SECURITY WARNINGS & Notices - Please post them here

[Staticguy]

LOL 

[Asyn]

Vulnerability Note VU#529496
Komodia Redirector with SSL Digestor fails to properly validate SSL and installs non-unique root CA certificates and private keys
http://www.kb.cert.org/vuls/id/529496

[Pondus]

Windows SSL Interception Gone Wild
https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339

[Staticguy]

BEWARE SCAM!!!!!

http://www.vg247.com/2015/02/23/darkest-dungeon-windows-8-store-scam/

[polonus]

The new Google Fuzzing Bots are doing overtime and with good results:
http://googleonlinesecurity.blogspot.nl/2015/02/more-protection-from-unwanted-software.html

polonus

[Pondus]

Superfish Update - An Open Letter from Lenovo CTO Peter Hortensius
http://news.lenovo.com/article_display.cfm?article_id=1932

[DavidR]

Superfish Update - An Open Letter from Lenovo CTO Peter Hortensius
http://news.lenovo.com/article_display.cfm?article_id=1932

Talk about trying to understate the seriousness of the issue:

This software frustrated some users without adding value to the experience so we were in the process of removing it from our preloads.

It "frustrated some users" a real master of understatement at work.

I though when there was this big a screw up the got a public flogging - or worse.

[polonus]

Hi DavidR,

If that is 57.000 users I would not like to be among them,

polonus

[Pondus]

maybe something good will come out of it

Now, we are in the midst of developing a concrete plan to address software vulnerabilities and security with defined actions that we will share by the end of the week. What I can say about this today is that we are exploring a wide range of options that include:

-creating a cleaner PC image (the operating system and software that is on your device right out of the box);

-working directly with users, privacy/security experts and others to create the right preload strategy quickly;

-and soliciting and assessing the opinions of even our harshest critics in evaluating our products going-forward.

a clean PC with only OS?...no crap software   

[bob3160]

Melih from Comodo also defends his position regarding Privdog:
https://forums.comodo.com/ssl-certificate/comodo-under-attack-t70990.0.html;msg798365#msg798365

[DavidR]

maybe something good will come out of it

Building trust again will take some time I fear - Despite their assurances, I know Lenovo is off my list for some time. When HP abandoned updating printer drivers for a new OS, my A3 business grade printer effectively became an expensive paper weight. I vowed never to purchase another HP product and that was over 10 years ago.

Sony is in a similar boat, after their rootkit fiasco, I vowed never to buy another Sony product and I haven't. Boy is that hard given the product range they have.

Now, we are in the midst of developing a concrete plan to address software vulnerabilities and security with defined actions that we will share by the end of the week. What I can say about this today is that we are exploring a wide range of options that include:

-creating a cleaner PC image (the operating system and software that is on your device right out of the box);

-working directly with users, privacy/security experts and others to create the right preload strategy quickly;

-and soliciting and assessing the opinions of even our harshest critics in evaluating our products going-forward.

a clean PC with only OS?...no crap software   

Well they are still going to have an AV on board according to their article as the say one of the first things that will happen on new systems is to run a scan to ensure there is no Superfish - or presumably any other malware.

[polonus]

Hi DavidR,

We just could have be waiting for this outcome, at long last the eager scraping for the easy bundling money is now backfiring greartly.
Will they ever learn they cannot lead the user to that same river again and again? Always the hardest thing is to recognize  your own mistakes and learn from them. Not a lot of marketeers are ready to learn, only a few can. If that is so, they have to learn the hard way.
I do not pity them. Arrogance, dear DavidR, arrogance everywhere and contempt  for the end-user/customer that  they cannot live without.

Damian

[mchain]

Superfish Fallout Raises Privacy Concern Over Parental Control Apps
https://blog.malwarebytes.org/privacy-2/2015/02/superfish-fallout-raises-privacy-concern-over-parental-control-apps/

[polonus]

Hi mchain,

More related SDK android malvertising.
Avast should provide proper Network Protection for it,
a typical Network Shield protection issue here.
Read: http://www.hotforsecurity.com/blog/android-malvertising-scam-promises-antivirus-delivers-lifetime-subscription-to-ringtones-7157.html   link article author: Lorezana Botezanu
So this sort of malcode has been with us since 2013 and now it went from bad to worse apparently.
In Avast we trust, unless we test.

polonus

[polonus]

Ramnit botnet was taken down by Europol, a cookie and password stealing botnet: http://blogs.technet.com/b/mmpc/archive/2011/05/10/little-red-ramnit-my-what-big-eyes-you-have-grandma.aspx

polonus