SECURITY WARNINGS & Notices - Please post them here

[Asyn]

Hacker is selling 34 million user records stolen from 17 companies
https://www.bleepingcomputer.com/news/security/hacker-is-selling-34-million-user-records-stolen-from-17-companies/

[bob3160]

Windows kernel zero-day vulnerability used in targeted attacks
https://www.bleepingcomputer.com/news/security/windows-kernel-zero-day-vulnerability-used-in-targeted-attacks/

While Microsoft has confirmed that the reported attack is real, it also suggests that it is limited in scope being targeted in nature. This is not, at least as of yet, a widespread broad-sweep exploit. Microsoft says that it has no evidence of any indication of widespread exploits.
The attack requires two vulnerabilities to be chained together for a successful exploit to happen. One of them has already been patched. That was a browser-based vulnerability, CVE-2020-15999, in Chrome browsers, including Microsoft Edge. As long as your browser is up to date, you are protected. Microsoft Edge was updated on October 22 while Google Chrome was updated on October 20.

(It's easy to spread doom and gloom. It takes a bit more effort to tell the whole story.)

[bob3160]

Weekly Security News Roundup w/e 11-6-2020

https://youtu.be/OoIVf1Ue1cU

[Asyn]

HMRC smishing tax scam targets UK banking customers
https://www.bleepingcomputer.com/news/security/hmrc-smishing-tax-scam-targets-uk-banking-customers/

[Asyn]

Critical Privilege Escalation Vulnerabilities Affect 100K Sites Using Ultimate Member Plugin
https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/

[Asyn]

Fraudulent Minecraft apps deceive millions of Google Play users
https://blog.avast.com/fraudulent-minecraft-apps-on-google-play-avast
https://press.avast.com/fraudulent-minecraft-related-apps-deceive-millions-of-google-play-users-avast-warns

[Asyn]

5.8 million RedDoorz user records for sale on hacking forum
https://www.bleepingcomputer.com/news/security/58-million-reddoorz-user-records-for-sale-on-hacking-forum/

[Asyn]

Animal Jam kids' virtual world hit by data breach, impacts 46M accounts
https://www.bleepingcomputer.com/news/security/animal-jam-kids-virtual-world-hit-by-data-breach-impacts-46m-accounts/

[Asyn]

Report: Hotel Reservation Platform Leaves Millions of People Exposed in Massive Data Breach
https://www.websiteplanet.com/blog/prestige-soft-breach-report/

[bob3160]

Avast Security News Roundup w/e 11-13-2020

https://youtu.be/_06fkM-HlvI

[Asyn]

Hacker shares 3.2 million Pluto TV accounts for free on forum
https://www.bleepingcomputer.com/news/security/hacker-shares-32-million-pluto-tv-accounts-for-free-on-forum/

[Asyn]

IRS Impersonation Payment Fraud
https://abnormalsecurity.com/blog/irs-impersonation-payment-fraud/

[bob3160]

IRS Impersonation Payment Fraud
https://abnormalsecurity.com/blog/irs-impersonation-payment-fraud/

As old as the Nigerian scam. Unfortunately, both still filch victims out of a lot of money.
The IRS fraud uses fear. The Nigerian scam uses greed.

[Asyn]

Large-Scale Attacks Target Epsilon Framework Themes
https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/

[bob3160]

Large-Scale Attacks Target Epsilon Framework Themes
https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/

When you don't update, you're susceptible to old vulnerabilities.