SECURITY WARNINGS & Notices - Please post them here

[polonus]

Insecurity coming, how you gonna flush dns when you have no command prompt nor Power Shell.
Shouldn't this version be taken on hold, because it is too restrictive, and has also the known macro vulnerabilities there.

Re: https://arstechnica.com/information-technology/2017/06/microsoft-should-shore-up-windows-10-ss-security-then-offer-it-to-everyone/

polonus

[REDACTED]

All of a sudden today, Avast is giving me a warning that my webmail account for CenturyTel is not safe - phishing, I think it said. It continues to give me the warning even though I set it in the exceptions. Even when I try to do a reply. Of course, I override it but how can I get it to STOP?

BTW, The verification really sucks - I have enough vision problems as it is and have a super hard time reading the letters and the sound option doesn't work at all.

[Asyn]

1. All of a sudden today, Avast is giving me a warning that my webmail account for CenturyTel is not safe - phishing, I think it said. It continues to give me the warning even though I set it in the exceptions. Even when I try to do a reply. Of course, I override it but how can I get it to STOP?

2. BTW, The verification really sucks - I have enough vision problems as it is and have a super hard time reading the letters and the sound option doesn't work at all.

1. Start a new topic: https://forum.avast.com/index.php?action=post;board=4
2. Only needed for your first 3 posts. (Spam protection)

[polonus]

Again a Windows Defender emulator hole found up with a fuzzer after porting Windows Defender onto linux.

Read here: https://twitter.com/taviso/status/878314575149506561
https://bugs.chromium.org/p/project-zero/issues/detail?id=1282&desc=2

Will Kaspersky's start to moan again, while Tavis Ormandy makes that Windows Defender gets more secure all the time?

polonus

[Eddy]

11% increase in ransomware within a year

https://securelist.com/ksn-report-ransomware-in-2016-2017/78824/

[DavidR]

11% increase in ransomware within a year

https://securelist.com/ksn-report-ransomware-in-2016-2017/78824/

My only surprise would be 'only an 11% increase' in a year. It seems to have been massive recently.

[bob3160]

11% increase in ransomware within a year

https://securelist.com/ksn-report-ransomware-in-2016-2017/78824/

My only surprise would be 'only an 11% increase' in a year. It seems to have been massive recently.

Not if you used Avast:
https://blog.avast.com/avast-and-avg-only-free-antivirus-score-100-av-comparatives-real-world-test

[Eddy]

Doesn't matter what you use(d), there still is a 11% increase in (new) ransomware.
It is not about how many things are blocked, but detected.

[bob3160]

Massive Petya Ransomware Attack (GoldenEye)

More information here and here

[polonus]

Hi bob3160,

Breaking news here indeed, at a grand scale.

Well someone should finally uphold the American constitution against these NSA spooks, thinking they are above the law, letting this out into cyberspace, now causing global havoc & damage through their EternalBlue zero-day proliferation, also giving Microsoft a bad name. Ransomeware-worms in the making and causing havoc around the globe.

Globally firms are devastated by Peyta in Ukraine and in Russia and now also in the port of Rotterdam, the Netherlands, e.g. Maersk Logistics, http://www.apmterminals.com/500.html?aspxerrorpath=/ -> https://asafaweb.com/Scan?Url=www.apmterminals.com%2F500.html%3Faspxerrorpath%3D  Read: http://www.nnit.com/OfferingsAndArticles/Pages/COWI-Upgrades-its-IT-Security.aspx  (there were threats from cybercriminals). See also: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fwww.apmterminals.com%2F500.html%3Faspxerrorpath%3D%2F

The malware, what they now think is a worm, spreading like wildfire, encrypts the MFT on the hard disk (master file table).

CERT's in all sort of countries now up in arms. Victims have no more than 30 minutes to take their systems off of the grid and shut them down. Thank you, foks, for making this crap possible (ironic mode on).

polonus

P.S. Great avast is out in the trenches against this, keeping a finger on the pulse through the Wifi-Inspector. 39 million servers vulnerable and haven't been patched. Read: https://blog.avast.com/petya-based-ransomware-using-eternalblue-to-infect-computers-around-the-world

Damian

[polonus]

Local Killswitch for Peyta.

Seems there is a killswitch now, creating c:\windows\perfc as the ransomeware checks that file and then stops.
Info credits: Amit Serper. AppLocker-feature to block the execution of "perfc.dat"  should also do the trick according to Kaspersky Lab's.

pol

P.S. For what it is worth: https://www.bleepingcomputer.com/news/security/petya-ransomwares-encryption-defeated-and-password-generator-released/

[Eddy]

https://blog.kaspersky.com/new-ransomware-epidemics/17314/
https://securelist.com/schroedingers-petya/78870/

[Be Secure]

Vaccine, not Killswitch, Found for Petya (NotPetya) Ransomware Outbreak
https://www.bleepingcomputer.com/news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak/

[Asyn]

Microsoft Security Advisory 4033453
Vulnerability in Azure AD Connect Could Allow Elevation of Privilege
https://technet.microsoft.com/library/security/4033453.aspx

[Pondus]

SLocker Mobile Ransomware Starts Mimicking WannaCry
https://blog.trendmicro.com/trendlabs-security-intelligence/slocker-mobile-ransomware-starts-mimicking-wannacry/