Zhiniang Peng from Qihoo 360 Core Security
NEO is a non-profit, community-based blockchain project. It is a distributed network that uses blockchain technology and digital identity for asset digitization. It is also an intelligent management of digital assets using intelligent contracts to create “Smart Economy”. At present, NEO’s market capitalization ranks fifteenth in the world in coinmarket, being one of the remarkable blockchain projects. We found a Denial of Service vulnerability in the NEO smart contract platform which attacker could use to instantly crash the entire neo network.
Zhiniang Peng from Qihoo 360 Core Security
NEO是一个非盈利的社区化的区块链项目。它是利用区块链技术和数字身份进行资产数字化，利用智能合约对数字资产进行自动化管理，实现“智能经济”的一种分布式网络。目前Neo市值在coinmarket上排名全球第十五，是备受关注的区块链项目之一。我们在neo智能合约平台中发现一处拒绝服务漏洞，攻击者可利用该漏洞在瞬间使得整个neo网络崩溃。
APT-C-26(Lazarus 音译”拉撒路”)是从2009年以来至今一直处于活跃的APT组织，据国外安全公司调查显示，该组织最早的攻击可能和2007年针对韩国政府网站大规模DDOS攻击的“Operation Flame”行动相关，同时可能是2014 年索尼影业遭黑客攻击事件，2016 年孟加拉国银行数据泄露事件和2017年席卷全球的“Wannacry”勒索病毒等著名攻击事件的幕后组织。2017年以来，该组织将攻击目标不断扩大，日趋以经济利益为目的，从针对全球的传统金融机构银行系统进行攻击，开始转向于针对全球加密货币组织和相关机构以及个人进行攻击。
APT-C-26 is an APT group that has been active since 2009. According to the research by an overseas security vendor, the group’s earliest attack may be associated with the “Operation Flame” which was a large-scale DDOS attack on Korean government’s website in 2007. Lazarus may also be the group behind the hacking incident of Sony Pictures in 2014, the data breach of the Bank of Bangladesh in 2016 and other infamous attacks such as the “Wannacry” ransomware that swept across the globe in 2017. Since 2017, the group has been expanding its targets of attack and increasingly aimed at economic interests. In earlier attacks, the group mainly targeted the banking system of traditional financial institutions. Now, it has begun to attack global cryptocurrency organizations and related individuals.
360烽火实验室
传统的APT攻击主要是针对PC端进行，而随着智能手机和移动网络在世界范围内的普及发展，越来越多黑客组织的攻击目标也迅速蔓延到移动端，甚至出现出和PC端结合的趋势。近几年被国内外安全厂商陆续披露的Fancy Bear、Lazarus、Operation Manul、摩诃草、黄金鼠等多个攻击组织无疑印证了这点。近期，360烽火实验室发现肚脑虫组织（APT-C-35）最新的攻击已把移动端也加入到其攻击目标中。
古河@360 Vulcan Team
asset是EOS官方头文件中提供的用来代表货币资产（如官方货币EOS或自己发布的其它货币单位）的一个结构体。在使用asset进行乘法运算（operator *=）时，由于官方代码的bug，导致其中的溢出检测无效化。造成的结果是，如果开发者在智能合约中使用了asset乘法运算，则存在发生溢出的风险。
