Weekly Cyber Security News 01/03/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Lots of buzz around a particularly embarrassing and damaging leak announced yesterday:

• Dow Jones Risk Screening Watchlist Exposed Publicly in a Major Data Breach

So many other amazingly interesting articles this week. Its been hard to choose, but this one reveals a potential concern in an area where many hope to gain extra security in the cloud:

• Hackers Can Plant Backdoors on Bare Metal Cloud Servers

Back to a regular swipe at IoT now, where the little things make for a fun day…

• Your Smart Coffee Maker is Brewing Up Trouble

 

Other awesome issues of the week:

• AltFS Fileless File System Aims to Evades Detection by Security Software

• Commonwealth Ombudsman singles out Home Affairs over stored communications and metadata handling (ZDNet)

• Crypto Mining Service Coinhive to Call it Quits

• Delhi Citizens Data Leak

• Elasticsearch Clusters Under Attack From Multiple Hacking Groups

• EOS/USD market drops by 4% following $7.7 million EOS hack attack.

• Former Grad Destroys Computers with Killer USB

• Hacker steals $7.7 million in EOS cryptocurrency after blacklist snafu

• ICANN: There is an ongoing and significant risk to DNS infrastructure (ZDNet)

• LinkedIn Messaging Abused to Target US Companies With Backdoors

• Most UK IT Security Leaders Fear CNI Attack

• MWC 2019: Your bionic hand is now at risk from hackers (ZDNet)

• New Attack Runs Code After Closing Browser Tab

• New Attacks Show Signed PDF Documents Cannot Be Trusted

• NVIDIA GPU Display Driver Needs Patching after Disclosure of 8 Issues

• Payroll Provider Gives Extortionists a Payday

• Plain wrong: Millions of utility customer’s passwords stored in plain text

• Supermicro hardware weaknesses let researchers backdoor an IBM cloud server

• Surprise, surprise, yet another cryptocurrency creator collared, hit with $6 million fraud rap

• Surveillance firm asks Mozilla to be included in Firefox”s certificate whitelist

• Tax Returns Exposed in TurboTax Credential Stuffing Attacks

• Thunderclap Vulnerabilities Allow Attacks Using Thunderbolt Peripherals

• Topps.com Sports Collectible Site Exposes Payment Info in MageCart Attack

• ToRPEDO Privacy Attack on 4G/5G Networks Affects All U.S. Carriers The attack threatens users with location-tracking, DoS, fake notifications and more.

• Two weeks after hackers tried to steal 13 million euros, Bank of Valetta goes offline again

• UK Banks Reported 480% More Breaches in 2018

• Web Site for a Bangladesh Embassy Compromised with Malicious Docs

• B0r0nt0K Ransomware Wants $75,000 Ransom, Infects Linux Servers

• Running Elasticsearch 1.4.2 or earlier? There”s targeted malware going for your boxen

• UN Aviation Agency Concealed Serious Hack: Media

• Office 365 Phishing Page Comes with Live Chat Support

• TLS 1.3 Support Coming to iOS 12.2, Enabled System-Wide in Beta Releases

• Windows 10 previews grind to halt over GSOD bug that Microsoft can”t fix (ZDNet)

• Chrome Zero-Day Exploited to Harvest User Data via PDF Files

• Cisco Patches High-Severity Webex Vulnerability For Third Time Third time’s hopefully a charm for Cisco, which has patched a high-severity flaw once again in its Webex video conferencing platform.

• Cryptocurrency Miners Exploit Latest Drupal Flaw (InfoRiskToday)

• CVE-2019-9019 affects British Airways Entertainment System on Boeing 777-36N(ER)

• Ready for another fright? Spectre flaws in today”s computer chips can be exploited to hide, run stealthy malware

• Ring Doorbell Flaw Opens Door to Spying Researchers are urging Ring users to update to the latest version of the smart doorbell after a serious flaw triggered privacy concerns.

• Thunderclap flaws impact how Windows, Mac, Linux handle Thunderbolt peripherals (ZDNet)