资讯类
Leakbase.pw被黑，网站被导向社工库
https://www.bleepingcomputer.com/news/security/leakbase-pw-hacked-password-service-goes-dark/
ICS-CERT（美国工控系统计算机应急响应团队）就如何在工业环境中更新杀毒软件提出建议，但有安全专家认为这些建议并不够实用，杀毒软件并不是工控系统安全的保证
http://www.securityweek.com/ics-cert-advice-av-updates-solid-impractical
多家执法机构合作取缔仙女座僵尸网络，此网络自2011年开始活跃，分发了非常多的恶意软件，关于此次行动的细节ESET发布了安全报告
http://securityaffairs.co/wordpress/66343/cyber-crime/andromeda-botnet-dismantled.html
https://www.welivesecurity.com/2017/12/04/eset-takes-part-global-operation-disrupt-gamarue/
安全研究员发现新的Shadow BTCware Ransomware变种，中招的用户只能免费解密3个小于1MB的文件
http://securityaffairs.co/wordpress/66331/malware/new-shadow-btcware-ransomware.html
美国证券交易委员会打响电子货币犯罪第一枪，ICO被冻结
谷歌开始打击未经用户允许收集用户资料的安卓应用
技术类
Struts2：S2-054、S2-055调查报告
https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095
共享密码的风险与现状
https://www.troyhunt.com/the-trouble-with-politicians-sharing-passwords/
img标签的进化：没有GIF的Gif
https://calendar.perfplanet.com/2017/animated-gif-without-the-gif/
PocketBeagle的手工制作
http://www.righto.com/2017/12/hands-on-with-pocketbeagle-tiny-25.html
深入剖析LLVM混淆工具
https://blog.rpis.ec/2017/12/dissection-llvm-obfuscator-p1.html
ECDSA私钥与DSA签名恢复工具
https://github.com/tintinweb/ecdsa-private-key-recovery
安卓中的ARM Mode与Thumb Mode
https://userpc.net/2017/12/04/arm-mode-thumb-mode-classification-android/
STARTTLS Stripping Attack PoC
https://github.com/tintinweb/striptls
基于Bigquery构建内容发现Wordlist
https://pentester.io/commonspeak-bigquery-wordlists/
基于神经网络的恶意软件检测
https://devblogs.nvidia.com/parallelforall/malware-detection-neural-networks/
NSJail与沙盒Imagemagick
https://offbyinfinity.com/2017/12/sandboxing-imagemagick-with-nsjail/
渗透测试与.NET执行文件 Part2
https://www.peew.pw/blog/2017/12/4/writing-net-executables-for-penteters-part-2
Plaso Heimdall介绍
https://www.youtube.com/watch?v=JZGfhd1PNhU
CNI-IPVLAN-VPC-K8S