SECURITY WARNINGS & Notices - Please post them here

[Para-Noid]

If and when AV-C is ready they will reveal the guilty party.

[Para-Noid]

Another reason to have a good ad blocker

https://blog.malwarebytes.org/malvertising-2/2015/04/malvertising-strikes-adult-site-xhamster-again/?utm_source=Gplus&utm_medium=social

[polonus]

Thank you, Para-Noid, for the heads-up on this.
And folks remember when you have plug-ins activate as an on demand basiis,
so only when you trust it to run inside the browser.
And remember now you rarely need java, so when not needed uninstall.

polonus

[polonus]

Again critical hole in WP CMS: http://klikki.fi/adv/wordpress2.html (disclosed by Jouko Pynnonen )
Sucuri's analysis: http://klikki.fi/adv/wordpress2.html

polonus

[Para-Noid]

Yet another reason to have a good ad blocker and MalwareBytes Anti-Exploit

https://blog.malwarebytes.org/privacy-2/2015/04/ads-on-colouring-pages-website-lead-to-installs-explicit-content/?utm_source=Gplus&utm_medium=social

This is getting old in a hurry. The only thing a user can do is to use common sense and be alert and stay up to date with all of the
malicious on-goings on the web. Look before you leap. In other words do some research before you click. It may save you some anguish later.

[Staticguy]

Malware authors go a step further to access bank accounts

https://blog.avast.com/2015/04/27/malware-authors-go-a-step-further-to-access-bank-accounts/

Updated: Kaspersky leaves users open to FREAK attack

On this article you will see this statement: "All the anti-virus applications checked - Avast, Kaspersky and ESET - lower the security of TLS connections in one way or another says Hanno Bock."

http://www.scmagazineuk.com/updated-kaspersky-leaves-users-open-to-freak-attack/article/411470/

Hope Avast read this. Someone please attract my post to the moderators so we can get an answer/clarification about a fix or a solution. Thanks.

[Asyn]

Hope Avast read this. Someone please attract my post to the moderators so we can get an answer/clarification about a fix or a solution. Thanks.

See: https://forum.avast.com/index.php?topic=170164.0

[Para-Noid]

Mac OS X under attack – 10 security packages put to the test

http://www.av-test.org/en/news/news-single-view/mac-os-x-under-attack-10-security-packages-put-to-the-test/

[Staticguy]

Acrobat and Reader support ending for Mac OS X 10.6 and 10.7

http://blogs.adobe.com/documentcloud/acrobat-and-reader-support-ending-for-mac-os-x-10-6-and-10-7/

[Para-Noid]

A good reason to take a layered approach in you system security.

https://blog.malwarebytes.org/malvertising-2/2015/04/domain-shadowing-with-a-twist/?utm_source=Gplus&utm_medium=social

[Para-Noid]

More iPhone 6 Scams in the Wild

https://blog.malwarebytes.org/fraud-scam/2015/04/more-iphone-6-scams-in-the-wild/?utm_source=Gplus&utm_medium=social

Password Alert for Chrome, and other Extensions

https://blog.malwarebytes.org/privacy-2/2015/04/password-alert-for-chrome-and-other-extensions/?utm_source=Gplus&utm_medium=social

[polonus]

Mozilla is phasing out HTTP in favor of HTTPS:
http://news.softpedia.com/news/Mozilla-Is-Phasing-Out-HTTP-Support-a-Legacy-Mode-Will-Be-Available-479895.shtml
and
https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/
and
https://letsencrypt.org/

Websites will be have "new features" disabled to pressure them into using TLS.

This all became possible because IE will soon join "Clippy" in the M$' Afterlife,
well at least that is what they plan for the future.

Also Google Chrome is planning to support the transition of HTTP through HTTPS.
Also to better thward off ad-blocking, conflicting with their main income scheme.

My personal question is why change unsecurity through another form of unsecurity driven by obscurity and encryption.

Malvertising detection will get harder. Loads and loads of website owners will continue to provide mixed and unsecure content and continue their unsecure misconfiguration of server and CMS (and plug-ins and themes) and endanger users further through outdated software and vulnerabilities.

First see to it that the protocol is configured securely, educate those that are responsible for a website's security and then think of a transition from http to https.

I have scanned many a so-called HTTPS Everywhere adopted website and what I found there did not make me particularly happy.
Scan for yourselves here: http://cyh.herokuapp.com/cyh  (online https and http security header scanner)

Also see loads and loads of sites where the log-in info go in plain txt over the wires. 

Browser developers in the first place should work on the client side,
not decide what should be on the server side, allthough they have a right to alert,
when and where something is going wrong.

Here a little background info and where the quote was taken from:
http://cryto.net/~joepie91/blog/2015/05/01/on-mozillas-forced-ssl/
link article  author = Joepie91.
And here a word from some-one that promotes the transition: http://moz.com/blog/seo-tips-https-ssl
link article author =  Cyrus Shepard

polonus

[Para-Noid]

“We Need Your Support” Nepal Earthquake 419 Spam

https://blog.malwarebytes.org/fraud-scam/2015/05/we-need-your-support-nepal-earthquake-419-spam/?utm_source=Gplus&utm_medium=social

There is always some idiot trying to prey on those with big hearts.
I have an idea on what to do with them...but it's illegal in the USA.

[polonus]

Google Password Alert for the second time bypassed: http://arstechnica.com/security/2015/04/30/behold-the-drop-dead-simply-exploit-that-nukes-googles-password-alert/
Advice: Do not use any Password Managers.

polonus

[essexboy]

Definitely time to leave Chrome for something more secure