u3002<\/p>\n\n\n\n

\u6211\u4eec\u9996\u5148\u5b9a\u4e49\u4e86\u83b7\u80dc\u6982\u7387\u8fd9\u4e00\u6982\u5ff5\uff0c\u5b83\u8868\u793a\u5bf9\u67d0\u4e00\u79cd\u5b50\u53d8\u5f02\u4ea7\u751f\u6267\u884c\u65b0\u4ee3\u7801\u8def\u5f84\u7684\u6d4b\u8bd5\u7528\u4f8b\u7684\u6982\u7387\u3002\u901a\u8fc7\u83b7\u80dc\u6982\u7387\uff0c\u6211\u4eec\u6307\u51fa\u4e86\u5f53\u524dAFL\u8c03\u5ea6\u7b97\u6cd5\u4e2d\u7684\u4e00\u4e9b\u95ee\u9898\u4e0e\u6311\u6218\u3002\u57fa\u4e8e\u6b64\uff0c\u6211\u4eec\u5b9a\u4e49\u4e86\u79cd\u5b50\u96c6\u5408\u7684\u4e09\u79cd\u72b6\u6001\uff0c\u5e76\u5f00\u53d1\u4e86\u81ea\u9002\u5e94\u7684\u80fd\u91cf\u8c03\u5ea6\u7b97\u6cd5\u4ee5\u53ca\u57fa\u4e8e\u6982\u7387\u7684\u79cd\u5b50\u641c\u7d22\u7b56\u7565\u3002\u6211\u4eec\u5728AFL\u57fa\u7840\u4e0a\u5b9e\u73b0\u4e86\u4e00\u6b3e\u81ea\u9002\u5e94\u80fd\u91cf\u8282\u7ea6\u578bGreybox Fuzzer\u2014\u2014EcoFuzz\u3002\u6211\u4eec\u5c06EcoFuzz\u4e0e\u5176\u4ed610\u4e2a\u5de5\u5177\u5728 14 \u4e2a\u771f\u5b9e\u7a0b\u5e8f\u548c LAVA-M \u4e0a\u8fdb\u884c\u4e86\u5bf9\u6bd4\u6d4b\u8bd5\u3002\u5b9e\u9a8c\u7ed3\u679c\u8868\u660e\uff0c\u76f8\u8f83\u4e8eAFL\uff0cEcoFuzz\u80fd\u591f\u5728\u51cf\u5c1132%\u6d4b\u8bd5\u7528\u4f8b\u751f\u6210\u6570\u91cf\u7684\u60c5\u51b5\u4e0b\uff0c\u8fbe\u5230214%\u7684\u8def\u5f84\u8986\u76d6\u7387\u3002\u6b64\u5916\uff0cEcoFuzz\u8fd8\u53d1\u73b0\u4e86GNU Binutils\u548c\u5176\u4ed6\u8f6f\u4ef6\u4e2d\u768412\u4e2a\u6f0f\u6d1e\u3002\u6211\u4eec\u8fd8\u6269\u5c55\u4e86EcoFuzz\u6765\u6d4b\u8bd5\u4e00\u4e9b\u7269\u8054\u7f51\u8bbe\u5907\uff0c\u5e76\u5728SNMP\u7ec4\u4ef6\u4e2d\u53d1\u73b0\u4e86\u4e00\u4e2a\u65b0\u6f0f\u6d1e\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong>\u4e50\u6cf0\uff0c\u56fd\u9632\u79d1\u6280\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u535a\u58eb\u7814\u7a76\u751f\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u6a21\u7cca\u6d4b\u8bd5\u6280\u672f\u3002<\/p>\n\n\n\n

\u9648\u51ef\u7fd4\uff0c\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>\u81ea\u52a8\u5316\u7ed5\u8fc7\u865a\u51fd\u6570\u4fdd\u62a4<\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

\u865a\u51fd\u6570\u8c03\u7528\u662fC++\u7528\u4e8e\u5b9e\u73b0\u9762\u5411\u5bf9\u8c61\u591a\u6001\u7279\u6027\u7684\u8bed\u6cd5\u57fa\u7840\uff0c\u5728\u5404\u7c7b\u5927\u578b\u9879\u76ee\u88ab\u5e7f\u6cdb\u4f7f\u7528\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u865a\u51fd\u6570\u8c03\u7528\u7ed3\u5408\u6f0f\u6d1e\u5b9e\u73b0\u63a7\u5236\u6d41\u52ab\u6301\uff0c\u4e3a\u6b64\uff0c\u7814\u7a76\u8005\u4eec\u66fe\u63d0\u51fa\u4e0d\u540c\u7c7b\u578b\u3001\u4e0d\u540c\u7c92\u5ea6\u7684\u5b8c\u6574\u6027\u4fdd\u62a4\u65b9\u6848\u7528\u4e8e\u9650\u5236\u865a\u51fd\u6570\u7684\u95f4\u63a5\u8df3\u8f6c\u76ee\u6807\u3002\u672c\u6b21\u62a5\u544a\u7cfb\u7edf\u5730\u4ecb\u7ecd\u73b0\u6709\u7684\u865a\u51fd\u6570\u4fdd\u62a4\u7406\u8bba\uff0c\u6307\u51fa\u5f53\u4e0b\u7684\u865a\u51fd\u6570\u8c03\u7528\u4fdd\u62a4\u5b58\u5728\u88ab\u7ed5\u8fc7\u7684\u53ef\u80fd\u6027\uff0c\u5e76\u5206\u4eab\u7ed3\u5408\u771f\u5b9e\u7a0b\u5e8f\u548c\u6f0f\u6d1e\u7684\u8c03\u7814\u7ed3\u679c\u3002<\/p>\n\n\n\n

\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

\u9648\u51ef\u7fd4\uff0c\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u535a\u58eb\u751f\uff0c\u6e05\u534e\u5927\u5b66\u7d2b\u8346\u82b1\u961f\u6210\u5458\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u5b89\u5168\u653b\u9632\u6280\u672f\u3002 
<\/p>\n","protected":false},"excerpt":{"rendered":"

InForSec\u5b9a\u4e8e2021\u5e748\u670827\u65e5(\u5468\u4e94)\u4e0b\u5348\u5728\u7ebf\u76f4\u64ad\u201c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e2d\uff09\u201d\u6d3b… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4906","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4906"}],"version-history":[{"count":3,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4906\/revisions"}],"predecessor-version":[{"id":4962,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4906\/revisions\/4962"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4906"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}