SECURITY WARNINGS & Notices - Please post them here

[Pondus]

Yandex acquires software developer Agnitum
http://www.telecompaper.com/news/yandex-acquires-software-developer-agnitum--1117968

[Pondus]

Comodore never die   

A 1980s Commodore PC has controlled this school district's A/C for 30 years
http://www.dailydot.com/technology/commadore-amiga-computer-school-air-conditioning/?fb=ss&prtnr=wired

[bob3160]

Comodore never die   

A 1980s Commodore PC has controlled this school district's A/C for 30 years
http://www.dailydot.com/technology/commadore-amiga-computer-school-air-conditioning/?fb=ss&prtnr=wired

They just don't make things like they used to. I still have a working Commodore Vic 20.

[Para-Noid]

Data Dissonance: Tunecore Breached

https://blog.malwarebytes.org/online-security/2015/12/data-dissonance-tunecore-breached/?utm_source=linkedin&utm_medium=socialIf

Malware Targeting Steam Traders Banks on New Escrow System

https://blog.malwarebytes.org/online-security/2015/12/malware-targeting-steam-traders-banks-on-new-escrow-system/?utm_source=Gplus&utm_medium=social

[Pondus]

Inside Chimera Ransomware – the first ‘doxingware’ in wild
https://blog.malwarebytes.org/intelligence/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/

[abruptum]

Microsoft ends support for .Net Framework 4, 4.5 and 4.5.1

  http://www.ghacks.net/2015/12/10/microsoft-ends-support-for-net-framework-4-4-5-and-4-5-1/

[polonus]

10% of Google chrome users infested with unwanted software: https://googleonlinesecurity.blogspot.nl/2015/12/year-one-progress-in-fight-against.html  link article authors: Moheeb Abu Rajab, Google Security Team.

polonus

[bob3160]

10% of Google chrome users infested with unwanted software: https://googleonlinesecurity.blogspot.nl/2015/12/year-one-progress-in-fight-against.html  link article authors: Moheeb Abu Rajab, Google Security Team.

polonus

Some help for this is Unchecky. More importantly is learning to use the custom install option.

[Asyn]

Vulnerability in Java Deserialization Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization

[ehmen]

Vulnerability in Java Deserialization Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization

Meaning only when JRE is enabled, or even when it's not since there's Java components in Cisco's tools?

[Pondus]

You’re so predictable: the AV vulnerability that bypasses mitigations
http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations

[polonus]

WordPress hoster hacked, data breach, see: https://wpengine.com/support/infosec/

As I said by many occasions WP has a lot of security issues, like oudated versions used, outdated or left plug-ins,
this was found on that site we discuss here: ditty-news-ticker   latest release (2.0.4)
http://dittynewsticker.com/
Not at this site but often for WP sites User Enumeration and Directory Indexing is enabled, a dangerous security misconfiguration!

The hacked website in question also had jQuery libraries that should come retired asap:
Detected libraries:
jquery - 1.8.3 : -https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
jquery-ui-dialog - 1.9.2 : -https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js
Info: Severity: medium
http://bugs.jqueryui.com/ticket/6016
jquery-ui-autocomplete - 1.9.2 : -https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js
jquery-ui-tooltip - 1.9.2 : -https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js
Info: Severity: high
http://bugs.jqueryui.com/ticket/8859
jquery - 1.6.4 : -https://cdn.optimizely.com/js/836340079.js
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
4 vulnerable libraries detected

And that at a hosting website where users go to find security they can trust 

polonus (volunteer website security analyst and website error-hunter)

[Para-Noid]

Avoid this Lloyds Bank Phish Attempt

https://blog.malwarebytes.org/fraud-scam/2015/12/avoid-this-lloyds-bank-phish-attempt/?utm_source=Gplus&utm_medium=social

Spike in Malvertising Attacks Via Nuclear EK Pushes Ransomware

https://blog.malwarebytes.org/malvertising-2/2015/12/spike-in-malvertising-attacks-via-nuclear-ek-pushes-ransomware/?utm_source=gplus&utm_medium=social

[Asyn]

Lenovo Security Advisory: LEN-4326
https://support.lenovo.com/product_security/len_4326

[DavidR]

Lenovo Security Advisory: LEN-4326
https://support.lenovo.com/product_security/len_4326

Wow Lenovo are certainly getting a hammering on security of late.