WordPress plugin with 10,000+ installations being exploited in the wild

Found on Ars Technica on Thursday, 02 June 2016
Browse Software

A growing number of WordPress websites have been infected by attackers exploiting a vulnerability that remains unpatched in a widely used plugin called WP Mobile Detector, security researchers warned.

The vulnerability can be exploited only when PHP option allow_url_fopen is enabled.

Wordpress again. Apart from trying to stop this via php.ini, every operating system worth being used should have SELinux running, which, by default, blocks the webserver from making outbound network connections. If not, then setsebool -P httpd_can_network_connect off fixes that.

TeamViewer denies hack after PCs hijacked, PayPal accounts drained

Found on The Register on Wednesday, 01 June 2016
Browse Software

In the past 24 hours, we've seen a spike in complaints from people who say their PCs and servers were taken over via the widely used remote-control tool on their machines. Even users with strong passwords and two-factor authentication enabled on their TeamViewer accounts say they were hit.

Over on Reddit, people were lining up with tales of their systems being compromised via TeamViewer, sparking fears the platform had been hacked. TeamViewer makes remote-control clients for Windows, OS X, Linux, Chrome OS, iOS and Android.

Every OS already has methods for allowing remote administration, be it SSH or RDP. Using a 3rd party software is not necessary.

PayPal to shutter operations in Turkey over licensing hurdle

Found on CNet News on Tuesday, 31 May 2016
Browse Internet

The new policy would have required PayPal to establish a local IT center in the country, something the company does not consider doable given its global approach to maintaining its IT systems.

Some countries, including Turkey, have strict censorship rules that have led to the takedown of social media sites Twitter and Facebook. Other countries require that companies establish a local presence in order to operate.

Paypal vs Erdogan. Not really something to cry about.

Fearing forced Windows 10 upgrades, users are disabling critical updates instead

Found on PC World on Monday, 30 May 2016
Browse Software

The only behavior that could deny the Windows 10 upgrade before—closing the pop-up by pressing the X in the upper-right corner—now counts as consent for the upgrade, and worse, the upgrade installation can automatically begin even if you take no action whatsoever.

“I fear some segment of consumers will turn off Windows Update as a result,” Wes Miller, research vice president at Directions on Microsoft, told me. “Which is a very bad side effect.”

The consumer versions of Windows 10 don’t allow you to disable or manually install Windows Updates. If Microsoft pushes out a Windows 10 update, you will receive it eventually.

Doing updates manually is the only option for now. Maybe until someone starts a class action against Microsoft.

Don't panic, says Blue Coat, we're not using CA cert to snoop on you

Found on The Register on Sunday, 29 May 2016
Browse Internet

A kerfuffle kicked off this week when it looked as though Blue Coat had been made an intermediate certificate authority, backed by root certificate authority Symantec, in September. This would allow Blue Coat to issue security certs for almost any website it wanted – certificates that would be trusted by browsers and apps on computers, phones and gadgets.

Unfortunately, Blue Coat's HTTPS-snooping products have been used by repressive regimes to spy on activists online and quash dissent.

Blue Coat won the "Lamest Vendor Response" Pwnie award at last year's Black Hat security conference. The gong was given after the biz pressured a security researcher into dropping a presentation at the SyScan Conference in Singapore earlier in the year.

Trust companies? It's 2016, we had numerous examples of what that means.

Mark Zuckerberg is ‘dictator’ of Facebook ‘nation’: The Pirate Bay founder

Found on CNBC on Saturday, 28 May 2016
Browse Internet

"People in the tech industry have a lot of responsibilities but they never really discuss these things ... Facebook is the biggest nation in the world and we have a dictator, if you look at it from a democracy standpoint, Mark Zuckerberg is a dictator. I did not elect him. He sets the rules," Sunde told CNBC.

"If politicians were a little bit more hard-core and actually believe in this they would be able to fix it. If we say Facebook doesn't agree with our rules in our country we are going to stop Facebook in our country. We censor a lot of things, why not censor Facebook?," he added.

You don't have to use FB. Sure, there might be a few drawbacks, but it boils down to the question if you are willing to give up your morals or not and turn into a sheep.

Chinese backlash over Windows 10 upgrade push

Found on CNet News on Friday, 27 May 2016
Browse Software

Chinese microblog site Weibo said users had now made more than 1.2 million posts complaining about Windows 10.

Microsoft had not respected the users' right to choose what they install on their computers. This was important, he said, because eventually Microsoft might profit from the "unwanted" upgrades.

Many users worldwide are annoyed by that forced upgrade. Looks like in China they are more vocal about it.

Man killed by walrus he took a selfie with, report says

Found on CNet News on Thursday, 26 May 2016
Browse Various

As the Shanghaiist reports, a man went to the Yeshanko Wildlife Zoo in Liaoning province and thought he'd take a selfie with a walrus. He also reportedly took video and posted the best of his work to WeChat during his visit.

The man drowned. A zookeeper, who had worked with the walrus for 10 years, dived in to try to save the man, but he drowned too, according to the report.

The only real loss here is the zookeeper.

Is Facebook eavesdropping on your phone conversations?

Found on News 10 on Wednesday, 25 May 2016
Browse Internet

According to Kelli, more than you could ever imagine. “I don’t think that people realize how much Facebook is tracking every move we’re making online,” she said. “Anything that you’re doing on your phone, Facebook is watching.” Indeed, they are.

The site, itself, admits in an online statement, “We use your microphone to identify the things you’re listening to or watching, based on the music and TV matches we’re able to identify.” But, experts contend that the site is going a step further. In what some users are calling an alarming trend, described as “Big Brother,”

Facebook is just squeezing the most out of its resources, so they can sell that info to their customers. That's not the user though, but the advertisers. Users are just the free and gullible resources.

SWIFT CEO promises security improvements

Found on The Register on Tuesday, 24 May 2016
Browse Various

The head of the SWIFT financial network has put forward a five-part plan to improve security after its systems were the focus of several cyberattacks.

Security experts pointed out that SWIFT's security systems were out of step with the modern world. Its security guidelines are "outdated and incomplete," said one analysis. Its systems were set up to deal with "the types of attacks that were prevalent a decade ago," and the network fails to safeguard against today's more sophisticated hacks – like the one suffered by the Bangladeshi bank.

If you want to process millions every day, you better invest a lot of money to make sure your systems are secure, and your processes are up to date so they can deal with the attack scenarios of today.