Weekly Cyber Security News 24/12/2015

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerbility disclosures and cyber security news.

General

• ‘Hello Kitty’ fan site exposed, but no data stolen: web host (Yahoo Security)

• After WhatsApp’s Blackout In Brazil, Who Should Hold The Data Keys? (Forbes)

• Bitcoin’s ‘Blockchain’ Tech May Transform Banking (SecurityWeek)

• Cisco Reviewing Code After Juniper Source Code Hack (SecurityWeek)

• Damn Vulnerable Node Application (DVNA) (Reddit)

• Facebook hammers another nail into Flash’s coffin (The Register)

• FBI probes breach at Juniper Networks: CNN (Yahoo Security)

• First Exploit Attempts For Juniper Backdoor Against Honeypot, (Tue, Dec 22nd)

• From Hello Kitty To Major League Baseball, Companies Are Leaking Kids’ Data All Over The Web (Forbes)

• Google Boosting HTTPS Pages in Search Results (SecurityWeek)

• Gyft resets some customer passwords following breach (SC Magazine)

• Hack Brief: Hello Kitty Sites Spill Details of 3.3M Users (WIRED)

• Hello Kitty hack exposes 3.3 million users’ details, says infosec bod (The Register)

• Hello Kitty owner Sanrio says fan site security leak fixed (Yahoo Security)

• Hello Kitty SanrioTown breach affects 3.3 million accounts (SC Magazine)

• Hello? Barbie Made The Naughty List? Brace Yourself For The Internet Of Toys (Forbes)

• IT bloke: Crooks stole my bikes after cycling app blabbed address (The Register)

• Joomla! New Version Fixes Security Flaws (SC Magazine)

• Juniper ‘fesses up to TWO attacks from ‘unauthorised code’ (The Register)

• Juniper issues patch for ScreenOS to eliminate unauthorized code (SC Magazine)

• Juniper Says It Didn’t Work With Government To Add ‘Unauthorized Code’ To Network Gear (Forbes)

• Online broadcaster Livestream suffers possible database breach (ZDNet)

• PCI extended the migration to TLS 1.1 1.2. New deadline 2018 (Reddit)

• Quantum computing: The smart person’s guide (TechRepublic)

• RCE, SQLi Flaws Found in Popular Web Apps (SecurityWeek)

• Researchers Solve the Juniper Mystery, and They Say Its Partially the NSAs Fault (WIRED)

• The other Juniper vulnerability CVE-2015-7756, (Tue, Dec 22nd)

• The Years 11 Biggest Hacks, From Ashley Madison to OPM (WIRED)

• Xen Project blunder blows own embargo with premature bug report (The Register)