SECURITY WARNINGS & Notices - Please post them here

[mchain]

Secunia Country Reports
The Secunia Country Reports tell you how much vulnerable software is present on private PCs in your country, plus a few extra, interesting facts.
http://secunia.com/resources/countryreports/?utm_campaign=Q3_2014_Corporate%20Newsletter%20August%2028&utm_medium=email&utm_source=Eloqua&elq=671fcd4b880949489bbf3f54996023b0&elqCampaignId=857
Out-of-date/end-of-life third-party software and system non-updates are a known way in for malware infections.

[Pondus]

14 antivirus apps found to have security problems
http://www.theregister.co.uk/2014/07/29/antivirus_blood_splattered_as_biz_warned_audit_or_die/

pdf.doc here   http://mincore.c9x.org/breaking_av_software.pdf


Antivirus products riddled with security flaws, researcher says
http://www.pcworld.com/article/2459760/antivirus-products-riddled-with-security-flaws-researcher-says.html

[Lisandro]

14 antivirus apps found to have security problems
http://www.theregister.co.uk/2014/07/29/antivirus_blood_splattered_as_biz_warned_audit_or_die/
pdf.doc here   http://mincore.c9x.org/breaking_av_software.pdf

Not signing product updates and delivering those over insecure HTTP, running excessive old code and not conducting proper source code reviews and fuzzing

Seems avast! is ok.
Besides the tone, which I do not like at all, avast! was one of the most tested antivirus and due to bug bounty program, we got they fixed.

[Pondus]

PUAs Open the Door to System Vulnerabilities
http://www.opswat.com/blog/puas-open-the-door-system-vulnerabilities

[Asyn]

Landfill.bugzilla.org Disclosure
http://bugzillaupdate.wordpress.com/2014/08/27/landfill-bugzilla-org-disclosure/

[bob3160]

Sadly just added to my newest presentation "Security Is Everyones Business"

[bob3160]

For the Facebook users, Privacy Checkup is now rolling out.

[Pondus]

In the news – car hacking, plane hacking and exploitable UEFI BIOS
http://blogs.norman.com/2014/business/in-the-news-car-hacking-plane-hacking

[polonus]

Hole in popular WordPress-plug-in abused actively: http://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html

pol

[polonus]

107.000 websites no longer trusted by Mozilla https://community.rapid7.com/community/infosec/sonar/blog/2014/09/04/107000-web-sites-no-longer-trusted-by-mozilla  (artcle author = Project Sonar's J.Nickel)
Also read: https://kuix.de/blog/  (blog author Karl Engert).
When will this come to Chrome as well. When will we be alerted?

polonus

[bob3160]

107.000 websites no longer trusted by Mozilla https://community.rapid7.com/community/infosec/sonar/blog/2014/09/04/107000-web-sites-no-longer-trusted-by-mozilla  (artcle author = Project Sonar's J.Nickel)
Also read: https://kuix.de/blog/  (blog author Karl Engert).
When will this come to Chrome as well. When will we be alerted?

polonus

Something you need to ask Google not the avast! forum members.....

[polonus]

Hi bob3160,

I hope the avast members will ask Google on our behalf  as well as all will benefit.

Damian

[bob3160]

It may not help what's happened but a free one year watch to help prevent Identity theft is available.
(An excerpt from Security Is Everyones Business )

[REDACTED]

Watch your browser's address bar to prevent TABjacking

Interesting article
http://krebsonsecurity.com/2010/05/devious-new-phishing-tactic-targets-tabs/
and this one includes a test in a "Try it Out" section.
http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/
(that demo worked on a tablet, but not on PC because of NoScript in the browser)

URL in the address bar will definitely show whether you're really entering your credentials (into, for example, gmail, your bank, here), or not, so never stop watching it as you traverse open tabs.

[bob3160]

Ask.com: Different Name, Same Old Dirty Tricks
A nice new "useful" tool:



Useless is a better way to describe it but, people will certainly fall for this crap.