[ Android ]  百脑虫之HOOK技术分析 - http://blogs.360.cn/360mobile/2016/04/25/analysis_of_bainaochong_hook/ by 360 Mobile Security Team

[ Android ]  RuMMS: The Latest Family of Android Malware Attacking Users in Russia Via SMS Phishing https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html

[ Attack ]  Massive security breach at German Nuclear power plant ~ http://www.express.co.uk/news/world/664868/German-nuclear-plant-security-breach-fears-cyber-hackers-gain-access-atomic-site

[ Attack ]  冒充最高检网络电信诈骗之追溯 - http://bobao.360.cn/learning/detail/2851.html

[ Attack ]  Oh man: vulnerability in huge dark web marketplace leaves private messages exposed; containing orders, addresses etc https://motherboard.vice.com/read/vulnerability-in-huge-dark-web-marketplace-exposes-private-messages-alphabay-reddit

[ Attack ]  Repackaging Open Source #BeEF Browser Exploitation Framework for #APT campaigns https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/

[ Backdoor ]  #Tuto4PC #scareware backdoors millions of computers-@ Cisco Talos report: https://threatpost.com/tuto4pc-utilities-silently-install-12m-backdoors-cisco/117704/ via @ threatpost

[ Browser ]  Debug Microsoft Edge from VS Code with the new Edge Diagnostics Adapter. https://blogs.windows.com/msedgedev/2016/04/27/introducing-edge-diagnostics-adapter/ https://t.co/rMV43Tp5mh

[ Browser ]  CVE-2016-1779 技术分析及其背后的故事 - http://xlab.tencent.com/cn/2016/04/19/CVE-2016-1779/ by @ XuanwuLab

[ Browser ]  Insight into security mechanisms within the MSFT Edge Browser. Worth a watch! http://bit.ly/1qM5kbO #DFIR https://t.co/657cRY2NkN

[ Browser ]  Firefox 46 Patches Critical Memory Vulnerabilities: https://threatpost.com/firefox-46-patches-critical-memory-vulnerabilities/117698/ via @ threatpost

[ Browser ]  Extracting page contents with CSS injection via OTF+SVG & XEE https://gist.github.com/cure53/1501bcb6aa6608b2af38fcafd68af219

[ Browser ]  Firefox release 46.0 gets enabled W^X for JIT-code: https://www.mozilla.org/en-US/firefox/46.0/releasenotes/, http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-firefox/

[ Detect ]  Passive DNS for Threat Hunting on the network https://www.endgame.com/blog/hunting-cheap-part-1-architecture

[ Linux ]  Linux KASLR memory randomization moving to PATCH stage http://comments.gmane.org/gmane.linux.kernel/2206880

[ Mac OS X ]  SyScan360 Singapore 2016 slides and exploit code https://reverse.put.as/2016/04/27/syscan360-singapore-2016-slides-and-exploit-code/

[ Malware ]  Malware Takes Advantage of Windows ‘God Mode’ https://blogs.mcafee.com/mcafee-labs/malware-takes-advantage-of-windows-god-mode/

[ Malware ]  New #malware variant combines high-level obfuscation techniques & several layers of evasion http://intel.ly/1pDLnD7 https://t.co/mdgVVdZ0UX

[ Mitigation ]  AMD Memory Encryption- http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf #SEV #SME

[ Mitigation ]  Changes in CFG: 'Reserved2' field of LOAD_CONFIG_DIRECTORY now points to new func ntdll!LdrpDispatchUserCallTarget https://t.co/0y6PKLfNue

[ OpenSourceProject ]  Re: CVE Request: Out-of-bands write issue found in qemu: +-- On Wed, 27 Apr 2016, 李强 wrote --+ | The qemu has... http://bit.ly/235peL7

[ OpenSourceProject ]  Vulnerability Spotlight: Further NTPD Vulnerabilities http://feedproxy.google.com/~r/Vrt/~3/YoDCJSvJV-Y/vulnerability-spotlight-further-ntpd_27.html

[ Others ]  Some Java Deserialization Security FAQ - https://christian-schneider.net/JavaDeserializationSecurityFAQ.html#main to answer dev questions about #JavaDeser - feedback welcome

[ Others ]  vulny : Vulnerable Linux socket game for educational purposes : https://github.com/vix597/vulny

[ Others ]  7 million unsalted MD5 passwords leaked by Minecraft community Lifeboat http://arstechnica.com/security/2016/04/minecraft-community-lifeboat-fails-remedial-password-security/

[ Pentest ]  书安第七期 - http://down.jdsec.com/secbook-7/%E4%B9%A6%E5%AE%89-%E7%AC%AC%E4%B8%83%E6%9C%9F.pdf

[ Pentest ]  书安第六期 - http://down.jdsec.com/secbook-6/%E7%AC%AC%E5%85%AD%E6%9C%9F.pdf

[ Pentest ]  IntruderPayloads : A collection of Burpsuite Intruder payloads : https://github.com/1N3/IntruderPayloads

[ Pentest ]  Faster Blind MySQL Injection Using Bit Shifting : https://www.exploit-db.com/papers/17073/

[ Pentest ]  Did you know we have official OSX installers for the open source Metasploit Framework? https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers

[ Tools ]  Mosh : the mobile shell (SSH replacement) : https://mosh.mit.edu/ (For Android,Mac OS X,FreeBSD,GNU/Linux) ,PDF : https://mosh.mit.edu/mosh-paper.pdf

[ Tools ]  PowerShell for Docker Available for Early Testing http://windowsitpro.com/powershell/powershell-docker-available-early-testing

[ Web Security ]  Binary Webshell Through OPcache in PHP 7 http://blog.gosecure.ca/2016/04/27/binary-webshell-through-opcache-in-php-7/

[ Web Security ]  Office 365 authentication bypass disclosure and write-up: http://www.economyofmechanism.com/office365-authbypass.html #SAML https://t.co/mckGzrqBev

[ Windows ]  MiAssignTopLevelRanges brings full KASLR to Windows 10, at last. ULTRAZERO. https://t.co/3hNCidVEws

[ Windows ]  CVE-2016-0018: DLL Planting Leads to a Remote Code Execution Vulnerability https://blogs.mcafee.com/mcafee-labs/cve-2016-0018-dll-planting-leads-to-a-remote-code-execution-vulnerability/

[ Windows ]  [Experimenting] JavaScript - Generate and Enroll Certificate Chain - COM+ Scriptlets https://gist.github.com/subTee/9b90e64808b477b2b92a37dbfad9d898

[ Windows ]  Windows Server 2016 Technical Preview 5 - with Shielded VM's and Host Guardian Service - https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-technical-preview interesting

[ Windows ]  NCC Group Blog: Adventures in Windows Driver Development: Part 1 - https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/april/adventures-in-windows-driver-development-part-1/

[ Windows ]  Windows RS1 14332, no changes in UAC except redesigned window (in 14328). Would be interesting to see if sysprep will be fixed before rtm.

[ Windows ]  Redstone Build 14332 now adds MiRebaseDynamicRelocationRegions, and fully dynamic PTE/PDE/PXE base, with a call to SecureKernel/VSM.