Weekly Cyber Security News 21/12/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Looks like the year is ending with some IoT hell. Nice…. First off we have international news of drones keeping planes on the ground at a major airport causing total chaos with no idea how to deal with it:

• Gatwick Airport Runways Closed to Avoid Drone Disaster

IoT questions continue to replicate above answers with a added GDPR issue by Amazon. This is bad data handing practice, what I want to know is why do they still have a months worth of recordings when its claimed recordings are not kept?

• Amazon Sends 1,700 Alexa Voice Recordings to a Random Person The intimate recordings paint a detailed picture of a man’s life.

And then Logitech shoots its self, and 3rd parties in the foot:

• Logitech disables local access on Harmony Hubs, breaks automation systems

 

More cheerful news on breaches and hackers resumes below:

• NASA discloses data breach (ZDNet)

• American bloke hauls US govt into court after border cops “cuffed him, demanded he unlock his phone at airport”

• Don’t Let DNS Flag Day Become Your DNS Doomsday

• Facebook defends giving tech giants access to extensive user data (ZDNet)

• Facebook Share Plunges Following Allegations of Data Sharing

• France fines Uber 400,000 euros over huge data breach

• Fraudulent Tactics on Amazon Marketplace

• Google is reading text in YouTube videos for search crawling without user consent

• Hacker spoofing bypasses 2FA security in Gmail, targets secure email services

• Hackers Enslaving More and More Smart Home Networks

• Hackers Intercepted EU Diplomatic Cables for 3 Years (InfoRiskToday)

• How one hacked laptop led to an entire network being compromised (ZDNet)

• Microsoft Issues Emergency Fix for IE Zero Day

• Microsoft officially announces “Windows Sandbox” for running applications in isolation (ZDNet)

• Nokia denies leaking internal credentials in server snafu

• PewDiePie Hackers Launch Second Printer Siege, According to Reports The hackers behind the attack said they have targeted 100,000 more printers in the latest attack dubbed #PrinterHack2.

• Popular avatar app Boomoji exposed millions of users – contact lists and location data

• Port 8545 and Ethereum Wallets, A Very Bad Combination

• Remote Firmware Attack Renders Servers Unbootable

• Researchers make RAM from a phase change we don’t entirely understand

• Researchers slam Hola VPN over absent encryption, user IP leaks

• Spooked by a speaking security camera? Polite hacker tells owner how to fix his IoT security

• Thousands of Jenkins servers will let anonymous users become admins

• Twitter discloses suspected state-sponsored attack

• Twitter tumbles on concerns about hacking activity, data theft attempt

• Who”s watching you from an unmarked van while you shop in London? Cops with facial recog tech

• New Wave of HMRC Scam Calls Hits UK

• Report: Facebook let major tech firms access private messages, friends lists

• Two Android apps used in combat by US troops contained severe vulnerabilities (ZDNet)

• Code Execution Flaw in SQLite Affects Chrome, Other Software

• Electric Vehicle Charging Stations Open to IoT Attacks Flaws could allow an attacker to stop or start a home charging station, or even change the current in order to start a fire.

• Facebook Flaw Exposes Private Photos for 6.8M Users The bug allowed 1,500 apps built by 876 developers to view users’ unposted _draft_ photos.

• File Inclusion Bug in Kibana Console for Elasticsearch Gets Exploit Code