Security

In other news, your check is in the mail.

Comcast says its customers shouldn't worry about having their browsing histories or personal information sold off by Comcast, because the cable giant doesn't have any immediate plans to do so. And if they do decide to change that policy, customers should rely on the state governments to stand up to a company that writes its own laws in many places.

In short, Comcast may be able to sell out its customers now, but customers should trust them not to.

And who can you trust, if not the company that once changed a customer's name to "Asshole Brown" out of spite?

https://www.theregister.co.uk/2017/03/31/comcast_we_will_never_sell_your_data/

In other news, your dishwasher may have a web server in it.
Maybe Kelly Conway wasn't so far wrong after all? (Nah, she probably still was).

Can't wait to see what some script kiddie decides to tell our kitchen appliances to do.

https://www.theregister.co.uk/2017/03/26/miele_joins_internetofst_hall_of_shame/

Not only are some browsers now throwing flares when forms are presented without encryption, but Google is starting to notice as well.
Bottom line - it's time to get a cert and make your site work over encrypted connections.

Here's a detailed article that will take you through the steps required to get HTTPS working on your site(s).

https://www.lullabot.com/articles/https-everywhere-deep-dive-into-making-the-switch

It takes roughly three steps to remediate the Heartbleed bug.
 

1. Patching: Update your software to the latest versions of OpenSSL; thankfully almost all organization have accomplished this step.
2. Creation of New Private Keys: Creating new private keys will prevent an attacker, who already exploited the flaw before patching, from being able to spy on your encrypted.
3. Reissuance of Security Certificates: This step will eliminate the ability of any attacker to spoof organizations and fool or phish their customers.

http://thehackernews.com/2017/01/heartbleed-openssl-vulnerability.html

As usual, Krebs has a much more detailed exigesis of how this thing actually works.

New research suggests that an elaborate cybercrime ring is responsible for stealing between $3 million and $5 million worth of revenue from online publishers and video advertising networks each day. Experts say the scam relies on a vast network of cloaked Internet addresses, rented data centers, phony Web sites and fake users made to look like real people watching short ad segments online.

https://krebsonsecurity.com/2016/12/report-3-5m-in-ad-fraud-daily-from-methbot/

And in other news, Yahoo is still in business...
Seriously, who has a Yahoo account?

The data breach officially disclosed on Wednesday actually occurred in 2013 and, just like the one in 2014, allowed the cyber crooks to obtain personal information of its users but not credit card details.

 

http://thehackernews.com/2016/12/yahoo-data-breach-billion.html

Please please please for the love of all that's good, stop using Flash.
And don't get me started on Windows.

According to analysis released this month by Recorded Future, Adobe Flash vulnerabilities provided six of the top 10 vulnerabilities used by exploit kits in 2016. Exploit kits are automated tools that criminals stitch into the fabric of hacked or malicious Web sites, so that visitors who visit one of these sites with an outdated version of Flash in their browser can have malware silently installed. 

https://krebsonsecurity.com/2016/12/new-critical-fixes-for-flash-ms-windows/

Carnegie Mellon's Computer Emerency Response Team (CERT) warns

Netgear's R7000 and R6400 routers, running current and latest versions of firmware, are vulnerable to arbitrary command injection attacks, though the number of users affected by the flaw is still unclear.

http://thehackernews.com/2016/12/netgear-router-hacking.html

Multi-level marketing comes to ransomware.

...to get their important files back, Popcorn Time gives victims option to pay a ransom to the cyber criminal or infect two other people and have them pay the ransom to get a free decryption key.

http://thehackernews.com/2016/12/ransomware-malware.html