Technical

[Asyn]

Threat Advisory: XOR DDoS
https://www.stateoftheinternet.com/downloads/pdfs/2015-threat-advisory-xor-ddos-attacks-linux-botnet-malware-removal-ddos-mitigation-yara-snort.pdf

[Asyn]

YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

[Asyn]

Threat Spotlight: Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone
http://talosintel.com/angler-exposed/

[Asyn]

[Cryptography] OpenPGP SEIP downgrade attack
http://www.metzdowd.com/pipermail/cryptography/2015-October/026685.html

[Asyn]

Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence
http://www.volexity.com/blog/?p=179

[Asyn]

Webmail Server APT: A New Persistent Attack Methodology Targeting Microsoft Outlook Web Application (OWA)
http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Labs-Analysis-Webmail-Sever-APT.pdf

[Asyn]

Authentication Bypass in Netgear WNR1000v4 Router
http://blog.csnc.ch/2015/10/authentication-bypass-in-netgear-wnr1000v4-router/
http://blog.csnc.ch/2015/10/aftermath-of-the-netgear-advisory-disclosure/
http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.html
http://www.shellshocklabs.com/2015/09/part-2en-hacking-netgear-jwnr2010v5.html

[Asyn]

87% of Android devices insecure
http://androidvulnerabilities.org/press/2015-10-08
https://www.cl.cam.ac.uk/~drt24/papers/spsm-scoring.pdf

[Asyn]

Certificate authorities issue SSL certificates to fraudsters
http://news.netcraft.com/archives/2015/10/12/certificate-authorities-issue-hundreds-of-deceptive-ssl-certificates-to-fraudsters.html

[DavidR]

Certificate authorities issue SSL certificates to fraudsters
http://news.netcraft.com/archives/2015/10/12/certificate-authorities-issue-hundreds-of-deceptive-ssl-certificates-to-fraudsters.html

This has been going on for absolutely years - I can remember one AV supplier (who will remain nameless) who also is a SSL Certificate Authorisation body.

[Asyn]

Certificate authorities issue SSL certificates to fraudsters
http://news.netcraft.com/archives/2015/10/12/certificate-authorities-issue-hundreds-of-deceptive-ssl-certificates-to-fraudsters.html

This has been going on for absolutely years - I can remember one AV supplier (who will remain nameless) who also is a SSL Certificate Authorisation body.

No need to name them Dave, the pie chart says it all...

[bob3160]

Certificate authorities issue SSL certificates to fraudsters
http://news.netcraft.com/archives/2015/10/12/certificate-authorities-issue-hundreds-of-deceptive-ssl-certificates-to-fraudsters.html

This has been going on for absolutely years - I can remember one AV supplier (who will remain nameless) who also is a SSL Certificate Authorisation body.

No need to name them Dave, the pie chart says it all...

None other than our fire  breathing friend, the Comodo Dragon:

[DavidR]

<snip quotes>
None other than our fire  breathing friend, the Comodo Dragon:

Wow (total 76%) I wasn't aware CloudFlare was also the same company, no wonder we are seeing so many CloudFlare invalid or bad SSL certificate or malware alert in the viruses and worms forum.

[Asyn]

The Hidden Data Economy - The Marketplace for Stolen Digital Information
http://www.mcafee.com/us/resources/reports/rp-hidden-data-economy.pdf

[Asyn]

The SHAppening: freestart collisions for SHA-1
https://sites.google.com/site/itstheshappening/
https://eprint.iacr.org/2015/967.pdf