Weekly Cyber Security News 11/12/2015

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

Certainly been a busy time of year!

General

• ‘fess up: New EU Law makes companies report their breaches (SC Magazine)

• ‘The Independent’ hacked, redirects to Angler Exploit Kit (SC Magazine)

• 78 bugs in last Adobe Patch Tuesday of the year (SC Magazine)

• Adobe’s final patch update this year: 78 bugs squashed (ZDNet)

• No. Too far…   American hacker duo throws pwns on IoT BBQs, grills open admin (The Register)

• Apple Issues Security Updates for OS X, iOS, Safari (SecurityWeek)

• Borg bitten by Java deserialisation bug, working on patch (The Register)

• CryptoPeak HTTPS patent cases settled out of court (ZDNet)

• Dailymotion hit by malvertising attack as perpetrators up their game’ (The Register)

• DailyMotion served Angler exploit kit to visitors, over 128 million users placed at risk (ZDNet)

• December Patch Tuesday avalanche of patches includes leaked Xbox certificate (ArsTechnica)

• GCHQ Christmas Card asks YOU the questions (The Register)

• Hacked at sea: Researchers find ships data recorders vulnerable to attack (ArsTechnica)

• Insurer now offering troll insurance for victims of online harassment (ArsTechnica)

• Internet’s root name servers DDoS attacks peak at 5M queries per second (SC Magazine)

• JD Wetherspoon loses data of over 650,000 customers in cyberattack (ZDNet)

• Kill Flash Now: 78 bugs patched in latest update (The Register)

• Let’s Encrypt Enters Public Beta (SecurityWeek)

• Let’s Encrypt says get your free digital security certificates here (SC Magazine)

• Linksys routers vulnerable through CGI scripts (The Register)

• Lock up your top-of-racks, says Cisco, there’s a bug in the USB code (The Register)

• Mandatory data breach reporting rules finally agreed by EUrocrats (The Register)

• McAfee Security Manager lets anybody bypass managers’ security (The Register)

• Microsoft inadvertent disclosed private keys for *.xboxlive.com MSA 3123040 (Reddit)

• Microsoft leaks Xboxlive SSL server cert (The Register)

• Millions affected. Major exploit in Bell Canada’s HomeHub 1000 2000 routers reveals WPA2-PSK in under one second. (Reddit)

• Millions of Internet Explorer users must update, or lose patches (ZDNet)

• Millions of websites vulnerable: Veracode (SC Magazine)

• Mystery attackers bombard servers at the internet’s core (ZDNet)

• Patch Tuesday Warmup: Internet Explorer Sunset and Windows XP Embedded End of Support, (Tue, Dec 8th)

• Patch Tuesday: Microsoft publishes 12 bulletins, 8 critical (SC Magazine)

• SHA1 sunset will block millions from encrypted net, Facebook warns (ArsTechnica)

• Steam tightens trading security amid 77,000 monthly account hijackings (ArsTechnica)

• The European Union’s case of doublethink: New cybersecurity rules and backdoor dreams (ZDNet)

• UK agency: Cyber-attack suspects’ average age down to 17 (Yahoo Security)

• UK Police Campaign Targets Hackers as Young as 12 (SecurityWeek)

• UK police target script kiddies, teenage hackers (ZDNet)

• UK pubs group JD Wetherspoon hit by cyber attack (Yahoo Security)

• UK research network Janet under ongoing and persistent DDoS attack (The Register)

• Wetherspoons: A ‘hacker’ nicks 650,000 pub-goers’ data (The Register)

• Wireless Hello Barbie back under the spotlight for slipshod security (The Register)

• WordPress hosting biz confesses to breach, urgently contacts 30,000 users (The Register)

• WPEngine Account Credential Breach (Reddit)

Malware

• ‘Legacy’ WordPress blog site of lt;igt;The Independentlt;/igt; serving malware (The Register)

• Cybercrime article on Guardian site delivers malware via Angler EK (SC Magazine)

• Phony ‘Steam escrow’ site used to deliver malware (SC Magazine)

User Space

• Apple Patches Everything, (Tue, Dec 8th)