Weekly Cyber Security News 19/10/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Some very exciting news, well I say exciting, its more like we’ve made a step forward in regards to IoT security at long last. Hopefully more will come on board and in time others will see the benefit:

• UK Launches ‘World First’ IoT Code of Practice

Which we sort of need, considering what recently happened with D-Link…

• Last year, D-Link flubbed a router bug-fix, so it”s back with total pwnage

An odd phishing attack popped up in the news feed this week. I know the industry well,  and there certainly is much money to be had for the top sellers, so I’m not surprised its finally been targeted:

• Phishers are after something unusual in ploy targeting book publishers

In other news…

• Medical Information Leaked After Hackers Breach Israeli Emergency Responders Website

• CVE-2018-7600 Drupal Bug Used in New Attack

• Deadly Cyber-Attack On Cards For UK, Warns NCSC Chief

• Abandoned Tweet Counter Hijacked With Malicious Script

• Alibaba passes blame for Alipay thefts to Apple

• Browser vendors unite to end support for 20-year-old TLS 1.0 (ArsTechnica)

• DDoS Attacks Hit Games Like Assassin’s Creed and Final Fantasy XIV

• Epson reported to Texas AG for bricking third-party ink cartridges

• Feds Investigate After Hackers Attack Water Utility

• IETF approves new internet standards to secure authentication tokens

• Microsoft to disable TLS 1.0 and TLS 1.1 support in Edge and Internet Explorer (ZDNet)

• Mindbody’s FitMetrix leaked millions of User’s Personal Details

• NotPetya Linked to Industroyer Attack on Ukraine Energy Grid Evidence shows that three of the most destructive incidents seen in modern cyber-history are the work of one APT.

• Oracle patches 301 vulnerabilities, including 46 with a 9.8+ severity rating

• Party like it”s 1987… SVGA code bug haunts VMware”s house, lets guests flee to host OS

• Pentagon discloses card breach

• Pentagon Staff Hit by Major Data Breach

• PINs and needled: Experian site blabbed codes to unlock credit accounts for fraudsters (The Register)

• Purging Long-Forgotten Online Accounts: Worth the Trouble?

• Researcher finds simple way of backdooring Windows PCs and nobody notices for ten months

• Sony working on a fix for bug that”s crashing PlayStation 4 consoles

• Still sending data via unencrypted thumb drives in the mail? It will cost you.

• Stripe hires Niels Provos away from Google to be its new head of security

• Supermicro boards were so bug ridden, why would hackers ever need implants?

• Tech Support Scams Decline as Consumers Get Savvy

• Tens of Millions of U.S. Voter Records for Sale

• The Importance of Security Awareness in Our Connected Lifestyle

• Tumblr turns stumblr, left humblr: Blogging biz blogs bloggers” private info to world+dog (The Register)

• UK”s National Cyber Security Centre gives itself big ol” pat on the back in annual review

• UK’s MoD Exposed in 37 Security Breaches: Report

• Vending Machine App Hacked for Unlimited Credit

• Verizon fiber suffered ‘unprecedented’ damage from Hurricane Michael

• WannaCry Cost NHS ?92 Million

• We”re killing off passwords. But are we ready for what will replace them? (ZDNet)

• Yale smart lock, alarm app debacle causes chaos across UK homes (ZDNet)

• In County Crippled by Hurricane, Water Utility Targeted in Ransomware Attack The Emotet Trojan is behind a crippling ransomware attack that hit the Onslow Water and Sewer Authority.

• Expert disclosed a new passcode bypass to access photos and contacts on a locked iPhone

• Tech-support scams: Microsoft reveals that fraudsters are still fooling too many people (ZDNet)

• Around 62% of all Internet sites will run an unsupported PHP version in 10 weeks (ZDNet)

• Brazil expert discovers Oracle flaw that allows massive DDoS attacks

• Security flaw in libssh leaves thousands of servers at risk of hijacking

• Support for PHP 5.6.x Ends in 2 Months, Millions of Websites at Risk