Weekly Cyber Security News 27/11/215

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

General

• Superfish 2.0: Dell Windows Systems Pre-Installed TLS Root CA, (Tue, Nov 24th)

• Amazon force-resets some account passwords, citing password leak (ZDNet)

• Amazon resets compromised passwords: Report (The Register)

• Amazon suffers potential password leak, unknown number of accounts affected (Yahoo Security)

• Criminals Steal $4 Million In Cash With Novel ‘Reverse ATM’ Attack (Forbes)

• Data breach at firm that manages Cisco, Microsoft certifications (The Register)

• Dell acknowledges security hole in new laptops (Yahoo Security)

• Dell admits preinstalling root certificate and pledges to remove it (ZDNet)

• Dell apologizes for HTTPS certificate fiasco, provides removal tool (ArsTechnica)

• Dell instructs how to remove eDellRoot certificate, will be removed by software update today (Reddit)

• Dell Promises To Kill Dangerous Security Certificate It Shipped On PCs (Forbes)

• Exclusive: Microsoft ‘Delay in fix to Advanced Threat Protection flaw’ (SC Magazine)

• FAKBEN Team Ransomware Uses Open Source Hidden Tear Code (Reddit)

• FBI Probes 1.2B Stolen Credentials (InfoRiskToday)

• Hacker predicts AMEX card numbers, bypasses chip and PIN (The Register)

• New Linux server ransomware demands $999 bitcoin (SC Magazine)

• Pen tester sounds alert over ‘gaping’ flaws in Brit alarm platform (The Register)

• Raspberry Pi Predictable SSH host keys (Reddit)

• Reuse of Cryptographic Keys Exposes Millions of IoT Devices: Study (SecurityWeek)

• Root Certificate Shipped With Dell PCs Poses Serious Risk (SecurityWeek)

• Second Dell backdoor root cert found (The Register)

• Take A Facebook Quiz, Give Up All Your Data For Free (Forbes)

• Windows Defender removes potentially dangerous Dell certificate (ZDNet)

• Yahoo declares war on ad blockers, blocks email access (ZDNet)

Infrastructure

• Lazy IoT, router makers reuse skeleton keys over and over in thousands of devices new study (The Register)

Malware

• Alleged Malware Service Operators Arrested in UK (SecurityWeek)