Weekly Cyber Security News 02/11/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Another week of quite astounding news, and I will lead with a really interesting story from a side where many of us don’t get to tread (perhaps thankfully), though his closing question is very disconcerting…

• Why the NSA Called Me After Midnight and Requested My Source Code

An audacious, and possibly fruitless project, which nevertheless we might all learn something from:

• Artificial intelligence agent pilot launched to expose liars at EU borders

A few serious hardware issues surfacing this week which are startling, and will no doubt keep a few busy this weekend:

• Cisco zero-day exploited in the wild to crash and reload devices

• Recipe for disaster: Bluetooth-enabled POS Terminals + MagStripe-based Cards

• USB Drives Deliver Dangerous Malware to Industrial Facilities: Honeywell

 

And the rest of the news goes like this:

• Exposed Docker APIs Continue to Be Used for Cryptojacking

• More Information about July 2018’s Singapore SingHealth Data Breach Revealed

• Australian Cryptocurrency Theft Highlights Security Mistakes (InfoRiskToday)

• Canada is Imitating EU’s GDPR, New Policy Takes Effect On Nov 2018

• Canadian Crypto-Exchange Shutters After $6m ‘Hack’

• Check this out: Radisson Hotel Group “fesses up to “security incident”

• Equifax Has Chosen Experian. Wait, What?

• Eurostar forces all customers to reset passwords after data breach

• FIFA, Hacked Again, Braces for New Revelations

• GitHub is now officially a part of Microsoft

• Google Project Zero-es in on Google project (The Register)

• Google won”t let you sign in if you disabled JavaScript in your browser (ZDNet)

• Hackers Steal Data of Over 60,000 Tomorrowland Attendees

• How to build your own IT infosec holodeck: A blueprint for crafting a virtual enterprise to prod, test and hack

• IBM to Acquire Open Source Giant Red Hat for $34 Billion

• Man Ordered to Pay $8.6 Million for Launching DDoS Attacks against Rutgers University

• Many CMS plugins are disabling TLS certificate validation… and that”s very bad (ZDNet)

• Nigerian airline Arik Air may have leaked customer data

• Post-breach, Cathay Pacific hit by group action by UK law firm

• Researchers find Stuxnet, Mirai, WannaCry lurking in industrial USB drives (ZDNet)

• Security Vulnerability in Internet-Connected Construction Cranes

• Telegram Desktop Saves Conversations Locally in Plain Text

• The D in Systemd stands for “Dammmmit!” A nasty DHCPv6 packet can pwn a vulnerable Linux box

• This is how hackers can take down our critical energy systems through the Internet

• This one weird trick turns your Google Home Hub into a doorstop

• Twelve malicious Python libraries found and removed from PyPI

• UK Construction Firms Hemorrhage Log-Ins to Dark Web

• US rubber stamps right to repair: What it means for IT, SMBs, and tinkerers

• Welcome back, “ping of death”, it”s been… a few months. Now it”s Apple”s turn to do the patching

• Yi IoT Home Camera Riddled with Code-Execution Vulnerabilities Five of them allow remote compromise of the IoT gadgets, so attackers can intercept video feeds and more.

• Bluetooth bugs bite millions of Wi-Fi APs from Cisco, Meraki, and Aruba

• Bing Pushing Malware When Attempting to Download Chrome

• Emotet malware gang is mass-harvesting millions of emails in mysterious campaign

• A few hours after Apple released iOS 12.1, a researcher presented a Passcode Bypass issue

• Square, PayPal POS Hardware Open to Multiple Attack Vectors Popular card readers like Square and PayPal have various flaws that allow attacks ranging from fraud to card data theft.