Author Topic: SECURITY WARNINGS & Notices - Please post them here  (Read 2904950 times)

0 Members and 8 Guests are viewing this topic.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89132
  • No support PMs thanks
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5415 on: August 15, 2017, 01:27:14 AM »
Browser Extensions Are a Privacy Nightmare: Stop Using So Many of Them

https://www.howtogeek.com/188346/why-browser-extensions-can-be-dangerous-and-how-to-protect-yourself/


Very interesting if your image is one that and the wording on the bottom of it has been created by Avast.

Whilst your image isn't related to a browser App, but Android Mobile App.

Then Avast should look close to home, namely the Avast battery Saver App for Android. Some time ago I was going to install this, but when I looked at the Permissions it required, I backed out of the Play Store.  For me the permissions were excessive for what was a battery saver app, they wanted access to very many areas I felt it had no reasonable need to. 

Hell the only thing not asked for was my inside leg measurement.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48597
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5416 on: August 15, 2017, 01:25:47 PM »
Browser Extensions Are a Privacy Nightmare: Stop Using So Many of Them

https://www.howtogeek.com/188346/why-browser-extensions-can-be-dangerous-and-how-to-protect-yourself/


Very interesting if your image is one that and the wording on the bottom of it has been created by Avast.

Whilst your image isn't related to a browser App, but Android Mobile App.

Then Avast should look close to home, namely the Avast battery Saver App for Android. Some time ago I was going to install this, but when I looked at the Permissions it required, I backed out of the Play Store.  For me the permissions were excessive for what was a battery saver app, they wanted access to very many areas I felt it had no reasonable need to. 

Hell the only thing not asked for was my inside leg measurement.
The words on the bottom are mine and this indeed is a caution about installing Apps.
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v24H2 64bit, 32 Gig Ram, 1TB SSD, Avast Free 24.4.6112, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5417 on: August 16, 2017, 12:35:51 PM »
8 Google chrome extensions hacked to spread adware:
https://www.proofpoint.com/us/threat-insight/post/threat-actor-goes-chrome-extension-hijacking-spree

Extension published by a bad actor after the legitimate extension was compromised....
With Google chrome extensions now coming to every major browser (firefox etc.)
his new browser extension mono-culture makes it much easier for attackers,
and less secure for end-users.
Programmers falling for an insecure link to click, not an unsavvy end-user or a computer nitwit... :o
Where for Pete's sake we are heading seen to browser security?
I, polonus, my dear friends, I fear here with great fear  :-X :'(

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5418 on: August 16, 2017, 01:13:19 PM »
Ransomeware targeting WordPress sites: https://www.wordfence.com/blog/2017/08/ransomware-wordpress/

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37548
  • Not a avast user

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37548
  • Not a avast user
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5420 on: August 16, 2017, 04:09:07 PM »
The Crisis of Connected Cars: When Vulnerabilities Affect the CAN Standard
http://blog.trendmicro.com/trendlabs-security-intelligence/connected-car-hack/


Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5421 on: August 17, 2017, 11:32:09 AM »
Hundreds of adware infested android-apps in Google Play,
one hundred or so of these adware-laden apps still were not been taken down by Google.

More and more the Google Chrome Android Mono-Culture is becoming a privacy and adware nightmare for end-users,
as the Google chrome browser mono-culture is becoming a likewise threat.

Less and less alternative paths open for those that want to evade these intrusions.  :'( :-[
Even firefox has thrown the towel to further the Google extension api everywhere.
More attack surface means less defense and bigger threats to the sheeple!!!!

