SECURITY WARNINGS & Notices - Please post them here

[Asyn]

New zero-day exploit for Log4j Java library is an enterprise nightmare
https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/
https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html
https://www.lunasec.io/docs/blog/log4j-zero-day/

It's already been patched.
As always, you need to update to be safe.
Update - Update - Update

Researchers release 'vaccine' for critical Log4Shell vulnerability
https://www.bleepingcomputer.com/news/security/researchers-release-vaccine-for-critical-log4shell-vulnerability/
http://github.com/Cybereason/Logout4Shell

Hackers start pushing malware in worldwide Log4Shell attacks
https://www.bleepingcomputer.com/news/security/hackers-start-pushing-malware-in-worldwide-log4shell-attacks/

Most infections can be directly attributed to neglect.
They neglected to update the system with the latest available security patches and the system got hacked.
No different here.

Log4j: List of vulnerable products and vendor advisories
https://www.bleepingcomputer.com/news/security/log4j-list-of-vulnerable-products-and-vendor-advisories/

[polonus]

Almost complete blocklist provided:
https://blog.fox-it.com/2021/12/12/log4shell-reconnaissance-and-post-exploitation-network-detection/

Warning various mutations seen in the wild: https://threatpost.com/apache-log4j-log4shell-mutations/176962/

polonus

[Asyn]

Beware of a New Amazon Token Crypto Scam
https://blog.avast.com/beware-of-a-new-amazon-token-crypto-scam

[bob3160]

Beware of a New Amazon Token Crypto Scam
https://blog.avast.com/beware-of-a-new-amazon-token-crypto-scam

12/14/2021 Security News Flash - Amazon Token Crypto Scam

https://youtu.be/us2C3YvMXF0
Look out for offers to purchases nonexistent Amazon Crypto currency Tokens.
Thanks to Jakub Vávra for his excellent article on this topic.
https://blog.avast.com/author/jakub-v%C3%A1vra

[bob3160]

Avast - 2022 Predictions

https://youtu.be/Z9XJjAbbFHQ
Avast's prediction of what the 2022 Cyber security landscape will look like.
Thanks to Grace Macej for her excellent information on this topic.
https://blog.avast.com/author/grace-macej

[bob3160]

In Case you'd like predictions and opinions on next years
cyber security landscape from a variety of experts in the field.
https://blog.emsisoft.com/en/39386/cyber-security-predictions-for-2022-what-the-experts-expect/

[bob3160]

If you're using Gmail and other online service,
be extremely careful.
The SPAM filter isn't working as well as it used to
My inbox has seen way to many emails that are spam
Here's just one sample I just received.

Read the headers. If you aren't exping an email, trash it.
Even better, put it in the spam folder where it belongs.

[bob3160]

12-16-2021 GOOGLE DRIVE WILL BEGIN INFORMING ITS USERS
OF CONTENT VIOLATIONS VIA EMAIL

https://youtu.be/QusvmKD0afY
Here is my take on Google's newest information release about files stored on Google Drive.
Thanks to ChromeUnboxed for their excellent article on this topic.
https://chromeunboxed.com/google-drive-violation-notice/

[DavidR]

12-16-2021 GOOGLE DRIVE WILL BEGIN INFORMING ITS USERS
OF CONTENT VIOLATIONS VIA EMAIL
<snip image>
https://youtu.be/QusvmKD0afY
Here is my take on Google's newest information release about files stored on Google Drive.
Thanks to ChromeUnboxed for their excellent article on this topic.
https://chromeunboxed.com/google-drive-violation-notice/

Interesting - whilst I have never used Google Drive and have no intention of doing so.
In order for Google to identify content violations they must have analytic access to your files.  So the question is do you trust Google not to somehow benefit from rummaging through your data ?

[bob3160]

12-16-2021 GOOGLE DRIVE WILL BEGIN INFORMING ITS USERS
OF CONTENT VIOLATIONS VIA EMAIL
<snip image>
https://youtu.be/QusvmKD0afY
Here is my take on Google's newest information release about files stored on Google Drive.
Thanks to ChromeUnboxed for their excellent article on this topic.
https://chromeunboxed.com/google-drive-violation-notice/

Interesting - whilst I have never used Google Drive and have no intention of doing so.
In order for Google to identify content violations they must have analytic access to your files.  So the question is do you trust Google not to somehow benefit from rummaging through your data ?

No more or less than any other online storage service.
To protect the corporation, they actually need to do this to weed out the stuff that can get Google (Alphabet into hot water.)

[DavidR]

12-16-2021 GOOGLE DRIVE WILL BEGIN INFORMING ITS USERS
OF CONTENT VIOLATIONS VIA EMAIL
<snip image>
https://youtu.be/QusvmKD0afY
Here is my take on Google's newest information release about files stored on Google Drive.
Thanks to ChromeUnboxed for their excellent article on this topic.
https://chromeunboxed.com/google-drive-violation-notice/

Interesting - whilst I have never used Google Drive and have no intention of doing so.
In order for Google to identify content violations they must have analytic access to your files.  So the question is do you trust Google not to somehow benefit from rummaging through your data ?

No more or less than any other online storage service.
To protect the corporation, they actually need to do this to weed out the stuff that can get Google (Alphabet into hot water.)

Which is just one reason why I don't use any on-line storage medium, I also haven't any social networking accounts.

[Asyn]

Lenovo laptops vulnerable to bug allowing admin privileges
https://www.bleepingcomputer.com/news/security/lenovo-laptops-vulnerable-to-bug-allowing-admin-privileges/
https://research.nccgroup.com/2021/12/15/technical-advisory-lenovo-imcontroller-local-privilege-escalation-cve-2021-3922-cve-2021-3969/

[DavidR]

Lenovo laptops vulnerable to bug allowing admin privileges
https://www.bleepingcomputer.com/news/security/lenovo-laptops-vulnerable-to-bug-allowing-admin-privileges/
https://research.nccgroup.com/2021/12/15/technical-advisory-lenovo-imcontroller-local-privilege-escalation-cve-2021-3922-cve-2021-3969/

Lenovo again, can anyone remember a long time again when Lenovo products had a chip that had been hacked, a bug in it that could deliver malware  ?

[bob3160]

Weekly Security News Roundup w/e 12-17-2021

https://youtu.be/AKUHgwwPi3I
Security-related news thanks mostly to Avast Software. I'm just a messenger.
They do most of the challenging work and research. https://www.avast.com/en-us/index#pc

[Asyn]

New zero-day exploit for Log4j Java library is an enterprise nightmare
https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/
https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html
https://www.lunasec.io/docs/blog/log4j-zero-day/

It's already been patched.
As always, you need to update to be safe.
Update - Update - Update

Researchers release 'vaccine' for critical Log4Shell vulnerability
https://www.bleepingcomputer.com/news/security/researchers-release-vaccine-for-critical-log4shell-vulnerability/
http://github.com/Cybereason/Logout4Shell

Hackers start pushing malware in worldwide Log4Shell attacks
https://www.bleepingcomputer.com/news/security/hackers-start-pushing-malware-in-worldwide-log4shell-attacks/

Most infections can be directly attributed to neglect.
They neglected to update the system with the latest available security patches and the system got hacked.
No different here.

Log4j: List of vulnerable products and vendor advisories
https://www.bleepingcomputer.com/news/security/log4j-list-of-vulnerable-products-and-vendor-advisories/

All Log4j, logback bugs we know so far and why you MUST ditch 2.15
https://www.bleepingcomputer.com/news/security/all-log4j-logback-bugs-we-know-so-far-and-why-you-must-ditch-215/