SECURITY WARNINGS & Notices - Please post them here

[Pondus]

Server-based botnet floods net with brutish SSH attacks
http://www.theregister.co.uk/2010/08/12/server_based_botnet/

also see reply #636 / #638

[Asyn]

Details of vulnerabilities in the Palm Pre and Android published
http://www.pcpro.co.uk/news/interviews/360256/q-a-how-we-sliced-open-palm-and-android-security
asyn

[Asyn]

First SMS-sending Android Trojan
http://news.cnet.com/8301-27080_3-20013222-245.html

Also see Reply #629...
asyn

[Pondus]

Call to improve password security
http://www.bbc.co.uk/news/technology-10963967

quote:
The growing use of graphics cards as surrogate supercomputers could spell trouble for users of short passwords

[Chris Thomas]

Stuxnet worm could hijack power plants, refineries

http://news.cnet.com/8301-27080_3-20013545-245.html

[Pondus]

Well.....not security news but found this very important ...    ....statistic concerning smart phone
if you have one you may want to switch brand .....or get one if not 


Sexual Activity by Smart Phone Brand .......
http://blog.okcupid.com/index.php/dont-be-ugly-by-accident/


hmmmm........ i wonder if there is a statistic by antivirus brand.....may have to switch if .......

[YoKenny]

Well.....not security news but found this very important ...    ....statistic concerning smart phone
if you have one you may want to switch brand .....or get one if not 

I don't have a smart phone. 

[Pondus]

Well.....not security news but found this very important ...    ....statistic concerning smart phone
if you have one you may want to switch brand .....or get one if not 

I don't have a smart phone. 

in what end of the statistic does that place you......high or low......

[Hermite15]

don't use Canary (current version, must be 6.0.493) if you got LastPass

updating v8 from 5214 to 5242 causes LastPass SHA256 hashing code to fail

http://code.google.com/p/chromium/issues/detail?id=52096
http://forums.lastpass.com/viewtopic.php?f=14&t=41109&p=151719&sid=aaeed2c35d2af7abb644cee325a6392f

I have no idea if that bug implies a security flaw as well.

[Asyn]

Trivial forwarding attack on NTLMv2 authentication
http://extendedsubset.com/?p=36
http://www.zdnet.com/blog/security/security-flaws-haunt-ntlmv1-2-challenge-response-protocol/7136
http://www.theregister.co.uk/2010/08/12/ntlm_authentication_still_vulnerable/
asyn

[Asyn]

Ruby update closes XSS vulnerability
http://www.ruby-lang.org/en/news/2010/08/16/ruby-1-9-1-p430-is-released/
asyn

[Asyn]

RIM offers Indian government surveillance tools
http://online.wsj.com/article/SB10001424052748703960004575427312899373090.html?mod=WSJEUROPE_hpp_sections_tech
asyn

[Asyn]

ColdFusion vulnerability more critical than first thought
http://h30507.www3.hp.com/t5/Following-the-White-Rabbit-A/Adobe-ColdFusion-s-Directory-Traversal-Disaster/ba-p/81964
http://www.exploit-db.com/exploits/14641/
http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
asyn

[Asyn]

Android game secretly transmits GPS coordinates
http://www.symantec.com/connect/blogs/androidostapsnake-watching-your-every-move
asyn

[Asyn]

The Facebook dislike button scam
http://www.h-online.com/security/news/item/The-Facebook-dislike-button-scam-1060712.html
asyn