11 total posts
Give us a week to GUT Superfish, begs Lenovo CTO
"Don't Panic, says malware-pusher, Superfish never swam on ThinkPads, servers or arrays"
Lenovo's chief technology officer Peter Hortensius has issued another statement on how the company plans to handle Superfish.
The missive explains that Lenovo has worked with anti-virus vendors to get their products flattening Superfish whenever a PC starts up and issued a removal tool.
Hortensius says Lenovo is now "in the midst of developing a concrete plan to address software vulnerabilities and security with defined actions that we will share by the end of the week."
He can't say what those actions will be for now, but says the company is "exploring a wide range of options that include":
Continued : http://www.theregister.co.uk/2015/02/24/give_us_a_week_to_clean_the_superfish_begs_lenovo_cto/
Related: Still smarting from HTTPS-busting Superfish debacle, Lenovo says sorry
Critical Samba flaw allows unauthorized remote code..
Samba, the popular free software that allows file and print sharing between computers running Windows and those running Unix or Linux, has been found sporting a critical flaw that can be exploited by an attacker to run programs as an administrator.
"CVE-2015-0240 is a security flaw in the smbd file server daemon. It can be exploited by a malicious Samba client, by sending specially-crafted packets to the Samba server. No authentication is required to exploit this flaw. It can result in remotely controlled execution of arbitrary code as root," the Red Hat Product Security team explained in a blog post that also offers more technical details about the flaw.
Continued : http://www.net-security.org/secworld.php?id=17997
Related : Samb-AAAHH! Scary remote execution vuln spotted in Windows-Linux interop code
AT&T Charging Customers to Not Spy on Them
Bruce Schneirer @ his "Schneier on Security" blog:
AT&T is charging a premium for gigabit Internet service without surveillance:
The tracking and ad targeting associated with the gigabit service cannot be avoided using browser privacy settings: as AT&T explained, the program "works independently of your browser's privacy settings regarding cookies, do-not-track and private browsing." In other words, AT&T is performing deep packet inspection, a controversial practice through which internet service providers, by virtue of their privileged position, monitor all the internet traffic of their subscribers and collect data on the content of those communications.
What if customers do not want to be spied on by their internet service providers? AT&T allows gigabit service subscribers to opt out -- for a $29 fee per month.
Continued : https://www.schneier.com/blog/archives/2015/02/att_charging_cu.html
Avast Launches Free Security Solution for Businesses
Security firm Avast announced on Monday the availability of a free offering designed to help small and medium businesses (SMBs) protect their networks against malicious attacks.
Avast for Business is a cross-platform solution that includes features such as essential antivirus protection, Web threat scanning and integrated browser protection, and a cloud management console. The solution also provides a robust reporting and alerting engine, Avast said.
Businesses that want more than just these basic features can acquire premium services such as Firewall, Sandbox, Anti-spam, SafeZone, and Datashredder. For servers, organizations can also add Exchange and Sharepoint protection. Customers can protect as many devices as they want, and they can activate or deactivate licenses at any time, the company noted.
Continued : http://www.securityweek.com/avast-launches-free-security-solution-businesses
Related : Has Avast Just Launched The World's First Free Business-Grade IT Security?
Amazon 'Order Details' Email Delivers Malware
Lately an email from Amazon has been hitting the inbox of unsuspecting users all over the world.
This email has been masqueraded as an order notification message from the famed marketplace Amazon.com.
In this email, recipients are thanked for placing order at Amazon and they are informed that their order details can be viewed by opening the attached file.
No matter how compelled you may become to open this amazing email from Amazon.. never do so. It is a fraudulent email sent by attackers with malicious intentions and not by Amazon.
Continued : https://www.hackread.com/amazon-order-details-email-delivers-malware/
PrivDog Releases Update After Being Compared to Superfish
The developers of PrivDog released an update for the application on Monday after researchers discovered that it failed to validate SSL certificates.
PrivDog is designed to make surfing the Web safe and private by blocking processes that track users' activities and by replacing ads with ones that have been vetted by AdTrustMedia. It's not uncommon for advertising-related apps to put users at risk, but this shouldn't be the case with PrivDog since the software is backed by Comodo, the renowned security firm and certificate authority. PrivDog is not only promoted by the company, but it's also bundled with Comodo solutions.
The existence of the security issue came to light just days after the world learned that Lenovo had preloaded an insecure browser add-on from Superfish on new laptops. The Superfish app used a local proxy and a self-signed root certificate to intercept traffic and inject ads into webpages.
Continued : http://www.securityweek.com/privdog-releases-update-after-being-compared-superfish
PrivDog Adware Poses Bigger Risk Than Superfish
Worse than Superfish? Comodo-affiliated PrivDog compromises web security too
H&R Block doesn't verify client e-mail, leaks personal info
Tax firm H&R Block doesn't verify client's e-mail, leaks personal info
"Failure gives man ability to hijack stranger's pending tax return."
With tax season in full swing, it's time for the yearly reminder that the security practices of many tax-preparation services are lacking. Case in point: H&R Block's reported failure to confirm the e-mail addresses of at least some of its online account holders.
The lapse was reported to Ars by reader Aaron Johnson, who said H&R Block in recent days has e-mailed him the name, address, and security question of a complete stranger. Johnson said he is confident he has everything he needs to access this person's account, steal his most valuable personal data, and hijack any owed tax returns. We created an account at H&R Block and were not asked to authenticate the e-mail address we used.
Continued : http://arstechnica.com/security/2015/02/tax-firm-hr-block-doesnt-verify-clients-e-mail-leaks-personal-info/