Weekly Cyber Security News 22/02/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Being a popular tool, I do find it odd that while faults in Zip files have been known for a long time, WinRAR has only just been identified with similar issues. Well, better late than never I suppose:

• Nasty code-execution bug in WinRAR threatened millions of users for 14 years

Drupal and WordPress have some pretty nasty issues right now folks.  Better get patching:

• No RESTful the wicked: If your website runs Drupal, you need to check for security updates – unless you enjoy being hacked

• CVE-2019-6977: Yet Another WordPress Critical Flaw Found, Left Unpatched For 6 Years

It’s nice to know how long we have to contain threats – or is it?

• You have around 20 minutes to contain a Russian APT attack

The rest of the news…

• Data breach rumours abound as UK Labour Party locks down access to member databases

• Ixigo CEO denies breach of user data; says payments information is not stored

• 2.7 Million Health-Related Calls, Sensitive Info Exposed for Six Years

• Apple: iPhone”s Group FaceTime isn”t working as it did before eavesdrop bug fix (ZDNet)

• Bored bloke takes control of British Army “psyops” unit”s Twitter (The Register)

• British Intelligence Says Huawei Risk Manageable: FT

• Check yo self before you HyperWreck yo self: Cisco fixes gimme-root holes in HyperFlex, plus more security bugs (The Register)

• Criminal hacking hits Managed Service Providers: Reasons and responses

• DrainerBot infected apps play invisible videos to drain your data

• Drupal Fixes Highly Critical Vulnerability

• European governments approve controversial new copyright law

• Exploit Code Published for Recent Container Escape Vulnerability

• Google Play App Suspensions Jump 66%

• Google to Let you Link Directly to a Word or Phrase in Chrome

• Half of UK Firms Admit to Unknown Network Devices

• J.P. Morgan Launches First US Bank-Backed Crypto-Coin

• Key takeaways from damning UK report on Facebook’s world of ‘digital gangsters’

• Major Crypto Brokerage Coinmama Reports 450,000 Users Affected by Data Breach

• Microsoft publishes security alert on IIS bug that causes 100% CPU usage spikes

• Optus Customers Saw Incorrect Info After Logging Into My Account Site

• Report: UK Believes Risk of Using Huawei Is Manageable (InfoRiskToday)

• Researcher: Not Hard for a Hacker to Capsize a Ship at Sea Capsizing a ship with a cyberattack is a relatively low-skill enterprise, according to an analysis from Pen Test Partners.

• Severe vulnerabilities uncovered in popular password managers (ZDNet)

• Sweden’s Patient Hotline in Major Privacy Snafu

• Swedish Privacy Snafu Affected More Companies

• Toyota Australia confirms “attempted cyber attack” (ZDNet)

• Toyota Australia driven offline by cyber attack, as heart hospital hit by ransomware

• UK Spooks Give Green Light to Huawei

• Unearthed emails could be smoking gun for epic GDPR battle against Google, adtech giants (The Register)

• Value of Stolen Card and Amazon Account Details Rockets

• Welcome to the sunlit uplands of HTTP/2, where a naughty request can send Microsoft”s IIS into a spin (The Register)

• What Are 5 Eyes, 9 Eyes and 14 Eyes Countries and Why You Should Care?

• Windows 7 users: You need SHA-2 support or no Windows updates after July 2019 (ZDNet)

• Forget Phishing and Ransomware. Formjacking Is the New Favorite Hack of Cyber Crooks

• Hackers Use Compromised Banks as Starting Points for Phishing Attacks

• Microsoft Edge Secret Whitelist Allows Facebook to Autorun Flash

• 19-Year-Old WinRAR Flaw Plagues 500 Million Users Users of the popular file-compression tool are urged to immediately update after a serious code-execution flaw was found in WinRAR.

• Data-spewing Spectre chip flaws can”t be killed by software alone, Google boffins conclude

• Password Manager Firms Blast Back at ‘Leaky Password’ Revelations 1Password, Dashlane, KeePass and LastPass each downplay what researchers say is a flaw in how the utilities manage memory.

• Researcher Earns $10,000 for Another XSS Flaw in Yahoo Mail

• WhatsApp Flaw Could Enable iOS Message Snooping (InfoRiskToday)