Weekly Web Security News

This week in web security nears there is new data suggesting that 9.1% of UK companies have not protected themselves from hacking attempts and a staggering 96% of UK companies have been subject to hacking attempts. Such numbers combined with the sheer amount of articles we find each week backup the notion that web security is a problem if gigantic scale. Further to this, 9.1% (as above) are not doing anything about it! Take a look at our selection of articles found this week below.

Drupal

• Drupal flicks fix to nix OpenID admin account hijack hole (The Register)

• Drupal Security Updates Patch Several Vulnerabilities (SecurityWeek)

General

Not a great week for ‘LastPass’ with a break, and the mystery around who was responsible for the Kaspersky attack deepens.

• 96% of UK corporations have been hacked, new data reveals

• Attackers Stole Certificate from Foxconn to Hack Kaspersky With Duqu 2.0 (WIRED)

• Chancellor Merkel ‘was patient zero’ in German govt network hack (The Register)

• Cyberspies Stole Legit Digital Certificates To Mask Their Malware (Dark Reading)

• Downing Street secretly deletes emails to avoid exposure to FOIeurs (The Register)

• Duqu 2.0 malware buried into Windows PCs using ‘stolen Foxconn certs’ (The Register)

• Duqu 2.0 Used Stolen Digital Certificate in Attacks: Kaspersky Lab (SecurityWeek)

• Hack Brief: Password Manager LastPass Got Breached Hard (WIRED)

• Hack of cloud-based LastPass exposes encrypted master passwords (ArsTechnica)

• Kaspersky says Iran talks spyware masqueraded under Foxconn name (Yahoo Security)

• Lastpass Breach (Reddit)

• LastPass Breached, Users Advised to Update Master Passwords

• LastPass password stash hacked time to change your password (The Register)

• LastPass Security Notice (Reddit)

• Leading password security company gets hacked; customers advised to change their master passwords (Yahoo Security)

• Password Manager LastPass Warns of Breach (IT Toolbox Blogs)

• Password service warns users to change their, yep, passwords (Yahoo Security)

• Password site LastPass warns of data breach (ZDNet)

• Researcher identifies vulnerabilities in Uber petition website (SC Magazine)

• Stuxnet spawn infected Kaspersky using stolen Foxconn digital certificates (ArsTechnica)

• Suspicious activity on LastPass network, data compromised (SC Magazine)

• Three Information Disclosure Vulnerability (Reddit)

• Uber Petition Site ‘Hacked’ And Defaced With Lyft Promotion (Forbes)

• Uber’s website was hacked to display an ad for rival company Lyft (Reddit)

Infrastructure

• Canonical Patches Privilege Escalation Vulnerability in Ubuntu (SecurityWeek)

• D-Link DSP-W110 WiFi socket, multiple vulnerabilities including arbitrary command execution (Reddit)

• Earlier today a massive route leak initiated by Telekom Malaysia (AS4788) caused significant network problems for the global routing system. (Reddit)

• No End In Sight For Exposed Internet Of Things, Other Devices (Dark Reading)

• Vapourware no more: Let’s Encrypt announces first cert dates (The Register)

Malware

• Blackhats exploiting MacKeeper hole to foist dangerous trojan (The Register)

• Information-Stealing Malware �Stegoloader� Hides in Image File

• Spearphishing and how to stop it: Some lessons from AusCERT (ZDNet)

User Space

A week that sees both iOS and Android having serious holes in critical parts of the system.

• ‘600m Samsung phones’ can be hijacked with a man-in-the-middle diddle (The Register)

• Apple CORED: Boffins reveal password-killer 0days for iOS and OS X (The Register)

• chromium: unconditionally downloads binary blob from Google (turns mic on and starts listening) (Reddit)

• New exploit turns Samsung Galaxy phones into remote bugging devices (ArsTechnica)

• Samsung Galaxy S6 Vulnerable To Cunning Keyboard Cracking Attack (Forbes)

• Serious OS X and iOS flaws let hackers steal keychain, 1Password contents (ArsTechnica)

• SwiftKey Bug Puts Millions of Samsung Galaxy Phones at Risk (SecurityWeek)

• Swiftkey keyboard in various stock Samsung ROMs vulnerable to RCE, even if 3rd party keyboard in use. (Reddit)

• XARA Flaws: 0-days allowing to steal (keychain) passwords, tokens, IPC sniffing, etc. in OS X iOS (Reddit)

WordPress

• Yoast WordPress SEO Plugin