Re: http://blog.trendmicro.com/trendlabs-security-intelligence/ghostclicker-adware-is-a-phantomlike-android-click-fraud/

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76035
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5422 on: August 18, 2017, 11:28:38 AM »
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37548
  • Not a avast user

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76035
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5424 on: August 20, 2017, 10:46:31 AM »
Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-004
https://www.drupal.org/SA-CORE-2017-004
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5425 on: August 23, 2017, 11:08:36 AM »
500 adridden apps removed by Google from the webstore:
http://www.express.co.uk/life-style/science-technology/818772/Android-warning-Google-Play-adware

Read about the development: https://blog.lookout.com/igexin-malicious-sdk
Mainland China testbed for ad- and spyware for developers and surveillance alike.

Do not read here, as it comes ad-ridden by itslef, block link: htxp://www.express.co.uk/life-style/science-technology/818772/Android-warning-Google-Play-adware
Link found in: https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-social/hosts (uBlock O).

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5426 on: August 24, 2017, 11:56:49 AM »
List of programs to stay away from or be specially cautious with,
because firm pays to compromise them through zero-days:


hxtps:%2F%2Fzerodium.com%2Fprogram.html&originalURL=973370001&pip=false&premium=false&client_uid=1241509284&client_ver=4.0.6.149&client_type=IEPlugin&suite=false&aff_id=662-187&locale=nl_nl&ui=1&os_ver=6.3.0.0
(link broken by me, as it could be risky for the non-savvy).

Firm is buying zero-days on chat-apps like Signal, WhatsApp, WeChat, Telegram, Facebook Messenger and Viber.

Amazing there are states in the world where such security-endangering trade of zero-days can be performed within legal bounds. :o

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5427 on: August 25, 2017, 11:49:37 AM »
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5428 on: August 27, 2017, 09:39:11 PM »
Cannot it be made really and one-way secure? HTTP public key pinning, they giving up on HPKP:
Read on backgrounds:
https://www.theregister.co.uk/2017/08/25/hpkp_crypto_criticism/  (link author = John Leyden)

Because of the complexity and feared attacks like: https://scotthelme.co.uk/using-security-features-to-do-bad-things/
Trust chains must be unbroken, no certs should be issued in error ever,  some to trust https://certificatechain.io/
and do not forget to check the code is correct. Cert should be in your DNSSEC authenticated DNS records.

It could come to it that we could also drop most of the root CAs from browsers
or at least devalue them to orange padlocks or something, until explicitly trusted. DANE will come coded into the browser
Chrome and firefox). Time to change to DNSSEC, but a lot of banks haven't yet changed... (info source from comments to article)

pol

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Re: SECURITY WARNINGS & Notices - Please post them here
« Reply #5429 on: August 30, 2017, 10:01:48 PM »
L.S.

Trying to get the 0-ring on chips sort of tinkerproof by disabling Intel Management Engine via a new method.

Probably the availability of this bit can only mean NSA requires a possibility to de-install this attack-vector to just use it for themselves. Also consider for instance the new byte by byte load- & tinkerproof Google Titan chip.

Intel and AMD are getting at your data big time, NSA as well as we know by now from the backdoors.
In this case NSA's High Assurance Platform, a NSA trusted platform
(the bit found by researchers in the code was named "reserve_hap")
One thinks it was designed to prevent so-called "side-leaks".

OpenSSL now proven to be crappy and it took Heartbleed to become aware of the real insecure overall 'borked' situation.

So as the going is getting increasingly narrow by using undocumented unsupported features ,
there is need for open software alternatives, to see that resource engineering
is not exclusively meantfor big goverment and big business.

Intel AMT handling now looks weird, just AMT being abused to create a worm of sorts,
and WannaCry in comparison would have been a picknick.

Open source CPU, the Chinese will facilitate (but not in the Lenovo way please). Like this: https://www.forbes.com/sites/rogerkay/2015/03/20/openpower-unlocks-floodgates-for-an-all-chinese-server-business/
POWER9CPU does not cost that much, but the maiboard is very very expensive (because of the low minimal production volumes)  8)

Another name to mention in this context: http://www.lowrisc.org

polonus (volunteer website security analyst and website error-hunter)
« Last Edit: August 31, 2017, 12:33:43 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!