Weekly Cyber Security News 07/12/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. I don’t often play games, and until this issue below appeared on my feed due to the self inflicted data breach I was blissfully unaware. Apart from the horrific appearing customer service, the breach is deeply unfortunate. What can we learn from it? Perhaps when under a lot of stress make sure you configure (was it a thread configuration issue or bug?) anything customer facing correctly:

• Bethesda’s attempt to fix a Fallout 76 blunder leaks angry shopper’s PID [Updated]

Why, oh why is Flash still a thing?

• Adobe Patches Zero-Day Vulnerability in Flash Player The vulnerability could lead to arbitrary code execution.

Usually I skip WordPress issues as they seem to be part of the furniture, but this one is nasty, and I have a new found hatred for WordPress due to having to use the new editor to write this blog article:

• WordPress Botnet Infects Blogs in a Large-Scale Attack

 

The other possibly annoying things to look at:

• Marriott sued hours after announcing data breach (ZDNet)

• Australia now has encryption-busting laws as Labor capitulates (ZDNet)

• Australia Passes Cyber Snooping Laws With Global Implications

• Australia Set to Pass Sweeping Cyber Laws Despite Tech Giant Fears

• Brits” DNA data sent to military base after “foreign” hack attacks

• Customers baffled as Citrix forces password changes for document-slinging Sharefile outfit

• Cyber-espionage group uses Chrome extension to infect victims

• Eastern European banks lose tens of millions of dollars in Hollywood-style hacks

• Giraffe hacks printers worldwide to promote God-awful YouTuber. Did we read that one right?; (The Register)

• Google kills off Allo to focus on Messages (ZDNet)

• Hacker hijacks printers worldwide to promote popular YouTube channel

• It”s nearly 2019, and your network can get pwned through an oscilloscope

• Magecart Group Ups Ante: Now Goes After Admin Credentials The group’s skimmer has added some capabilities that steals credentials from admins.

• Microsoft Replacing Edge With New Chromium-based Browser

• Mozilla Testing DNS-over-HTTPS in Firefox

• Now you, too, can snoop on mobe users from 3G to 5G with a Raspberry Pi and £1,100 of gizmos

• Only 29% of EU organizations are GDPR compliant (TechRepublic)

• Southeby’s Site Infected with Magecart for Over a Year

• SplitSpectre CPU Vulnerability Discovered: Yet Another Hardware Design Flaw

• The Dark Side of the ForSSHe

• Unprotected MongoDB Exposes Scraped Profile Data of 66 Million

• Wanna save yourself against NotPetya – Try this one little Windows tweak (The Register)

• Yet another mega-leak: 100 million Quora accounts compromised by system invaders

• Google Patches More Than 50 Android Vulnerabilities in December

• Over 100,000 PCs infected with new ransomware strain in China (ZDNet)

• London Blue Cybergang List 50,000 execs for Phishing Attacks

• Microsoft, Mastercard propose universal digital identity program

• Critical Privilege Escalation Flaw Patched in Kubernetes

• Kubernetes Flaw is a ‘Huge Deal’, Lays Open Cloud Deployments Hackers can steal data, sabotage cloud deployments and more.