SECURITY WARNINGS & Notices - Please post them here

[CharleyO]

***

Fake Anti-Virus, Social Network Scams On The Rise

... researchers found that the rising tide of fake anti-virus during the first half of 2011 includes a new variant consisting of fake desktop utilities, propelled by SpyEye and Zeus Trojan spam.

... the report found that security threats from social media continue to rise as social networking sites such as Facebook and Twitter are increasingly used in the workplace.
... rogue apps that impersonate online games in order to distribute malware.

... mobile security threats for the Android platform experienced a big upward spike, proliferated with the growth of the Android Market.

http://www.crn.com/news/security/231600446/fake-anti-virus-social-network-scams-on-the-rise-report.htm;jsessionid=Im5cs88mTXd-5XWl+mtdZQ**.ecappj02?cid=nl_sec


***

[CharleyO]

***

Apple Gives Internship To JailbreakMe Creator

Sometimes, if you can’t beat them, employ them. Nicholas Allegra, a 19-year-old hacker and creator of the Jailbreakme.com site, responsible for a series of jaibreaking iOS hacks, has officially been hired as an intern at Apple

http://www.crn.com/news/security/231600297/apple-gives-internship-to-jailbreakme-creator-comex.htm?cid=nl_sec


***

[CharleyO]

***

Xpaj Botnet Intercepts 87 Million Web Searches In Click-Fraud Scheme

... researchers said Friday they recently uncovered the file-infector W32.Xpaj.B botnet, also known simply as Xpaj, by digging up command and control servers containing encrypted binary data, encryption keys, databases and Web applications used in conjunction with a widespread click-fraud scheme over the last several months.

http://www.crn.com/news/security/231600289/xpaj-botnet-intercepts-87-million-web-searches-in-click-fraud-scheme.htm?cid=nl_sec


***

[CharleyO]

***

Skype Cross-Site Scripting Flaw Enables Phone Session Attacks

A gaping cross-site scripting flaw in the latest version of Skype enables attackers to inject malicious code into a user’s phone sessions.
The cross-site scripting vulnerability occurs in Skype 5.5.1.113, affecting Windows XP, Vista and 7, and stems from a persistent code injection vulnerability due to a validation input error that prevents the VoIP client from properly inspecting phone numbers sourced from users’ home, office and mobile Skype accounts, according to researcher Levent Kayan.
 

http://www.crn.com/news/security/231600218/skype-cross-site-scripting-flaw-enables-phone-session-attacks.htm?cid=nl_sec


***

[Asyn]

Fraudulent certificate triggers blocking from software companies
https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google
http://www.microsoft.com/technet/security/advisory/2607712.mspx
http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/
http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert
http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html

Fake Google certificate is the result of a hack
http://www.h-online.com/open/news/item/Fake-Google-certificate-is-the-result-of-a-hack-1333728.html
http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx

More Info
http://www.h-online.com/security/news/item/Updated-Chrome-and-Firefox-for-fraudulent-Google-certificate-available-1333898.html
http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2
http://www.f-secure.com/weblog/archives/00002228.html
http://nakedsecurity.sophos.com/2011/08/31/google-blacklists-247-certificates-is-it-related-to-diginotar-hacking-incident

[mchain]

Et al,

Just thought I'd post this for other users and viewers to peruse at their leisure.

See:  http://news.cnet.com/8301-27080_3-20099421-245/google-users-in-iran-targeted-in-ssl-spoof/?tag=contentMain;contentBody
 
re: Spoofed and Invalid CA certificates.

I come here every week or so to see what is out there as far as malware trends are going.  Looks like the latest and greatest (sadly) is the one currently known as 'Enhanced Protection Virus'.  I wish Essexboy all the best in finding a successful resolution for the two users whom currently have this rogue program on their machines.

If we have known spoofed CA's, then is this not a part of the problem with Google Re-direct, since we don't really know for sure where the browser is ending up at?   

Note, too, the link provided for the program called 'Covergence', at the bottom of the blog, which is said to analyze for certificate revocations, that does not work on my machine.  When the add-on is run in FF 6.0, it says it is not compatible. 

As always, I run my browser in a sandbox to test before installing anything like this.  Could this affect proper operation?  Why would it say 'incompatible' if it is supposed to run on FF?

Just a question, if anyone cares to explain possible reasons.

I sure some have seen this blog, but just want to make sure everyone here at this forum knows about it.

mchain

XP Home Edition SP 3 P4 2 GB RAM Avast! Free Edition v. 6.0.1203

[Asyn]

Security breach on kernel.org
http://kernel.org/#news
http://linux-foundation.org/weblogs/lwf/2011/08/31/the-cracking-of-kernelorg/
http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html

[Asyn]

Fraudulent certificate triggers blocking from software companies
https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google
http://www.microsoft.com/technet/security/advisory/2607712.mspx
http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/
http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert
http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html

Fake Google certificate is the result of a hack
http://www.h-online.com/open/news/item/Fake-Google-certificate-is-the-result-of-a-hack-1333728.html
http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx

More Info
http://www.h-online.com/security/news/item/Updated-Chrome-and-Firefox-for-fraudulent-Google-certificate-available-1333898.html
http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2
http://www.f-secure.com/weblog/archives/00002228.html
http://nakedsecurity.sophos.com/2011/08/31/google-blacklists-247-certificates-is-it-related-to-diginotar-hacking-incident

The DigiNotar Debacle, and what you should do about it
https://blog.torproject.org/blog/diginotar-debacle-and-what-you-should-do-about-it

[bob3160]

@Asyn,
Clicking on the link in your last post brings up the following:



Strange, the only thing I had blocked in openDNS was Adult content and randomized isp's.
I don't see any here and yet the site was blocked.
I've removed the filer.

[Asyn]

@Asyn,
Clicking on the link in your last post brings up the following:

Sorry Bob, can't help you, I just tried it again and it still works here...!
Do you use OpenDNS..?? The alert seems related to it.

[bob3160]

Yes I do and I guess according to them, it's not a safe place to go.

[DavidR]

No problem with the link either, not using OpenDNS either.

Can't see why OpenDNS would object to this, however would also depend on what your dashboard settings are if you have any set.

[Asyn]

Yes I do and I guess according to them, it's not a safe place to go.

Well, usually it's one of the safest places to go...!!!
http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29
https://www.torproject.org/index.html.en

[CraigB]

Yes I do and I guess according to them, it's not a safe place to go.

Im using OpenDNS and that link is not blocked for me but im not using the dashboard settings, just the basic DNS addresses.

[YoKenny]

Yes I do and I guess according to them, it's not a safe place to go.

Its definitly not a safe place to go according to OpenDNS!