SECURITY WARNINGS & Notices - Please post them here

[Asyn]

2014-02-04: Advisory: Netgear
https://www.syss.de/news-events/advisories/advisory-netgear/

[polonus]

New Zero-Day for Blue E abused: http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html

polonus

[polonus]

Scores of fake SSL certificates.
Read: http://news.netcraft.com/archives/2014/02/12/fake-ssl-certificates-deployed-across-the-internet.html
40% of mobile apps do not check for SSL-certificates:
http://blog.ioactive.com/2014/01/personal-banking-apps-leak-info-through.html
(link article autho =r Ariel Sanchez) -see attached image.

[Asyn]

Linksys Worm "TheMoon" Summary: What we know so far
https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633

[Asyn]

Important Kickstarter Security Notice
https://www.kickstarter.com/blog/important-kickstarter-security-notice

[Asyn]

Microsoft Security Advisory (2934088)
http://technet.microsoft.com/en-us/security/advisory/2934088
Fix It: http://support.microsoft.com/kb/2934088/en-us

[DavidR]

Microsoft Security Advisory (2934088)
http://technet.microsoft.com/en-us/security/advisory/2934088
Fix It: http://support.microsoft.com/kb/2934088/en-us

Interesting - only effects IE9 and IE10 - No problem with IE8 on XP since MS wouldn't allow XP to update to IE9 or IE10

[Charyb-0]

GreedyWonk

Another flash zero day exploit.

http://www.fireeye.com/blog/technical/targeted-attack/2014/02/operation-greedywonk-multiple-economic-and-foreign-policy-sites-compromised-serving-up-flash-zero-day-exploit.html

[polonus]

After facebook acquired WhatsApp people in Europe do not trust tnat Messenger app any longer and are leaving the mobile app massively to install Russian developed Telegram-Messenger.
Couldn't  this also be because of this news on reported security and apparent privacy problems? Re: http://www.praetorian.com/blog/whats-up-with-whatsapps-security-facebook-ssl-vulnerabilities
link article author = Paul Jauregui, a Praetorian security researcher.
SSL-problems in WhatsApp-

This is the kind of stuff the NSA would love

, says Jauregui.

polonus

[mchain]

Microsoft Security Advisory (2934088)
http://technet.microsoft.com/en-us/security/advisory/2934088
Fix It: http://support.microsoft.com/kb/2934088/en-us

Interesting - only effects IE9 and IE10 - No problem with IE8 on XP since MS wouldn't allow XP to update to IE9 or IE10

This also is telling:  The fact that only some versions are affected seems to mean that not all versions are updated and made secure in the same way at the same time.

[polonus]

A secure alternative for the Whatsapp community could or might be this Swiss Threema, a mobile messaging app that puts security first
See:  https://threema.ch/en/  Their claim:

you can rest assured that only you and the intended recipient can read your messages.

.
All security in these days however is only relative security and that is globally so. How far this is true also here I saw when I analyzed the SSL security headers on their very SSL-site, where I saw problems with x-content-type-options, x-xss-protection, x-frame options, content-security-policy with secure headers not being returned. Also not best practices performed on strict-transport-security. So for instance content sniffing stays overall possible also for this service, despite of what the claims, Found these insecurities from their https site analyzed with Recx Security Analyzer.
Authentication however seems for the larger part OK: https://www.ssllabs.com/ssltest/analyze.html?d=threema.ch

What I think. Stay calm, part of this is fear mongering. It is is all "a hype of the day", at least m.p.o.

polonus

[AdrianH]

Linksys Worm "TheMoon" Summary: What we know so far
https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633

Not just Linksys and Asus , but many other top selling brands are open to attack ....

http://www.bbc.co.uk/news/technology-26287517

  A separate study by security firm Tripwire has found that 80% of the 25 best-selling routers available on Amazon are vulnerable to compromise.

Security researcher Craig Young from Tripwire said exploits had been publicly discussed and published for more than one-third of these devices.

The past 12 months have seen a flurry of interest in routers by security researchers keen to find bugs and loopholes. One project detailing their findings now lists hundreds of exploits for routers from 36 separate manufacturers.

[polonus]

Hi AdrianH,

That is why to have secure procedures you should use cable.
Despite what everybody claims wifi is not fully secure and it never will be.

What is "hanging in the air" can be trapped, tracked and even compromised.
Dlink Amplifiers can be used to abuse.
Not everybody is behind a proxy fire-walled and neatly configured home network,
that puts the browser screen topsy-turvy for eventual  intruders and then denies them.

So watch out. Security of open wifi is even worse.

We had a lot of problems here in Europe with Fritzbox routers lately
and despite many ISP warnings still a whole army of users did not upgrade
and are still vulnerable to remote hacks.

pol

[Asyn]

Apple promises fix 'very soon' for Macs with failed encryption
http://www.reuters.com/article/2014/02/22/us-apple-encryption-idUSBREA1L10220140222
https://www.imperialviolet.org/2014/02/22/applebug.html

[Charyb-0]

Poisoned YouTube ads serve Caphaw banking trojan

http://www.scmagazine.com/poisoned-youtube-ads-serve-caphaw-banking-trojan/article/335465/