Weekly Cyber Security News 30/10/2015

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

I go away for a week’s holiday and the world goes crazy with Talk Talk and a web hosting data breach, Google having a go at Symantec and a host of amazing vulnerabilities being exposed. Enjoy!

 

Drupal

• Security Flaws Patched in Joomla, Drupal (SecurityWeek)

General

• ’10-second’ hack jogs Fitbits into malware-spreading mode (The Register)

• 000webhost hacked, 13 million customers exposed (ZDNet)

• 13 Million Passwords Appear To Have Leaked From This Free Web Host (Forbes)

• 13 Million Passwords Leaked From Free Hosting Service (SecurityWeek)

• 13 million plaintext passwords belonging to webhost users leaked online (ArsTechnica)

• 15-year-old arrested over TalkTalk hack (ZDNet)

• As sites move to SHA2 encryption, millions face HTTPS lock-out (ZDNet)

• Burned: British Gas customer info hits Pastebiin (The Register)

• Dridex Still Active After Takedown Attempt (SecurityWeek)

• Fuming Google tears Symantec a new one over rogue SSL certs (The Register)

• Further confusion at TalkTalk claims it was hit by ‘sequential attack’ (The Register)

• Google replacing OpenSSL with BoringSSL (Reddit)

• Google Tells Symantec to Improve Digital Certificate Security (SecurityWeek)

• Google to Symantec: Clean up your act or be branded unsafe (ZDNet)

• Hackers can invade a PC with a 10-second attack on a Fitbit (Yahoo Security)

• Hacking puts 4 million UK telecoms customers’ data at risk (Yahoo Security)

• Jaguar car hack in New Zealand (SC Magazine)

• Joomla bug puts millions of websites at risk of remote takeover hacks (ArsTechnica)

• Joomla Flaw Exploited in the Wild Within Hours of Disclosure (SecurityWeek)

• Joomla patches critical core shop-pwning flaw (The Register)

• Lawyers harrumph at Talk Talk’s ‘no obligation to encrypt’ blurt (The Register)

• Let’s Encrypt announces browser integration (The Register)

• Lloyds Group left thousands of accounts potentially open to attack (SC Magazine)

• Low-cost IMSI catcher for 4G/LTE networks track phones precise locations (ArsTechnica)

• Mozilla may reject SHA-1 certificates six months early (SC Magazine)

• Network Time Protocol flaws defy HTTPS, cause network chaos (ZDNet)

• New NTP Vulnerabilities Put Networks at Risk (SecurityWeek)

• Northern Irish 15-year-old bailed over TalkTalk cyber attack (Yahoo Security)

• Oww: Hackers snatch 13 million 000webhost account passwords (The Register)

• Patch this braXen bug: Hypervisor hole lets guest VMs hijack hosts (The Register)

• Police arrest 15-year-old in Northern Ireland over TalkTalk hack (Yahoo Security)

• Several Flaws Patched in Xen Hypervisor
• Crypto Password Service You Might Want To Use Now (Forbes)

• Still fuming over HTTPS mishap, Google gives Symantec an offer it cant refuse (ArsTechnica)

• Talk Talk says cyberattack data theft not as bad as feared (Yahoo Security)

• Talk Talk: Hackers may have nicked personal, banking info on 4m Brits (The Register)

• TalkTalk Attack Highlights Worldwide Breach Concerns (InfoRiskToday)

• TalkTalk attack: ‘No legal obligation to encrypt customer bank details’, says chief (The Register)

• TalkTalk attack: Lad, 15, cuffed by UK cyber-cops (The Register)

• TalkTalk attack: Small biz customers may also have been targeted (The Register)

• TalkTalk attackers stole ‘incomplete’ customer bank data, ISP confirms (The Register)

• TalkTalk Breach Fuels Call for Tougher UK Laws (InfoRiskToday)

• TalkTalk CEO admits security fail, says hacker emailed ransom demand (The Register)

• TalkTalk Customer Details Exposed in Data Breach (SecurityWeek)

• TalkTalk Customers Reporting Fraudulent Financial Transactions After Breach (October 23, 24, and 26, 2015) (SANS Newsbites)

• TalkTalk Cyber-Attack: Website Hit By ‘Significant’ Breach (October 23, 2015) (SANS Newsbites)

• TalkTalk cyberattack: who, what and why? (Yahoo Security)

• TalkTalk Downplays Data Breach (SecurityWeek)

• TalkTalk expects criminals unable to steal money after cyber attack (Yahoo Security)

• TalkTalk Faces Ransom Demand After Breach (InfoRiskToday)

• TalkTalk fears customer data may have been stolen in cyber attack (Yahoo Security)

• TalkTalk hack hits up to 4 million in unencrypted data theft (ZDNet)

• TalkTalk Hack: UK Police Bust Teenage Suspect (InfoRiskToday)

• TalkTalk hires BAE Systems to investigate cyber attack (Yahoo Security)

• TalkTalk hush-hush on compo for up to 4 million customers after mega cyber attack (The Register)

• TalkTalk says cyber attack could affect four million customers (Yahoo Security)

• TalkTalk shares drop 10.7% despite research that breaches don’t cause drops (The Register)

• Tardy TalkTalk advertised for a new infosec officer 1 week ago (The Register)

• Teen Arrested in Connection With TalkTalk Breach (SecurityWeek)

• Temperature of Hell drops a few degrees Microsoft emits SSH-for-Windows source code (The Register)

• The TalkTalk aftermath: Social engineering and empty bank accounts (ZDNet)

• This 11-year-old is selling cryptographically secure passwords for $2 each (ArsTechnica)

• UK police arrest 15-year-old boy after telecoms cyberattack (Yahoo Security)

• UK telecoms provider: customer data at risk after hacking (Yahoo Security)

• UK’s TalkTalk says cyber attack could affect 4 million customers (Yahoo Security)

• Updated: Analysing the TalkTalk customer database attack (SC Magazine)

• Xen patches 7-year-old bug that shattered hypervisor security (ArsTechnica)

• Xen XSA-148: PV guest breakout on x86 Xen 3.4+ (Reddit)

• Youths represent UK at first European Cyber Security Challenge (The Register)

Infrastructure

Seriously? Oh dear

• Squealing iKettles reveal owner’s Wifi passwords (SC Magazine)

Malware

• Attacker slips malware past Ubuntu Phone checks (The Register)

• Thousands of e-commerce Magento websites struck with Guruncsite malware (ZDNet)

• Thousands of Magento Sites Abused for Malware Distribution

• Google to require Android Marshmallow devices be encrypted by default (SC Magazine)

WordPress

• Critical Flaw Patched in Akismet Plugin for WordPress (SecurityWeek)