SECURITY WARNINGS & Notices - Please post them here

[ehmen]

For most people life is to short to read every EULA and that is what most companies hope for.

Speaking of which

[polonus]

Hundreds of pr0n-sites source of malicious ads: https://blog.malwarebytes.org/malvertising-2/2015/12/large-number-of-adult-sites-distribute-malware-via-adxpansion-malvertising/

polonus

[Lisandro]

Hundreds of pr0n-sites source of malicious ads: https://blog.malwarebytes.org/malvertising-2/2015/12/large-number-of-adult-sites-distribute-malware-via-adxpansion-malvertising/

polonus

Polonus, do you have any info about this kind of malware that could be converted into a blog article?

[polonus]

Hi Lisandro,

When it goes into a blog article warn about the nature of the adxpansion threat e.g. explicit adult content.
This is not suitable info for minors!
Besides this has been all over the news at MBAM forum and other places,
so what would be the additional avast blog content value?
But here then is the story in a nutshell and understandable for a greater user base.
It all comes down to cybercriminal fraudulent adxpansion abuse.
Read here: https://www.mywot.com/en/scorecard/adxpansion.com?utm_source=addon&utm_content=popup
This is classified as a 34% high risk site. The malicious manipulation of the ads is not done by the parties that buy ads, but by third parties that manipulate.
We see high risk vulnerabilities here. It is a known Flash ad/exploit attack scheme as this technique simply relies on a disguised Flash advert that downloads its own exploit and payload. The traffic for ads it seeks to malcreate runs in the millions of clicks...  So disabling or uninstall Flash or enable it on demand only could help protect.
Like DirectRev Malvertising this Uses Self Sufficient Flash 0Day.
The ad is booby-trapped such that it silently loads an external URL
and that is not a direct no-no in unethical ad-serving for the adlaunching industry, so can be abused easily.
See observed sub-domains: https://www.virustotal.com/nl/domain/adxpansion.com/information/

This site for instance that was used in the hack was earlier hacked and compromised, so found to be vulnerable
-malenkiyprince dot ru
re: -http://malenkiyprince.otel-v-krimu.ru/aan.txt

The Flash exploit used was described here: http://malware.dontneedcoffee.com/2015/10/cve-2015-7645.html

Here it was not detected and this should be so under normal instances: http://www.stwhisper.com/www.malenkiyprince.ru

More on this malcode  issue here: http://avpclub.alone.tw/discuz/redirect.php?tid=53748&goto=lastpost

So now you see how devious this is and why an adult user should never go on to the Internet without a decent adblocker and an good script blocker,

polonus (volunteer website security analyst and website error-hunter)

[Para-Noid]

“INTUIT Security Warning” Emails Lead to Fake Browser Update Malware

https://blog.malwarebytes.org/security-threat/2015/12/intuit-security-warning-emails-lead-to-fake-browser-update-malware/?utm_source=Gplus&utm_medium=social

[Staticguy]

Adobe Flash Player Update: Say Hello to New 'Adobe Animate CC

http://www.latinpost.com/articles/99836/20151204/adobe-flash-player-update-hello-new-animate-cc.htm

[polonus]

Kicking in an open door here: http://www.darkreading.com/vulnerabilities---threats/the-programming-languages-that-spawn-the-most-software-vulnerabilities/d/d-id/1323397?
PHP, ASP Web scripting languages breed more vulnerabilities than Java, .NET programming platforms, Veracode's new state of software security report says.
And it still is very much the truth: Chris Wysopal: "When I see a breach, one of the things that sticks out in my head is 'I'll bet that was a PHP site.'"

polonus (volunteer website security analyst and website error-hunter)

[Para-Noid]

Steer Clear of Movie Spam Subreddits

https://blog.malwarebytes.org/online-security/2015/12/steer-clear-of-movie-spam-subreddits/?utm_source=Gplus&utm_medium=social

[Asyn]

OpenSSL Security Advisory [3 Dec 2015]
http://openssl.org/news/secadv/20151203.txt

[polonus]

Malvertising returns to DailyMotion again: https://blog.malwarebytes.org/malvertising-2/2015/12/malvertising-hits-dailymotion-serves-up-angler-ek/
The fake traffic schemes that are rotting your Internet: http://www.bloomberg.com/features/2015-click-fraud/

pol

[polonus]

Spy-malware researchers life became threatened by malcreant(s): https://citizenlab.org/2015/12/packrat-report/

polonus

[REDACTED]

Found this just wo days old Malwarebytes blogpost about Dailymotion malvertising: https://blog.malwarebytes.org/malvertising-2/2015/12/malvertising-hits-dailymotion-serves-up-angler-ek/

Hope that adblockers are enough to protect casual users from these kind of things.

[polonus]

Hi Pernaman,

On the other hand the leaking of private data goes on for instance Dutch medical websites and Dutch hospital websites. These sites will leak user health information to commercial third parties. Data-services like AddThis and ShareThis are known to create such user tracking profiles for visitor webhistory, search queries, etc. Trackers were only removed after Dutch TV journalists had asked questions. So a decent adtrack-blocker is a tool we cannot go without for our own good...

polonus

[polonus]

The Independent WP Blog (was) spreading Ransomware malware: http://blog.trendmicro.com/trendlabs-security-intelligence/blog-of-news-site-the-independent-hacked-leads-to-teslacrypto-ransomware/

polonus

[Asyn]

Microsoft Security Bulletin Summary for December 2015
https://technet.microsoft.com/en-us/library/security/ms15-dec.aspx