Technical

[Asyn]

ZDI-CAN-6135: A Remote Code Execution Vulnerability in the Microsoft Windows Jet Database Engine
https://www.zerodayinitiative.com/blog/2018/9/20/zdi-can-6135-a-remote-code-execution-vulnerability-in-the-microsoft-windows-jet-database-engine

[Asyn]

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows
https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/

[Asyn]

Another Victim of the Magecart Assault Emerges: Newegg
https://www.riskiq.com/blog/labs/magecart-newegg/
https://www.volexity.com/blog/2018/09/19/magecart-strikes-again-newegg/

[Asyn]

GandCrab V5 Released With Random Extensions and New HTML Ransom Note
https://www.bleepingcomputer.com/news/security/gandcrab-v5-released-with-random-extensions-and-new-html-ransom-note/

[billygoat59]

In Quiet Change, Google Now Automatically Logging Users Into Chrome

https://www.darkreading.com/vulnerabilities---threats/in-quiet-change-google-now-automatically-logging-users-into-chrome/d/d-id/1332882?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

[bob3160]

In Quiet Change, Google Now Automatically Logging Users Into Chromehttps://www.darkreading.com/vulnerabilities---threats/in-quiet-change-google-now-automatically-logging-users-into-chrome/d/d-id/1332882?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Easy enough to fix if it's not something that makes your life easier:
https://www.askvg.com/fix-google-chrome-automatically-signs-into-browser-when-you-log-into-gmail-or-other-google-services/

[Asyn]

Firefox Monitor
https://monitor.firefox.com/

[DavidR]

Firefox Monitor
https://monitor.firefox.com/

Personally I never use things like this as I'm just to trusting (NOT), I don't give out any information (or drop my defences) for anyone to run a supposed security/compromise check.   

Sign up for Firefox Monitor. You’ll get a full report on your compromised accounts and notifications any time your accounts appear in new data breaches.

I don't know how this falls in line with their comment "Your email will not be stored." (presumably just for that check).  However, if you sign up it and others you use/used would have to be stored.

[Asyn]

1. Personally I never use things like this as I'm just to trusting (NOT), I don't give out any information (or drop my defences) for anyone to run a supposed security/compromise check.   

Sign up for Firefox Monitor. You’ll get a full report on your compromised accounts and notifications any time your accounts appear in new data breaches.

2. I don't know how this falls in line with their comment "Your email will not be stored." (presumably just for that check).  However, if you sign up it and others you use/used would have to be stored.

1. Me neither, but FFM is certainly one of the few trustworthy services, imo.
2. Correct.

[alanb]

I don't know how this falls in line with their comment "Your email will not be stored."

No email address is transferred.  To quote Mozilla:

When a user submits their email address to Firefox Monitor, it hashes the plaintext value and sends the first 6 characters to the HIBP API.

[DavidR]

I don't know how this falls in line with their comment "Your email will not be stored."

No email address is transferred.  To quote Mozilla:

When a user submits their email address to Firefox Monitor, it hashes the plaintext value and sends the first 6 characters to the HIBP API.

Thanks for that, it could be useful if they either stated that (or gave a link) on the same page as they say your email won't be stored.

Mine you those like myself, who question statements like that, are less likely to need the service. Those that believe just because they say it (and it is written down) is so may be their target audience.

[alanb]

...could be useful if they either stated that...

Take a look here:  https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity/

[DavidR]

...could be useful if they either stated that...

Take a look here:  https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity/

I will have a look at it later, just about to go out.

It isn't so much that it isn't there, just that people would have to go digging for it and many won't.

[Asyn]

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

[Asyn]

Torii botnet - Not another Mirai variant
https://blog.avast.com/new-torii-botnet-threat-research