Weekly Cyber Security News 08/02/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Some absolute gems this week – that’s a bad thing, right? As the stakes rise for security risk and disclosure, two articles tweaked my attention on how it can sometimes not go right; for both sides. Something we all have to learn and build upon errors:

• Vendor allegedly assaults security researcher who disclosed massive vulnerability

• Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

Then we have something creepy and a little worrying for other IoT devices. Time to find out if there are any other surprises in that box you have sitting and listening to you:

• Nest Secure had a secret microphone, can now be a Google Assistant

Breaches are bad. Breaches that include inflammatory material and accusations are even worse:

• B&Q data leak exposes information on 70,000 thefts from its stores, including names of suspected offenders

 

The rest of the week’s nightmares:

• Houzz Urges Password Resets After Data Breach The decorating website said that account usernames, passwords and more have been compromised as part of a breach.

• Pentesters breach 92 percent of companies, report claims (ZDNet)

• $145 million funds frozen after death of cryptocurrency exchange admin (ZDNet)

• 59K Data Breaches Reported, 91 Fines Imposed Since GDPR Enactment

• Australian government computing network reset following security “incident” (ZDNet)

• Boffin suggests Trappist monk approach for Spectre-Meltdown-grade processor flaws, other security holes: Don”t say anything public zip it

• Canberra ignoring “overwhelming empirical evidence” on encryption busting (ZDNet)

• China hacked Norway”s Visma cloud software provider

• Chrome extension with millions of users is now serving popup ads

• Digital sign systems allowed hacker access through default passwords (ZDNet)

• EFF has an encryption plan for the entire internet

• EU orders recall of children”s smartwatch over severe privacy concerns

• Facebook broad data collection ruled illegal by German anti-trust office

• Firefox to get a “site isolation” feature, similar to Chrome

• Flaw in Multiple Airline Systems Exposes Passenger Data Up to eight airlines do not encrypt e-ticketing booking systems leaving personal customer data open for the taking.

• Hi, Jack”d: A little PSA for anyone using this dating-hook-up app… Anyone can slurp your private, public snaps

• I won”t bother hunting and reporting more Sony zero-days, because all I”d get is a lousy t-shirt (The Register)

• India’s largest bank SBI leaked account data on millions of customers

• Kwik-Fit in Trouble After IT Systems Go Down

• LibreOffice and Apache OpenOffice vulnerable to same bug; only one is fixed

• Linux kernel gets another option to disable Spectre mitigations (ZDNet)

• Metro Bank Victim of Sophisticated 2FA Attack That Exploits S77

• MongoDB databases still being held for ransom, two years after attacks started (ZDNet)

• Mozilla Resumes Firefox 65 Rollout After AVs Disable HTTPS Scanning

• New SpeakUp Backdoor Infects Linux and macOS with Miners

• Outlaw Shellbot infects Linux servers to mine for Monero

• Over 485,000 Ubiquiti devices vulnerable to new attack (ZDNet)

• RDP Clients Exposed to Reverse RDP Attacks by Major Protocol Issues

• Recently patched Ubuntu needs another quick patch (ZDNet)

• Security Analysis of the LIFX Smart Light Bulb

• Software executive exploits ATM loophole to steal $24 million (ZDNet)

• Trakt app users” personal data exposed: We were hit by a “PHP exploit”… back in 2014

• Two hacker groups responsible for 60 percent of all publicly reported hacks

• UK Consumers Not Happy with PSD2 Fraud Rules

• What are Data Manipulation Attacks, and How to Mitigate Against Them Hackers don’t always steal data. Sometimes the goal is to manipulate the data to intentionally trigger external events that can be capitalized on.

• Who are the last people you”d expect to spill thousands of student records? A computer science dept? What a fantastic guess

• Zcash cryptocurrency fixes infinite counterfeiting vulnerability (ZDNet)

• Check-in Links Sent by Several Airlines Expose Passenger Data

• Failed Fraud Against UK Bank Abused Mobile Infrastructure (InfoRiskToday)

• The Tricky Balance in Declining or Accepting Online Payments

• Exclusive: spreading CSV Malware via Google Sheets

• Google Patches Critical .PNG Image Bug Eleven critical bugs will be patched as part of the February Android Security Bulletin.

• It”s 2019, and a PNG file can pwn your Android smartphone or tablet: Patch me if you can

• Phishers Leveraging Google Translate to Target Google and Facebook Users

• Windows Firefox 65 rollout halted by Mozilla: AV clash stopped users browsing (ZDNet)