Notes

Google의 보안 엔지니어링: 제 면접 학습 노트 작성자: nolang 저는 Google의 보안 엔지니어이며, 이는 제가 면접을 준비할 때 작성했던 노트입니다. 이 분야에서의 첫 직장이며, 많은 분들이 어떻게 공부했는지 물어보셨습니다. 제 노트는 주로 배워야 할 용어와 기술 목록과, 특정 세부 사항을 기억하는 데 도움이 된 작은 정보들로 구성되어 있습니다. 또한 공부할 주제를 아는 것만큼 중요한 면접 팁과 학습 전략도 포함시켰습니다. 때때로 더 많은 주제를 포함하도록 노트를 업데이트합니다. 목록에는 매우 많은 주제와 용어가...

CVE-2017-0213

CVE-2017-0213: Windows COM 권한 상승 취약점 설명 작성자: Google Security Research CVE: 2017-0213 EDB-ID: 42020 참고 자료: Project-Zero Microsoft Exploit-Database 동영상: Youtube 영향을 받는 제품 제품| 버전| 업데이트| 빌드| 테스트 완료 ---|---|---|---|--- Windows 10| 1511| | 10586| √ Windows 10| 1607| | 14393| √ Windows 10| 1703| | 15063...

Investing Together: Wiz Defend and Google Security Operations

Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate...

CVE-2026-15587

CVE-2026-15587 affects Google SecOps (Chronicle SOAR) prior to version 6.3.85 on Google Cloud Platform. An authenticated attacker could escalate to system-level admin via a crafted internal authentication header. The issue is mitigated by upgrading to 6.3.85; Google notes no customer action is re...

Inside a fake Google security check that becomes a browser RAT

A website styled to resemble a Google Account security page is distributing what may be one of the most fully featured browser-based surveillance toolkits we have observed in the wild. Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push...

Google SecOps SOAR Server 安全漏洞

Google SecOps SOAR Server is a security platform from Google, Inc USA. A security vulnerability exists in Google SecOps SOAR Server that stems from insufficient code validation of uploaded Python packages, which could lead to remote code execution...

MAL-2025-190978 Malicious code in nanoreset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d98d973ab73f5753f101bf681c2916dd61b81ae036a3519f76e17321ba9e2ef The package nanoreset was found to contain malicious code. Source: ghsa-malware fc12f8a503d7dbf0bae6b335d8ea61ae3e1c8e6ec42e415cc48b4ab536180c8e Any...

EUVD-2025-18662

Malicious code in bioql PyPI...

CVE-2025-9918

CVE-2025-9918 describes a Path Traversal vulnerability in the archive extraction component of Google SecOps SOAR Server, affecting version 6.3.54.0, 6.3.53.2 and earlier. An authenticated attacker with import-use-case permissions can achieve Remote Code Execution by uploading a malicious ZIP arch...

How to spot the latest fake Gmail security alerts

Security alerts from tech companies are supposed to warn us when something might be amiss—but what if the alerts themselves are the risk? Scammers have long impersonated tech companies' security and support staff as a way to sniff out users' login credentials, and reports suggest that they're doi...

Google ChromeOS Out-of-Bounds Read Vulnerability

Google ChromeOS is an operating system from the American company Google. Google ChromeOS suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause a virtual machine to escape...

Empowering SecOps in the cloud: enhancing threat detection with Wiz and Google Security Operations

Wiz announces integration with Google Security Operations to help SecOps teams identify critical cloud security issues...

Google Fixes Nearly 100 Android Security Issues

Plus: Apple shuts down a Flipper Zero Attack, Microsoft patches more than 30 vulnerabilities, and more critical updates for the last month of 2023...

New Malvertising Campaign Distributing PikaBot Disguised as Popular Software

The malware loader known as PikaBot is being distributed as part of a malvertising campaign targeting users searching for legitimate software like AnyDesk. "PikaBot was previously only distributed via malspam campaigns similarly to QakBot and emerged as one of the preferred payloads for a threat...

Vulnerability Researchers: Check out The Critical Thinking Podcast

Today, The Wordfence Bug Bounty Program was featured on an episode of the Critical Thinking Podcast, a top resource and community for bug bounty researchers. Critical Thinking is a podcast focused on ethical hacking and security analysis and is described as a “by Hackers for Hackers podcast focus...

Google Android suffers from an unspecified vulnerability (CNVD-2023-9767435)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to cause denial of service attacks...

CVE-2023-3497

Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. Chromium security severity: Medium...

CVE-2023-3497

Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. Chromium security severity: Medium...

Design/Logic Flaw

Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. Chromium security severity: Medium...

CVE-2023-3497: Out-of-bounds Read

Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device. Chromium security severity: Medium...