Facebook Offering You $1000 to Run Advertisement Against Terrorism

Facebook Offering $1,000 Credits If You Want to Run Advertisements Against ISIS and Terrorism
Over a past few times, we have seen a steady growth in the online recruitment of Jihadis from social networking sites by many radical groups.
ISIS has topped the online recruitment, and it is the only terror group that leverages the enormous power of Twitter and Facebook to radicalize young minds, spread its message and recruit foreign supporters to its fights.
Many ISIS militants maintain extremely active accounts on the popular social media platforms and have a strong presence on the most popular encrypted messaging app Telegram with more than 100,000 followers.
This issue had impacted the society deeply. Recent examples include last year’s Paris attack in which ISIS used some popular messaging apps to plot the attack.
As the Dark Siders of social media began to turn this platform into a Terror-Picker, the White Siders of the same social media came under a single roof to declare fight against terrorism, and rage cyber war against these anti-humans.

Facebook Buckled Up to Fight against Terrorism

Facebook is also on the main line up to join the fight against terrorism. The social media giant has also come up with a solution to minimize the presence of caliphate group from its social media platform.
Similar efforts have previously been made by Anonymous hacktivist group, who conducted various planned operation like OpISIS, OpParis, expunging ISIS channels from Twitter and Telegram.
Recently, Facebook introduced a new program, dubbed “Counter-Speech,” that offers advertising credits up to $1000 for those who raise their voice against hate speeches & terror propagandas.
This new intelligent strategy would enlighten the immature minds of those who got influenced by the radicalized propaganda and created an automatic hatred towards the group (who tried to brainwash with their propagandas).
So, rather than vanishing or blocking the extremist Facebook pages that spread hatred among its followers, Facebook is focusing on educating more and more young minds in an effort to fight against terrorism.

The First Person to Receive $1000 Credit

Arbi-el-Ayachi – A German comedian had got benefited from the newly released Facebook plan when he released a video showing eating halal meat is poisonous to Christians, last year.

How did the idea strike?

The idea was formed by the current Facebook Chief Operating Officer Sheryl Sandberg while speaking at World Economic Forum last month.
Sandberg backed up this idea by referring to a recent attack conducted by the group in Germany called “Laut gegen Nazis” (an anti-neo nazi group) had attacked the Facebook page of the far-right NDP by getting members to like (“Like Attack”) and post on the page.
“Rather than scream and protest, they got 100,000 people to like the page, who did not like the page and put messages of tolerance on the page, so when you got to the page, it changed the content and what was a page filled with hatred and intolerance was then tolerance and messages of hope” Sandberg stated.

Cyber World Fights Against Terrorism

Gradually, the massive operation to fight against terrorist organizations began to hit the headlines and grabbed the attention of several tech giants like Google, YouTube, and Twitter.
  1. Youtube had wiped out more than 1000 dozens of radical videos from its database.
  2. Twitter had expelled 1,25,000 accounts of Jihadi members since in mid 2015.
  3. Google also rolled out a special advertising program for terrorist sympathizers who type extremism-related words in the search engine, but the “top” search results display anti-radicalized links.
Joint ventures like this would act as a Digital Age Shield to minimize the threat levels.
However, Facebook had not mentioned about the verification procedure for those credited $1000. So, it may be possible that those awarded credits could be used for personal promotions too…

Cross-Site Scripting in form component

Component Type: TYPO3 CMS

Release Date: February 16, 2016

 

Vulnerable subcomponent: form component

Vulnerability Type: Cross-Site Scripting

Affected Versions: Versions 6.2.0 to 6.2.17

Severity: Low

Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:O/RC:C

CVE: not assigned yet

Problem Description: Failing to sanitize content from unauthenticated  website visitors, the form component is susceptible to Cross-Site Scripting.

Solution: Update to TYPO3 version 6.2.18 that fixes the problem described.

Credits: Thanks to David Vieira-Kurz who discovered and reported the issue.

 

General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note: All security related code changes are tagged so that you can easily look them up on our review system.

