https://blog.1sec.day/tags/%E5%A8%81%E8%83%81%E6%83%85%E6%8A%A5/ Recent content in 威胁情报 on 思安录 | Thinking's Security Notes Hugo -- gohugo.io zh-cn Thinking Thinking Wed, 15 Jul 2026 00:00:00 +0000 https://blog.1sec.day/posts/2026-07-15-telegram-desktop-local-session-reuse/ Wed, 15 Jul 2026 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-15-telegram-desktop-local-session-reuse/ <blockquote> <p>导读：这个复现结果超出了我原本的认知。Telegram 的设备认证机制——手机号验证、短信验证码、二次验证密码——在我的理解里是设计完备的。但当 tdata 被复制到另一台 Mac 后启动客户端，登录界面没有出现。这不是 2FA 被破解了，而是整个复用过程根本没有触发需要验证的环节。</p> </blockquote> https://blog.1sec.day/posts/2026-07-16-fake-reputation-crypto-clipboard-hijacker/ Fri, 20 Jun 2025 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-16-fake-reputation-crypto-clipboard-hijacker/ <blockquote> <p>导读：当 GitHub 的 Star、SourceForge 的下载量、YouTube 的播放量、VirusTotal 的&quot;安全&quot;投票全部可被伪造，&ldquo;社会证明&quot;这套信任机制本身就成了攻击面。Check Point 这份研究揭示了一个把恶意软件伪装成热门项目玩出花样的 Rust 剪贴板劫持器 campaign，值得每一位安全从业者关注。</p> </blockquote> https://blog.1sec.day/posts/2025-02-23-lazarus-apt-attack/ Sun, 23 Feb 2025 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2025-02-23-lazarus-apt-attack/ <blockquote> <p>网络安全对抗是一场持久战。本文由我（Thinking）与山哥（23pds）联合撰写。</p> </blockquote> https://blog.1sec.day/posts/2024-05-31-aggr-malicious-chrome-extension/ Fri, 31 May 2024 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2024-05-31-aggr-malicious-chrome-extension/ https://blog.1sec.day/posts/2022-08-20-celer-network-bgp-hijacking/ Sat, 20 Aug 2022 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2022-08-20-celer-network-bgp-hijacking/ https://blog.1sec.day/posts/2022-08-04-solana-massive-theft/ Thu, 04 Aug 2022 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2022-08-04-solana-massive-theft/ https://blog.1sec.day/posts/2022-05-17-discord-phishing-analysis/ Tue, 17 May 2022 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2022-05-17-discord-phishing-analysis/