[ Android ]  Here’s the apk from @vvdveen/@vu5ec for testing #android for #Drammer attack. Presentation coming up at #ccs16.... https://t.co/vP3vaS0gTg

[ Browser ]  New post: Bypassing Content-Security-Policy with DNS prefetching https://blog.compass-security.com/2016/10/bypassing-content-security-policy-with-dns-prefetching/

[ Browser ]  This is huge: Chrome will require Certificate Transparency for all new public certificates from Oct 2017 https://t.co/byz9iRUEEv

[ Bug Bounty ]  War Stories from Google's Vulnerability Reward Program : https://docs.google.com/presentation/d/e/2PACX-1vTMBZV_hXgZkEyGBUw8K_pvPjrDBhceV-TYuHWw-Nc3LXA8PZwkW2zQj268W8XBhSkfDEXZ6DN7jrvC/pub?start=false&loop=false&delayms=3000&slide=id.g137e0edca9_0_0

[ Crypto ]  Hacking GSM A5 crypto algorithm by using commodity hardware http://securityaffairs.co/wordpress/52666/hacking/gsm-crypto-hacking.html

[ Debug ]  Debug Linux kernel from Visual Studio (VisualKernel) - http://sysprogs.com/VisualKernel/

[ Detect ]  A simple way for detection the remote user's antivirus : https://vah13.github.io/AVDetection/

[ Exploit ]  PrivEsc : A collection of Windows, Linux and MySQL privilege escalation scripts and exploits : https://github.com/1N3/PrivEsc cc @ crowdshield

[ Fuzzing ]  So #fuzzinator is out: https://github.com/renatahodovan/fuzzinator! All the awesome and crazy ideas for extensions are welcome! ;)

[ macOS ]  Project Zero blog: "task_t considered harmful" by Ian Beer (design issue in iOS/MacOS) - https://goo.gl/yHsnSK

[ macOS ]  task_t (a design issue at core of XNU kernel which powers iOS & MacOS) considered harmful: https://googleprojectzero.blogspot.in/2016/10/taskt-considered-harmful.html ; https://bugs.chromium.org/p/project-zero/issues/detail?id=837

[ macOS ]  OS X/iOS kernel use-after-free in IOSurfaceh ttps://bugs.chromium.org/p/project-zero/issues/detail?id=831

[ macOS ]  OS X kernel use-after-free in IOThunderboltFamily https://bugs.chromium.org/p/project-zero/issues/detail?id=834

[ macOS ]  OS X kernel use-after-free in CoreStorage https://bugs.chromium.org/p/project-zero/issues/detail?id=833

[ macOS ]  OS X/iOS kernel use-after-free in IOHDIXController https://bugs.chromium.org/p/project-zero/issues/detail?id=832

[ macOS ]  OS X kernel use-after-free in IOBluetoothFamily.kext https://bugs.chromium.org/p/project-zero/issues/detail?id=830

[ Malware ]  过期签名“红颜”木马分析 - http://bobao.360.cn/learning/detail/3121.html

[ Malware ]  Trojan[DDOS]/Linux. Znaich分析笔记 - http://www.antiy.com/response/Znaich/Znaich.html

[ Malware ]  恶意软件伪装“正规军”，撕开Booster Cleaner“画皮”下的真相 http://blog.avlsec.com/2016/10/3886/booster-cleaner/

[ Mobile ]  Fun for researchers: Cellebrite phone hacking firmware leaked online: http://motherboard.vice.com/read/the-phone-hackers-at-cellebrite-have-had-their-firmware-leaked-online

[ OpenSourceProject ]  Vulnerability Spotlight: LibTIFF Issues Lead To Code Execution http://blogs.cisco.com/security/talos/libtiff-code-execution

[ OpenSourceProject ]  SSL Death Alert: OpenSSL (CVE-2016-8610) : http://seclists.org/oss-sec/2016/q4/224

[ OpenSourceProject ]  Baidu Tera is a structured distributed database which is designed to manage trillions of links and webpages https://t.co/REl6A9OXci

[ Others ]  New blog post(technical): Micro architecture attacks on KASLR. http://cyber.wtf

[ Others ]  Enumerating Disk Artifacts in Memory http://resources.infosecinstitute.com/enumerating-disk-artifacts-in-memory/

[ Popular Software ]  Foxit Reader FlateDecode Use-After-Free Remote Code Execution Vulnerability CVE-2016-8604 http://srcincite.io/advisories/src-2016-44/

[ Programming ]  All-in-one API documentation browser with offline mode and instant search : http://devdocs.io/

[ Tools ]  Istvan is presenting our #TypeSan @ vu5ec type confusion bug detector @ acm_ccs: https://github.com/vusec/typesan

[ Tools ]  exploit_generator : Automated Exploit generation with WinDBG : https://github.com/theevilbit/exploit_generator

[ Tools ]  Frida 8.1 is out with brand new networking APIs and lots of other improvements: http://www.frida.re/news/2016/10/25/frida-8-1-released/

[ Tools ]  Detect TCP content injection attacks with findject http://www.netresec.com/?page=Blog&month=2016-10&post=Detect-TCP-content-injection-attacks-with-findject

[ Web Security ]  Combining host header injection and lax host parsing serving malicious data : https://labs.detectify.com/2016/10/24/combining-host-header-injection-and-lax-host-parsing-serving-malicious-data/

[ Windows ]  #mimikatz Windows Server 2016 edition! - https://github.com/gentilkiwi/mimikatz/releases Full support for Windows 10 AU & Server 2016 (1607… https://t.co/J1gCe25Gdl

[ Windows ]  Invoke Win32 applications with Bash on Windows : https://msdn.microsoft.com/en-us/commandline/wsl/interop

[ WirelessSecurity ]  LTE security downright ridiculous: every call, text, can be intercepted, blacked out... http://www.theregister.co.uk/2016/10/23/every_lte_call_text_can_be_intercepted_blacked_out_hacker_finds/