Cross-Site Scripting in legacy form component

Component Type: TYPO3 CMS

Release Date: February 16, 2016

 

Vulnerable subcomponent: legacy form component

Vulnerability Type: Cross-Site Scripting

Affected Versions: Versions 6.2.0 to 6.2.17

Severity: Low

Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:O/RC:C

CVE: not assigned yet

Problem Description: Failing to sanitize content from editors, the legacy form component is susceptible to Cross-Site Scripting. A valid editor account with access to a form content element is required to exploit this vulnerability.

Solution: Update to TYPO3 version 6.2.18 that fixes the problem described.

Credits: Thanks to Georg Ringer who discovered and reported the issue.

 

General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note: All security related code changes are tagged so that you can easily look them up on our review system.

Cross-Site Scripting in link validator component

Component Type: TYPO3 CMS

Release Date: February 16, 2016

 

Vulnerable subcomponent: link validator

Vulnerability Type: Cross-Site Scripting

Affected Versions: Versions 6.2.0 to 6.2.17 and 7.6.0 to 7.6.2

Severity: Low

Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:O/RC:C

CVE: not assigned yet

Problem Description: Failing to sanitize content from editors, the link validator component is susceptible to Cross-Site Scripting. A valid editor account with access to content which is scanned by the link validator component is required to exploit this vulnerability

Solution: Update to TYPO3 versions 6.2.18 or 7.6.3 that fix the problem described.

Credits: Thanks to Steffen Müller who discovered and reported the issue.

 

General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note: All security related code changes are tagged so that you can easily look them up on our review system.

SQL Injection in dbal

Component Type: TYPO3 CMS

Release Date: February 16, 2016

 

Vulnerable subcomponent: Dbal

Vulnerability Type: SQL Injection

Affected Versions: Versions 6.2.0 to 6.2.17

Severity: High

Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C

CVE: not assigned yet

Problem Description: A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.

Solution: Update to TYPO3 versions 6.2.18 that fix the problem described.

Credits: Thanks to Mohamed Rebai who discovered and reported the issue.

 

General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note: All security related code changes are tagged so that you can easily look them up on our review system.

WhatsApp to advise users if they receive a dangerous file

WhatsApp is set to send a warning to users when they receive a dangerous file. The instant messaging application will introduce this feature during its next few updates, making the sharing of files a bit safer.

Under a new menu, named Documents, users will find a section which is similar to the current one which stores photos and videos that have been exchanged in the conversation. Now, however, there will be text documents, Excel files, presentations, and other office-style documents.

The danger of Excel files

As we’ve said on many occasions before, if you receive an Excel file by email then you should be suspicious. This is why Excel files require the permission of the user to run the file in a trusted mode, and this is exactly what WhatsApp is going to do, too.

whatsapp files

Once again, this piece of information has come from WhatsApp’s translation service. It seems that a security alert will appear before allowing you to run the office document.

By doing this, they hope to avoid the spread of malware via mobile devices. The message will be clear and direct – “This document might contain unsafe content. Make sure you trust the sender before you open it”.

This news confirms what we have always said: be careful with attachments and those that are sent via mobiles. Now, WhatsApp will also help us to remain a little more protected! 😉

The post WhatsApp to advise users if they receive a dangerous file appeared first on MediaCenter Panda Security.

USN-2896-1: Libgcrypt vulnerability

Ubuntu Security Notice USN-2896-1

15th February, 2016

libgcrypt11, libgcrypt20 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Libgcrypt could be made to expose sensitive information.

Software description

  • libgcrypt11
    – LGPL Crypto library

  • libgcrypt20
    – LGPL Crypto library

Details

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered
that Libgcrypt was susceptible to an attack via physical side channels. A
local attacker could use this attack to possibly recover private keys.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
libgcrypt20

1.6.3-2ubuntu1.1
Ubuntu 14.04 LTS:
libgcrypt11

1.5.3-2ubuntu4.3
Ubuntu 12.04 LTS:
libgcrypt11

1.5.0-3ubuntu0.5

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-7511