[ Android ]  Android IOMX getConfig/getParameter Information Disclosure https://packetstormsecurity.com/files/136632 #exploit

[ Android ]  iOS & Android vulnerable to 2FA attack - How Anywhere Computing Just Killed Two-Factor Authentication (2FA) : https://docs.google.com/viewer?url=http%3A%2F%2Ffc16.ifca.ai%2Fpreproceedings%2F24_Konoth.pdf (pdf)

[ Attack ]  Mumblehard spam-spewing botnet floored German CERT contacting admins of infected linux servers ~ http://m.theregister.co.uk/2016/04/07/mumblehard_spam_botnet_takedown/

[ Browser ]  Tofino, Mozilla's new experimental desktop browser based on Chromium/Electron (following in @ Brave's footsteps): https://medium.com/project-tofino/browsers-innovators-dilemma-and-project-tofino-ef634c6164f0#.skrqr83w9

[ Browser ]  WebRTC Test Landing Page http://mozilla.github.io/webrtc-landing/

[ iOS ]  If You Can't Break Crypto, Break the Client: Recovery of Plaintext iMessage Data https://www.bishopfox.com/blog/2016/04/if-you-cant-break-crypto-break-the-client-recovery-of-plaintext-imessage-data/

[ IoTDevice ]  I’m writing a series of posts on basic Reverse Engineering of embedded systems :) Part 1 - Hunting for Debug Ports: http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/

[ Malware ]  Nuclear Drops Tor Runs and Hides http://blog.talosintel.com/2016/04/nuclear-tor.html

[ Network ]  WordPress is automatically turning on HTTPS encryption for every site they host, thanks to @ letsencrypt: https://en.blog.wordpress.com/2016/04/08/https-everywhere-encryption-for-all-wordpress-com-sites/

[ NetworkDevice ]  Over 135 million modems (ARRIS (Motorola)) vulnerable to denial-of-service flaw : http://www.securityforrealpeople.com/2016/04/arris-motorola-surfboard-modem.html ,More : http://seclists.org/fulldisclosure/2016/Apr/8

[ Others ]  Writing your own Parser : http://resources.infosecinstitute.com/writing-your-own-parser/

[ Others ]  Japan To Begin Testing Fingerprints As 'Currency' : http://the-japan-news.com/news/article/0002859676 > Did I hear hackers cheering up ?

[ Others ]  NoScript 2.9.0.11 is out, fixes several XSS filter bypasses caused by a broken build script. One of them: <b onbeforescriptexecute=alert(1)>

[ Pentest ]  Metasploit Unleashed : https://community.rapid7.com/docs/DOC-2227 ( *pdf)

[ Popular Software ]  A Look Into Adobe Flash Player CVE-2016-1019 Zero-Day Attack http://blog.trendmicro.com/trendlabs-security-intelligence/look-adobe-flash-player-cve-2016-1019-zero-day-vulnerability/

[ ReverseEngineering ]  Reverse engineering the popular 555 timer chip (CMOS version) http://www.righto.com/2016/04/teardown-of-cmos-555-timer-chip-how.html

[ Tools ]  Framework for Making Environmental Keyed Payloads https://github.com/Genetic-Malware/Ebowla

[ Tools ]  Voltron with WinDbg/CDB support (using PyKD by @ ussrhero) is on GitHub now. https://github.com/snare/voltron https://t.co/I2vRnoKwmW

[ Web Security ]  #Monstra 3.0.1 Privilege Escalation #CVE-2014-9257 http://security.szurek.pl/monstra-301-privilege-escalation.html They fix it after sarimkiani Full Disclosure on github

[ Web Security ]  [CVE-2016-3972]DotCMS Directory traversal vulnerability http://goo.gl/fb/3R71Tm #FullDisclosure

[ Web Security ]  Google UI-Redressing Bug That Discloses The User's Email Address http://blog.mazinahmed.net/2016/03/google-ui-redressing-bug-that-discloses-email-addresses.html

[ Windows ]  How to Run Ubuntu on latest Windows 10 Insider Preview Build 14316 http://thehackernews.com/2016/04/how-to-run-ubuntu-on-windows-10.html #Ubuntu #Security

[ Windows ]  Leo Davidson UAC autoelevation method extended, simple, no need any "injects" http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3643&p=28249#p28249 w7-RS1 #uacme https://t.co/T9D439TsxE