Weekly Cyber Security News 15/02/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. My heart goes out to a victim of a hack this week, an email provider who lost the lot. OK, how the guys got in leads to some questions, however the total, wilful destruction is heart breaking:

• Hacker Erases Email Provider’s Servers, Backups

• Hackers wipe US servers of email provider VFEmail

• Hackers Wipe VFEmail Servers, May Shut Down After Catastrophic Data Loss

A bit of déjà vu of last week’s news. The response to the children’s smartwatch vulnerable is staggering:

• Leaky child-tracking smartwatch maker hits back at bad PR

And after B&Q’s leak of alleged shoplifters, a breach in New Zealand goes one step further…

• NZ: Landlord’s ‘blacklist’ of tenant’s criminal convictions hacked and leaked online

Announcement too of a gapping hole in Docker, which appears to now be patched – thankfully:

• Docker runc flaw opens the door to a ‘Doomsday scenario’

 

The rest of it…

• Singapore health ministry refutes suggestions of HIV data leak coverup (ZDNet)

• 620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts

• Botched Mumsnet update allowed users to see details of stranger’s accounts

• Can two-factor authentication save us from our inability to create good passwords?

• Canonical Snapd Vulnerability Gives Root Access in Linux

• China Gives Police New Powers to Snoop on Foreign Firms

• China”s cybersecurity law update lets state agencies “pen-test” local companies (ZDNet)

• Coffee Meets Bagel Hack Disclosed to Users on Valentine’s Day

• Collection of 127 Million Stolen Accounts Up for Sale on the Dark Web

• Cyber Attack on Malta’s Bank of Valletta

• DataCamp Implements Partial Password Reset After Data Security Incident

• Dunkin” Donuts accounts compromised in second credential stuffing attack in three months

• Exposed: Instagram, OKCupid, Mumsnet All Face Data Concerns Three major websites are making data-privacy news this week.

• FBI arrests second Apophis Squad hacker in the US (ZDNet)

• First CryptoCurrency Clipboard Hijacker Found on Google Play Store

• First they came for Equifax and we did nothing because America. Now they are coming for back-end systems and we”re…

• Housing biz made to pay 1.5k for sticking fingers in its ears when served a subject access request

• Japan”s Credit Card Fraud Debacle (InfoRiskToday)

• Lenovo Watch X Riddled with Security Vulnerabilities Researchers have identified multiple security issues with this Lenovo smartwatch.

• macOS Mojave Privacy Bug Allows Malicious Apps to Access Restricted Data

• Met Facial Recognition Comes in for More Criticism

• Microsoft: 70 percent of all security bugs are memory safety issues

• Millions Affected by 500px Data Breach

• New Astaroth Trojan Variant Exploits Anti-Malware Software to Steal Info

• New TLS encryption-busting attack also impacts the newer TLS 1.3 (ZDNet)

• Oh dear, Lads: Spam marketing bosses banned from forming UK firms for clobbering folk with 500k calls and texts

• One click and you”re out: UK makes it an offence to view terrorist propaganda even once

• Patch Tuesday Roundup Includes IE Zero Day

• QNAP NAS user? You”d better check your hosts file for mystery anti-antivirus entries

• Russian MPs Back Bill to Isolate Country’s Internet

• Selling 911 location data is illegal – US carriers reportedly did it anyway

• South Korea is Censoring the Internet by Snooping on SNI Traffic

• Swiss government invites hackers to pen-test its e-voting system (ZDNet)

• UK Firms Are Drowning in Breaches

• Use an 8-char Windows NTLM password – Don”t. Every single one can be cracked in under 2.5hrs (The Register)

• Users complain of account hacks, but OkCupid denies a data breach

• Why you should choose a pseudonym at Starbucks

• With Doctored Photos, Thieves Try to Steal Bitcoin (InfoRiskToday)

• Xiaomi electric scooters vulnerable to remote hijacking

• EE customer: Creepy ex used employee access to change my mobile number, spy on me (The Register)

• USB Cable with Embedded Wi-Fi Controller

• Container Escape Flaw Hits AWS, Google Cloud, Linux Distros

• Major Flaw in Runc Poses Mass Container Takeover Risk (InfoRiskToday)

• runC Major Security Flaw Patched At Record Time, All Container Admins Expected To Update