SECURITY WARNINGS & Notices - Please post them here

[Be Secure]

A Malware Cocktail Shakes Up Cerber Ransomware Infections
http://www.infosecurity-magazine.com/news/a-malware-cocktail-shakes-up/

[Pondus]

Alice: A Lightweight, Compact, No-Nonsense ATM Malware
http://blog.trendmicro.com/trendlabs-security-intelligence/alice-lightweight-compact-no-nonsense-atm-malware/

[bob3160]

Alice: A Lightweight, Compact, No-Nonsense ATM Malware
http://blog.trendmicro.com/trendlabs-security-intelligence/alice-lightweight-compact-no-nonsense-atm-malware/

Now here I thought you were talking about my wife Alice and all the ATM withdrawals she's been making lately

[Pondus]

hmmm, maybe this need further investigation   

[polonus]

Service worker javascript code changes bringing more extensive Google snoopin'to your chrome/newtab?
Read on these recent changes: https://www.reddit.com/r/javascript/comments/3n4cyz/suspicious_service_worker_in_chrome/

Why would they do that?

Maybe we have to consider this also in the light of having to hand over your Google account credentials before entering the USA,
this is the public side of it now: http://www.politico.com/story/2016/12/foreign-travelers-social-media-232930

Soon they also will perform such checks at this side of the Atlantic too, for instance at Amsterdam Schiphol airport in the Netherlands, will be handled by American officials.

Being on social media is not that innocent, folks.
Mind the spooks....

polonus

[Be Secure]

New DeriaLock Ransomware Active on Christmas, Includes An 'Unlock All' Command
https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/
Hope avast is ready......

[polonus]

Protection against malicious Word-macro's using Windows Firewall:

https://limpidwebblog.blogspot.com/2016/10/a-shower-leads-to-powershell-puking.html

PowerShell will come to Windows 10 shortly for the command prompt interpreter.

A bash-shell in beta has also arrivedl:
http://www.howtogeek.com/249966/how-to-install-and-use-the-linux-bash-shell-on-windows-10/

Having been around for years and offering far more is cygwin, with editors, compilers, database clients, etc. You could even choose to install the X server to get an X Windows graphical user interface. In this way you can run graphical Linux: programs:https://www.cygwin.com

All for the anvanced user, but others may try as well.

polonus

[Pondus]

Millions of Websites Vulnerable Due to Security Bug in Popular PHP Script
https://www.bleepingcomputer.com/news/security/millions-of-websites-vulnerable-due-to-security-bug-in-popular-php-script/

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

[polonus]

Hi Pondus beaten me to it by a sec 

N.B. Big zero-day hole in WordPress PHP Mailer: https://www.wordfence.com/blog/2016/12/phpmailer-vulnerability/
Critical Vulnerability in PHPMailer. Affects WP Core [1]

Millions and millions of websites vulnerable.

A critical remote code execution vulnerability in PHPMailer has been discovered by Polish researcher Dawid Golunski. The vulnerability was announced on legalhackers.com yesterday but proof of concept exploit details were not included.

Unfortunately someone posted a proof of concept to exploit-db and to github a few hours ago demonstrating how the vulnerability can be exploited in the PHPMailer library, but not targeting any web application that is in use.

We are publishing this unscheduled update to give PHP developers and our community advance warning of this issue. We expect this story to continue to evolve rapidly as more developers and malicious actors look at this code.

An issue in WP core was opened about 4 hours ago that included a patch to fix this issue. It updates WP core from using PHPMailer 5.2.14 to 5.2.19. This is just a proposed patch, not the final fix.

polonus

[Pondus]

Evolved DNSChanger malware slings evil ads at PCs, hijacks routers

Software nasty is packed with exploits for vulnerabilities in home broadband boxes
http://www.theregister.co.uk/2016/12/20/new_dnschanger_exploit_kit_goes_after_166_types_of_router/

[polonus]

Update...

Since an hour there is a patched update for WP core: https://github.com/PHPMailer/PHPMailer/blob/master/class.phpmailer.php
All are asked to update to version 5.2.19.

polonus

[Be Secure]

KillDisk ransomware demands over $215,000
https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/

[Pondus]

This man's smart television with Google TV caught some malware, and now it's bricked
http://www.androidpolice.com/2016/12/27/smart-mans-smart-television-google-tv-caught-malware-now-bricked/

[DavidR]

This man's smart television with Google TV caught some malware, and now it's bricked
http://www.androidpolice.com/2016/12/27/smart-mans-smart-television-google-tv-caught-malware-now-bricked/

What I have been banging on about Smart TV for some time, pigeons coming home to roost.

I'm waiting for the IoT (Internet of Things) coming down with the same hijack/malware issues. Imagine your fridge locking you out or ordering stuff for itself, fridge light, heater and TV.

[bob3160]

This man's smart television with Google TV caught some malware, and now it's bricked
http://www.androidpolice.com/2016/12/27/smart-mans-smart-television-google-tv-caught-malware-now-bricked/

It has already been un-bricked.
(Read the relies.)