Weekly Cyber Security News 25/03/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

Stories Of the Week

The Bangladesh bank attack rolls on and continues to twist at every turn – missing and then found staff, legal action and now someone saying they know something about it. How will this develop?

DROWN is still rolling on with lack of interest dealing with the problem.

Android and iOS exposed to some pretty bad vulnerabilities.

Links

 

• 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking

• Android rooting bug opens Nexus phones to permanent device compromise (ArsTechnica)

• Apple Patches Serious Encryption Flaws in iMessage (SecurityWeek)

• Attackers Alter Water Treatment Systems in Utility Hack: Report (SecurityWeek)

• Bangladesh Bank debates lawsuit against Federal Reserve over cyber fraud (ZDNet)

• Bangladesh Bank heist shows weak spots in finance safeguards (Yahoo Security)

• Bangladesh Central Bank ‘Complicit’ in Heist: Minister

• Bangladesh central bank weighs lawsuit against NY Fed over cyber heist (Yahoo Security)

• Bangladesh Heist Exposes Philippine Dirty Money Secrets (SecurityWeek)

• Bangladesh IT Expert Missing After Bank Heist Remarks (SecurityWeek)

• Bangladesh seeks FBI’s help in investigating central bank heist (Yahoo Security)

• Bangladesh tech expert who went missing after cyber theft returns (Yahoo Security)

• Bangladesh’s ‘Missing’ IT Expert Found

• Chinese man named in Bangladesh cyber heist to ‘answer everything’: lawyer (Yahoo Security)

• Clear April 12: Windows, Samba to splat curious ‘crucial’ Badlock bug (The Register)

• Crypto vulnerability lets attackers decrypt iMessage photo, article warns (ArsTechnica)

• Cyber expert disappears after comments on Bangladesh central bank heist (Yahoo Security)

• FBI probes Bangladesh bank account cyber theft: WSJ (Yahoo Security)

• FBI to Assist Bangladesh With Probe Into Central Bank Heist (SecurityWeek)

• Google Adds Certificate Transparency Log for Untrusted CAs (SecurityWeek)

• Google builds list of untrusted digital certificate suppliers (ZDNet)

• Google publishes list of Certificate Authorities it doesn’t trust (The Register)

• Google slings critcial patch at exploited Linux kernel root hole (The Register)

• Is DROWN a ‘Hello Kitty’ SSL Vulnerability?

• Latest Stagefright worse than feared: ‘850 million’ Androids in hijack risk (The Register)

• Microsoft, Samba Preparing Patch for Severe quot;Badlockquot; Flaw (SecurityWeek)

• MITRE Puts Rapid CVE Assignment Pilot on Hold

• MITRE’s bug pilot program fix ‘indefinitely’ shelved amid criticism (The Register)

• Oh, sugar! Sysadmin accidently deletes production database while fixing a fault (The Register)

• Silverpush Quits Creeping World Out, Ceases Tracking TV Habits Via Inaudible ‘Beacons’ (Forbes)

• Sophisticated USB Trojan Spotted in the Wild (SecurityWeek)

• StartSSL Flaw Allowed Attackers to Obtain SSL Cert for Any Domain

• Swedish police investigate large cyber-attacks against media (Yahoo Security)

• Swedish sysadmins reach for the hex key, reassemble services after weekend DDoS (The Register)

• The future of our city services? Cyberattackers target core water systems (ZDNet)

• What was all that about a scary iMessage flaw? Your three-minute guide (The Register)

• Apple’s scariest bug this week: Your device pwned over Wi-Fi (ZDNet)

• 275 million Android phones imperiled by new code-execution exploit (ArsTechnica)

• Google Issues Emergency Patch For Critical Android Rooting Exploit (SecurityWeek)

• Google rushes out emergency fix for Android rooting exploit but most phones remain at risk (ZDNet)

• US warns against Android apps that secretly listen in on your TV habits (ZDNet)