5481

Three new zero-days being abused in Word Press plug-ins:

https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/

PHP-based CMS, a disaster in the hands of the unsavvy!

polonus

5482

Every single Yahoo account was compromised by hackers
http://nordic.businessinsider.com/yahoo-3-billion-accounts-were-compromised-in-its-hacking-attack-2017-10?r=US&IR=T

https://www.bloomberg.com/news/articles/2017-10-03/yahoo-says-all-3-billion-users-probably-affected-by-2013-breach

http://www.marketwatch.com/story/every-yahoo-account-was-affected-by-2013-hack-verizon-now-says-2017-10-03

5483

Win7 kernel security to be applied to Win10 kernel as well?

That is what Google wants: https://googleprojectzero.blogspot.nl/2017/10/using-binary-diffing-to-discover.html

polonus

P.S. See attached code txt attached, copyright 1989 by Dave Angel, providing a mem-dump for fuzzers. (pol)

5484

Security Alert: User Info Breach
https://blog.disqus.com/security-alert-user-info-breach

5485

Ouch. Would be nice if they informed their users. :frowning:

5486

Another vulnerable plug-in in Word Press: https://web.archive.org/web/20170817183628/https://wordpress.org/plugins/postman-smtp/

Patched by another developer: https://github.com/yehudah/Postman-SMTP

polonus

5487

Forrester.com Experienced A Cybersecurity Incident
https://go.forrester.com/blogs/forrester-com-experienced-a-cybersecurity-incident/

5488

Microsoft silently fixes security holes in Windows 10 – dumps Win 7, 8 out in the cold
http://www.theregister.co.uk/2017/10/06/researchers_say_windows_10_patches_punch_holes_in_older_versions/

5489

The only thing is that I’m not surprised about what MS gets up to or in this case doesn’t get up to.

5490

Yepp you have to trust that your AV vendor has those exploits blocked
https://googleprojectzero.blogspot.no/2017/10/using-binary-diffing-to-discover.html

5491

SS7 (Signalling System 7) protocol, is as holed as holed can be. Do no longer use SMS authentication!

Read: http://anonymous-news.com/how-hackers-can-use-two-factor-authentication-to-hack-your-gmail-empty-bitcoin-wallet/

polonus

P.S. Related threat -usb-cable with inbuilt-sim-card… https://secure.dshield.org/forums/diary/Whats+in+a+cable+The+dangers+of+unauthorized+cables/22904/

Damian

5492

Google allows 37,000 Chrome users to be tricked with a fake extension by fraudulent developer who clones popular name and spams keywords.
https://twitter.com/SwiftOnSecurity/status/917446126382526464

5493

Whatsapp and similar apps could be spied upon for data about your wake/sleeping patterns and other interesting data…

Re: https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/
Re: https://news.ycombinator.com/item?id=15435822 (about other scenario’s)…

A phone number could be enough of a lead…
Frightening is not it? A world without any privacy!

polonus

5494

Russia to block access to “dubious” cryprocurrency exchanges websites, as they call it:

https://www.theregister.co.uk/2017/10/10/russia_to_ban_cryptocurrency_exchanges/

Certainly there are bad bitcoin scam & fake miners sites: http://www.badbitcoin.org/thebadlist/

And these better schould be blocked.

polonus

5495

Alert https://www.ncsc.nl/actueel/factsheets/factsheet-tls-interceptie.html

Example where things are wrong: https://urlquery.net/report/be049d88-859c-4fa8-8cb9-8cc53e4de3fc
and http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fsd-1367041-l.dattaweb.com%2F
and -http://sd-1367041-l.dattaweb.com/

Warnings
TLS1.2
This server is vulnerable to a TLS renegotiation attack

Site cert has 2 errors
Wrong certificate installed.
The domain name does not match the certificate common name or SAN.
Intermediate certificate missing.
GeoTrust SSL CA - G3 → https://observatory.mozilla.org/analyze.html?host=sd-1367041-l.dattaweb.com

Normal user should trust those that keep these servers up.

polonus (checking it for you ;D )

5496

“Responsible encryption” to facilitate the Surveillance State a bad idea:

EFF’s response to the proposals…
https://www.eff.org/deeplinks/2017/10/deputy-attorney-general-rosensteins-responsible-encryption-demand-bad-and-he

What we need is good e2e encryption everywhere.

It is either full encryption or no encryption at all, and digi-n00b politicians won’t understand. (Rosenstein, Budd etc.).

Make sure to introduce TLS 1.3 on websites everywhere:

Enhanced Security Most of the attacks on TLS from the last few years targeted vestigial pieces of the protocol left around from the 90s. TLS 1.2 is highly configurable, and vulnerable sites simply failed to disable the older features in hopes of being compatible with old browsers. TLS 1.3 embraces the “less is more” philosophy, removing support for older broken forms of cryptography. That means you can’t turn on the potentially vulnerable stuff, even if you try. The list of TLS 1.2 features that have been removed is extensive, and most of the exiled features have been associated with high profile attacks. These include: RSA key transport — Doesn’t provide forward secrecy CBC mode ciphers — Responsible for BEAST, and Lucky 13 RC4 stream cipher — Not secure for use in HTTPS SHA-1 hash function — Deprecated in favor of SHA-2 Arbitrary Diffie-Hellman groups — CVE-2016-0701 Export ciphers — Responsible for FREAK and LogJam
Quote from Introducing TLS 1,3 by CloudFlare CDN.

Google Chrome and firefox support TLS 1,3 as per default.

Let us make the world more secure in stead of less secure,

polonus (volunteer website security analyst and website error-hunter)

5497

Microsoft Corp. faces a coordinated investigation by European privacy regulators after it failed to do enough to address their concerns about the collection and processing of user data with a series of changes to Windows 10 last month.

https://www.bloomberg.com/news/articles/2017-02-21/microsoft-faces-european-privacy-probes-over-windows-10

Data-protection agencies from the Netherlands, Germany, France, the U.K., Spain, Hungary and Slovenia are collaborating on the Microsoft probes according to Dutch Watchdog.

polonus

5498

Third party malscript injection: https://arstechnica.com/information-technology/2017/10/equifax-rival-transunion-also-sends-site-visitors-to-malicious-pages/

The Internet is an insecure place often…

polonus

5499

Microsoft’s October Patch Tuesday Fixes 62 Vulnerabilities, including an Office Zero-Day
http://blog.trendmicro.com/trendlabs-security-intelligence/microsofts-october-patch-tuesday-office-zero-day/

5500

Key Reinstallation Attacks - Breaking WPA2 by forcing nonce reuse
https://www.krackattacks.com/