SECURITY WARNINGS & Notices - Please post them here

[Pondus]

https://theintercept.com/2017/04/14/leaked-nsa-malware-threatens-windows-users-around-the-world/

NSA's exploit tools are out  in the open.Leaked by shadowbrokers hacker group.

What if NSA have leaked this on purpose, that would be a neat trick

And they now log info from lots of bad guys / goverments .... hmmm   

[TrueIndian]

This is essentially a big archive of exploits and dirty programs. ODDJOB, ZIPPYBEER, and ESTEEMAUDIT, capable of breaking into — and in some cases seizing control of — computers running version of the Windows operating system.

FUZZBUNCH is the crown jewel here it is used by NSA to deploy any exploit in their arsenal.Here is a screenshot of the exploits from fuzbunch that can be used.

[polonus]

Hi True Indian,

NSA is trying to turn the tables on the Internet, turning it into a panopticon of sorts.

Even tor source developers are being asked to cooperate just so to allow NSA to get access to meta-data and mail-content
(recently for example with German tor-developer, Hahn).

There will always be some Judas, that will sell his internet soul for a "proverbial thirty silverlings", just to follow the Easter Story.

NSA divides users in two categories. Those users that can be brought easily under mass surveillance without further ado. They fall victim to normal dragnet procedures.

And a second category of users that knows how to protect themselves and their privacy. This latter category will directly come under scruteny by such services (users that use tor and tails for instance or visit here: https://www.resetthenet.org/ ).

Protection for that second category of end-users will become harder and harder (recently with plans to use one and the same browser engine for all major browser flaws (Edge, firefox and Google's chrome) and so a one mono-culture of extension-api for them all). It is a pity not all Internet users are aware of this insecure status "by design" of the Internet as we have it now.  From an information exchange medium it was slowly turned into a 'grab more of that money' machine.

The average user just thinks, when it all functions, it is OK. Then in a ,lot of cases he, she or it may be completely wrong.

polonus

[polonus]

According to Microsoft most of these NSA exploits were being patched: https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/

Four exploits were not being patched until one month ago.

For users of Windows XP, Server 2003 and Vista this is a completely different story, they run risks even with EnglishmanDentist, EsteemAudit en ExplodingCan and all other unpatched exploits.

Remember, that running surveillance exploits against the general public has beenan  ongoing practice since 2001.
Targeted attacks cannot even be evaluated (watering place attaks etc.).

polonus

[TrueIndian]

Its a mystery as to how MS patched these vulnerabilities a month ago before this was even leaked. 

[bob3160]

Not really a mystery if it was leaked to them first.

[TrueIndian]

Not really a mystery if it was leaked to them first.

MS has not given any statement on the above yet or they just don't want to!

There are no acknowledgements for MS17-10 which patched most of the big bugs from the ShadowBrokers drop.

According to Mr.Snowden,he doesn't believe that this is all NSA has and he says there are more unknown exploits like these that NSA never bothers to reveal but instead use it to spy.

[Pondus]

Oracle patches Solaris 10 hole exploited by NSA spyware tool – and 298 other security bugs
http://www.theregister.co.uk/2017/04/19/oracle_april_security_patches_nsa/

[Pondus]

That apple.com link you clicked on? Yeah, it's actually Russian
http://www.theregister.co.uk/2017/04/18/homograph_attack_again/

[Pondus]

'Nobody's got to use the internet,' argues idiot congressman in row over ISP privacy rules
https://www.theregister.co.uk/2017/04/17/sensenbrenner_blunder_after_privacy_criticism/

[polonus]

120.000 Drupal-websites exploitable by hole in module with left code: https://www.drupal.org/project/usage/references
Drupal is now seen waiting for a new maintainer

2017-04-14 - A potential new maintainer is working through the process of fixing the References module. When this is complete a new release will be published and this SA will be updated

Unsuported modules is not the way to go forward, guys 

polonus

[polonus]

100.000 servers infested with 'leaked' NSA government malware: http://blog.binaryedge.io/2017/04/21/doublepulsar/

Especially where older Windows servers are being used globally, these risk have not been mitigated (Windows 2006 server foir instance) and the NSA exploit holes haven't been patched. In the Netherlands a 1300 servers showed to have been affected.

Normally NSA should remove the malware and all traces of it, but sometimes the spooks get sloppy and do not abide by their own stringent rules. So eventually their schemes are detected and some can take counter-measures.

Good for law-abiding citizens that should be left alone.

polonus

[Pondus]

Related to Chrome / Opera / Firefox

Phishing with Unicode Domains  >>  https://www.xudongz.com/blog/2017/idn-phishing/

IDN in Google Chrome  >>  https://www.chromium.org/developers/design-documents/idn-in-google-chrome


IDN homograph attack > https://en.wikipedia.org/wiki/IDN_homograph_attack
Punycode > https://en.wikipedia.org/wiki/Punycode

[Pondus]

Homeland Security warns of 'BrickerBot' malware that destroys unsecured internet-connected devices
http://www.zdnet.com/article/homeland-security-warns-of-brickerbot-malware-that-destroys-unsecured-internet-connected-devices/

[Pondus]

No more IP addresses for countries that shut down internet access
https://www.theregister.co.uk/2017/04/12/no_ip_addresses_for_countries/