SECURITY WARNINGS & Notices - Please post them here

[Pondus]

Data is the ‘New Oil' and Everyone Needs to know what they're Leaking
https://www.f-secure.com/en/web/press_global/news-clippings/-/journal_content/56/1075444/1863508?p_p_auth=n5Aruqhu

[Asyn]

Content Injection Vulnerability in WordPress
https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html

[mchain]

https://blog.avast.com/avast-releases-three-more-decryption-tools-for-ransomware-victims
Appears melding of avast and avg together is now coming to fruition as we are now seeing anti-malware tools avast has not had before?

[DavidR]

https://blog.avast.com/avast-releases-three-more-decryption-tools-for-ransomware-victims
Appears melding of avast and avg together is now coming to fruition as we are now seeing anti-malware tools avast has not had before?

They were already on those decryption tools before the merge. To the same end they were trying to improve the ransomeware detections But anything is welcome.

[Asyn]

Microsoft Windows SMB Tree Connect Response memory corruption vulnerability
http://www.kb.cert.org/vuls/id/867968

[Be Secure]

Locky Ransomware, Kovter Click-Fraud Malware Spreading in Same Campaigns
https://threatpost.com/locky-ransomware-kovter-click-fraud-malware-spreading-in-same-campaigns/123560/

[polonus]

Questioning the validity of AV-test results: http://robert.ocallahan.org/2017/01/a-followup-about-av-test-reports.html

polonus

[bob3160]

Questioning the validity of AV-test results: http://robert.ocallahan.org/2017/01/a-followup-about-av-test-reports.html

polonus

Articles like that are a way to instantly gain attention and "fame".

[polonus]

@bob3160,

We two know better, don't we?

Obvious from what Robert O'Callahan states, is that he does not know how AV-Comparatives is testing.

Consider the small detection window and time-frame (under 20 minutes) often provided for them for the various lauch-points of malware, that makes his story sound not completely based on live theater experience. Besides AV-Comparatives is a fully independant institute and authortities make sure their research cannot be influenced by third party interests either benign nor criminal (TÜV oversight).

In an ever changing malware landscape, that is what you get. I.m.o. this blogger does not know what he is on about.
According to me he never was related to the security industry etc. His 5 minutes of fame against those that are in the know.

Damian

[Pondus]

Russian spy purge after suspected leaks to U.S. intelligence
http://money.cnn.com/2017/02/01/news/fsb-kaspersky-arrests/index.html



=============================================================
Russian security teams also arrested an employee of Russian internet security firm Kaspersky Lab. Ruslan Stoyanov was the head of the company's computer incidents investigation team, where he oversaw hacking investigations.
In a statement, Kaspersky said he was under investigation "for a period predating his employment at Kaspersky Lab." He had joined the company in July 2012, according to his LinkedIn profile. Kaspersky also insisted it has "no political ties to any government."
==============================================================

Hmmmm ..... not sure i trust Kaspersky

[polonus]

Now that both Net Neutrality and Privacy are dead in the water, read this interesting link how the profiling of Internet users could be used in data-driven communication. There is a lot of subtle psychology involved and it can be set to work via the hidden hand of our social media data manipulation, like facebook, whatsapp and the like.

Read: https://motherboard.vice.com/en_us/article/how-our-likes-helped-trump-win

polonus

[bob3160]

Now that both Net Neutrality and Privacy are dead in the water, read this interesting link how the profiling of Internet users could be used in data-driven communication. There is a lot of subtle psychology involved and it can be set to work via the hidden hand of our social media data manipulation, like facebook, whatsapp and the like.

Read: https://motherboard.vice.com/en_us/article/how-our-likes-helped-trump-win

polonus

Privacy has been dead for a very long time. You were just pretending to hide.....

[polonus]

Hi bob3160,

Yes and Google can be ordered to turn all of your data over to the FBI or other three-letter services for that matter, read here: http://www.reuters.com/article/us-google-usa-warrant-idUSKBN15J0ON  and what of the iCloud when those experts that should protect your data or back-up versions aren't those super experts they always pretend to be and carriers and cloud-services only take responsibility for carrying and transporting and not against a hack or a data-breach of your data in the Cloud?

As you always say. Do not share with Interwebs what you do not like to share with everyone.
Privacy and integrety is a non-existent animal....

You are rather naive when you think your pizzaweb google forms are still yours only....
but the simpletons among us do not care until it is too late.

polonus

[bob3160]

It's time to realize, it's already too late. 

[polonus]

Polish banking industry takes a serious malware hit by javascript injection from the Polish Banking Regulator (KNF),
see: https://badcyber.com/several-polish-banks-hacked-information-stolen-by-unknown-attackers/
the present situation is being monitored: https://www.youtube.com/watch?v=0OrmAhpBhoY  (po polsku)

For our Polish users that have bank accounts there 'w kraju'.
Warto na temat spojrzeć szerzej i dostrzec pewien schemat:
https://zaufanatrzeciastrona.pl/post/czeski-msz-porzadnie-zhakowany-polski-msz-sobie-z-atakiem-rosjan-poradzil/
and
http://www.pandasecurity.com/mediacenter/pandalabs/dangerous-malware-neutralized/

polonus (volunteer website security analyst and website error-hunter)