SECURITY WARNINGS & Notices - Please post them here

... researchers found that the rising tide of fake anti-virus during the first half of 2011 includes a new variant consisting of fake desktop utilities, propelled by SpyEye and Zeus Trojan spam.
… the report found that security threats from social media continue to rise as social networking sites such as Facebook and Twitter are increasingly used in the workplace.
… rogue apps that impersonate online games in order to distribute malware.

… mobile security threats for the Android platform experienced a big upward spike, proliferated with the growth of the Android Market.

http://www.crn.com/news/security/231600446/fake-anti-virus-social-network-scams-on-the-rise-report.htm;jsessionid=Im5cs88mTXd-5XWl+mtdZQ**.ecappj02?cid=nl_sec

system · August 30, 2011, 11:30pm

Apple Gives Internship To JailbreakMe Creator

Sometimes, if you can’t beat them, employ them. Nicholas Allegra, a 19-year-old hacker and creator of the Jailbreakme.com site, responsible for a series of jaibreaking iOS hacks, has officially been hired as an intern at Apple

http://www.crn.com/news/security/231600297/apple-gives-internship-to-jailbreakme-creator-comex.htm?cid=nl_sec

system · August 30, 2011, 11:35pm

Xpaj Botnet Intercepts 87 Million Web Searches In Click-Fraud Scheme

... researchers said Friday they recently uncovered the file-infector W32.Xpaj.B botnet, also known simply as Xpaj, by digging up command and control servers containing encrypted binary data, encryption keys, databases and Web applications used in conjunction with a widespread click-fraud scheme over the last several months.

http://www.crn.com/news/security/231600289/xpaj-botnet-intercepts-87-million-web-searches-in-click-fraud-scheme.htm?cid=nl_sec

system · August 30, 2011, 11:40pm

Skype Cross-Site Scripting Flaw Enables Phone Session Attacks

A gaping cross-site scripting flaw in the latest version of Skype enables attackers to inject malicious code into a user’s phone sessions. The cross-site scripting vulnerability occurs in Skype 5.5.1.113, affecting Windows XP, Vista and 7, and stems from a persistent code injection vulnerability due to a validation input error that prevents the VoIP client from properly inspecting phone numbers sourced from users’ home, office and mobile Skype accounts, according to researcher Levent Kayan.

http://www.crn.com/news/security/231600218/skype-cross-site-scripting-flaw-enables-phone-session-attacks.htm?cid=nl_sec

Asyn · August 31, 2011, 5:36pm

More Info
http://www.h-online.com/security/news/item/Updated-Chrome-and-Firefox-for-fraudulent-Google-certificate-available-1333898.html
http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2
http://www.f-secure.com/weblog/archives/00002228.html
http://nakedsecurity.sophos.com/2011/08/31/google-blacklists-247-certificates-is-it-related-to-diginotar-hacking-incident

mchain · August 31, 2011, 8:19pm

Et al,

Just thought I’d post this for other users and viewers to peruse at their leisure.

See: http://news.cnet.com/8301-27080_3-20099421-245/google-users-in-iran-targeted-in-ssl-spoof/?tag=contentMain;contentBody

re: Spoofed and Invalid CA certificates.

I come here every week or so to see what is out there as far as malware trends are going. Looks like the latest and greatest (sadly) is the one currently known as ‘Enhanced Protection Virus’. I wish Essexboy all the best in finding a successful resolution for the two users whom currently have this rogue program on their machines.

If we have known spoofed CA’s, then is this not a part of the problem with Google Re-direct, since we don’t really know for sure where the browser is ending up at? ??? ???

Note, too, the link provided for the program called ‘Covergence’, at the bottom of the blog, which is said to analyze for certificate revocations, that does not work on my machine. When the add-on is run in FF 6.0, it says it is not compatible.

As always, I run my browser in a sandbox to test before installing anything like this. Could this affect proper operation? Why would it say ‘incompatible’ if it is supposed to run on FF?

Just a question, if anyone cares to explain possible reasons.

I sure some have seen this blog, but just want to make sure everyone here at this forum knows about it.

mchain

XP Home Edition SP 3 P4 2 GB RAM Avast! Free Edition v. 6.0.1203

Asyn · September 1, 2011, 12:55pm

Security breach on kernel.org
http://kernel.org/#news
http://linux-foundation.org/weblogs/lwf/2011/08/31/the-cracking-of-kernelorg/
http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html

Asyn · September 2, 2011, 6:51am

The DigiNotar Debacle, and what you should do about it
https://blog.torproject.org/blog/diginotar-debacle-and-what-you-should-do-about-it

bob3160 · September 2, 2011, 11:57am

@Asyn,
Clicking on the link in your last post brings up the following:

http://my.jetscreenshot.com/2701/m_20110902-g9jm-49kb.jpg

Strange, the only thing I had blocked in openDNS was Adult content and randomized isp’s.
I don’t see any here and yet the site was blocked.
I’ve removed the filer.

Asyn · September 2, 2011, 12:27pm

Sorry Bob, can’t help you, I just tried it again and it still works here…!
Do you use OpenDNS…?? The alert seems related to it.

SECURITY WARNINGS & Notices - Please post them here

Announcements