Author Topic: SECURITY WARNINGS & Notices - Please post them here (Read 2623574 times)

polonus · « **Reply #5760 on:** October 17, 2018, 06:58:01 PM »

Popular CMS will still accept older PHP versions. T0-day Drupal will run with PHP 5.5.9. Joomla demands at least PHP 5.3 and WordPress still will accept PHP 5.2.4.

Always be aware for PHP vulnerabities like this authentication bypass - http://yaisb.blogspot.com/2006/08/authentication-bypass_07.html * could reapear encrypted

Quote

Code: [Select]
<script>  </script> translating to
Code: [Select]
//document.write (s) <? if(!isset($_SESSION['session']["privLvl"])) { header("Location: login.php"); exit(); } echo "BIG SECRET!"; ?>

code source credits go to: RYAN *

polonus

Be Secure · « **Reply #5761 on:** October 22, 2018, 10:47:43 AM »

Kraken Cryptor Ransomware Connecting to BleepingComputer During Encryption
https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-connecting-to-bleepingcomputer-during-encryption/

Be Secure · « **Reply #5762 on:** October 22, 2018, 10:49:20 AM »

Remote Code Execution Flaws Found in Popular OS Powering Embedded Systems
https://www.bleepingcomputer.com/news/security/remote-code-execution-flaws-found-in-popular-os-powering-embedded-systems/

REDACTED · « **Reply #5763 on:** October 25, 2018, 04:06:32 PM »

Every time I create a web account I create a new email address which is forwarded to my real email address. I never use that email address for anything else. That way, if I get emails to that address that I should not, I know site is marketing my address or that they have been hacked.

I just received an email from a hacker warning of dire consequences if I don't pay big time. (I know it is not true but just a scam.) However the scam email was sent to an email address which has never been used for anything except to logon to this site. I have not used it for several years (until the scammer used it today.) My domain is one they would not likely try (it's something like ky7620z.com.) It is not very comforting that an antimalware site has been hacked like that.)

I have deleted the forwarder so the email address no longer exists. Avast needs to be more careful to protect its customers.

bob3160 · « **Reply #5764 on:** October 25, 2018, 04:14:39 PM »

Quote from: Ev Jon on October 25, 2018, 04:06:32 PM

Every time I create a web account I create a new email address which is forwarded to my real email address. I never use that email address for anything else. That way, if I get emails to that address that I should not, I know site is marketing my address or that they have been hacked.

I just received an email from a hacker warning of dire consequences if I don't pay big time. (I know it is not true but just a scam.) However the scam email was sent to an email address which has never been used for anything except to logon to this site. I have not used it for several years (until the scammer used it today.) My domain is one they would not likely try (it's something like ky7620z.com.) It is not very comforting that an antimalware site has been hacked like that.)

I have deleted the forwarder so the email address no longer exists. Avast needs to be more careful to protect its customers.

Avast wasn't hacked. This forum was some years back - https://www.grahamcluley.com/avast-forum-hacked/

CraigB · « **Reply #5765 on:** October 25, 2018, 05:11:54 PM »

Quote from: Ev Jon on October 25, 2018, 04:06:32 PM

Every time I create a web account I create a new email address which is forwarded to my real email address. I never use that email address for anything else. That way, if I get emails to that address that I should not, I know site is marketing my address or that they have been hacked.

I just received an email from a hacker warning of dire consequences if I don't pay big time. (I know it is not true but just a scam.) However the scam email was sent to an email address which has never been used for anything except to logon to this site. I have not used it for several years (until the scammer used it today.) My domain is one they would not likely try (it's something like ky7620z.com.) It is not very comforting that an antimalware site has been hacked like that.)

I have deleted the forwarder so the email address no longer exists. Avast needs to be more careful to protect its customers.

The email scam you're describing sounds like the one that did the rounds not long ago, some guy reckons he's recorded you watching porn and has collected all your contacts and if you don't pay the ransom he'll forward the video to all your friends yada yada yada

I also got the same scam email which was an old email used for this forum 4 years ago, Avast did change their registration process after that hack to further prevent it happening again.

Unfortunately these forum hacks are happening more and more often, Malwarebytes was struck somewhere back around the same time as Avast, Adguard was hit only a few weeks ago also and just about all emails were pawned.

It's crazy how many Government offices and other businesses have been hit recently, sadly it's only going to get worse