Weekly Cyber Security News 12/08/2016

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

Each week when I choose which articles to curate for this list I wonder what news could out do the previous week. I think we have two in particular that float to the top, and they offer mind blowing levels of ridiculousness.

The first is Oracle, a company you would expect to know better, though this is their subsidiary Micros – a company I have had dealings with in the past. I can’t imagine the chaos there right now:

• Data Breach At Oracle’s MICROS Point-of-Sale Division Brian Krebs reports

• Oracle Probes MICROS PoS System Breach More than 700 systems may have been compromised by suspected Russian cybercriminals Carbanak Gang.

• Security breach at Oracle could affect hundreds of thousands of businesses (Yahoo Security)

• Big Red alert: Oracle’s MICROS payment terminal biz hacked (The Register)

• Oracle-owned point-of-sale service suffers from malware attack (ArsTechnica)

 

The other follows on from last week’s pop at mobile apps. The UK banking system is trying to mix things up and encourage customers to shop around. Their idea is to create a mobile phone app that allows customers to compare bank account deals and to ease migration. See where this is going? As soon as I saw that on the news I ROLF’d, and it looks like I wasn’t the only one!

• Funny story, this. UK.gov’s ‘open banking app revolution’. Security experts not a fan of it (The Register)

 

And why not check the rest of the exciting news of breaches and other silliness!

• Apple, Intel, Google Employee Accounts Exposed in Data Breach of Developer Forum Joseph Cox reports

• AdBlock Plus blocked in China: 159m forbidden from stripping adverts (The Register)

• Australia census to go back online 2 days after cyberattack (Yahoo Security)

• Australia Online Census Shutdown After Cyber Attacks (SecurityWeek)

• Australia’s controversial census in chaos after possible cyber attack (Yahoo Security)

• Australian census back online 2 days after cyberattack (Yahoo Security)

• Australian Census Disrupted by DDoS (InfoRiskToday)

• Australian online census shut down by cyberattacks (Yahoo Security)

• Cybercrime Gang Suspected in Attack on Oracle PoS Division (SecurityWeek)

• Glassdoor ‘Carelessly’ Exposed 600K Users Emails

• Go-Based Linux Trojan Used for Cryptocurrency Mining (SecurityWeek)

• If you use smart Bluetooth locks, you’re asking to be burgled (The Register)

• Linux bug leaves USA Today, other top sites vulnerable to serious hijacking attacks (ArsTechnica)

• London Police Busted For Windows XP Possession (InfoRiskToday)

• Own a Piece of Bitcoin History (InfoRiskToday)

• Secure Boot Vulnerability Exposes Windows Devices to Attacks

• ‘It was an attack’: Australian census website collapses due to ‘malicious foreign hackers’ Catherine Healey reports

• Classic Shell hackers: We infected FossHub so ransomware couldn’t (and yeah, also for fun) (The Register)

• Stealthy malware infects digitally-signed files without altering hashes (The Register)

• Bungling Microsoft singlehandedly proves that golden backdoor keys are a terrible idea (The Register)

• Google says that insanely scary new Android vulnerability isnt really that scary (Yahoo Security)

• Newly Announced Chipset Vuln Affects 900 Million Android Devices Check Point Research Team details four vulnerabilities that can easily lead to full privilege escalation.

• Unpatched quot;QuadRooterquot; Vulnerabilities Put Over 900 Million Android Devices at Risk (SecurityWeek)

• Four Android Flaws Leave 900M Devices at Risk (InfoRiskToday)

• Linux security backfires: Flaw lets hackers inject malware into downloads, disrupt Tor users, etc (The Register)

• Major Qualcomm chip security flaws expose 900M Android users (ArsTechnica)

• New critical flaw makes even the most secure Android devices vulnerable to hacks (Yahoo Security)

• Samsung Pay Token Flaw Allows Fraudulent Transactions (SecurityWeek)

• Serious Flaws Found in Netgear, NUUO Network Video Recorders (SecurityWeek)