Weekly Cyber Security News 24/03/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. I hear today of something nasty brewing in the CA world…

• Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs (ArsTechnica)

That one sort of over shadows the epic fail of yet another IoT device. Utterly amazed at how bad this one is. Or am I? Can anyone out there point me to an IoT device that actually has thought things through?

• Nest CCTV cameras can be easily blacked out by Bluetooth burglars (The Register)

For the rest of the news…

• Affiliated Sant Group learned that patient info was exposed on GitHub for years

• Android Forums resets passwords after breach (The Register)

• Three cops to data breach (The Register)

• UK: 26 million NHS patients records in security scare over SystmOne ‘enhanced data sharing’

• UK: Three Data Breach Exposes Mobile Customer Account Details To Total Strangers Steve McCaskill reports

• What should password managers not do? Leak your passwords? What a great idea, LastPass (The Register)

• Apple Extortion Attempt by Hackers Likely a Bluff (InfoRiskToday)

• Cisco Finds Zero-Day Vulnerability in CIA Attack Tool Dump (InfoRiskToday)

• Confirmed: TSA bans gear bigger than phones from plane cabins (The Register)

• eBay dumps users into insecure authentication mechanism (The Register)

• Fileless Attack Can Bypass User Account Control in Windows 10

• Firefox gets complaint for labeling unencrypted login page insecure (ArsTechnica)

• Git sprints carefully towards SHA-1 deprecation (The Register)

• India’s Banks Must Move to Aadhaar-Based Biometric Authentication (InfoRiskToday)

• LastPass Fixes Software Error That Exposed Passwords (InfoRiskToday)

• Maryland man uses Twitter to cause epileptic writer to have a seizure, leading to FBI arrest (TechRepublic)

• McDonalds India is leaking 2.2 million users data Hackernoon writes

• Microsoft’s ‘Application Verifier’ bug-finder is easily pwnable (The Register)

• Researchers Hacked A MacBook Pro And Hijacked Its Touch Bar (Forbes)

• Think your Cisco switch is secure? Think again: Hundreds are vulnerable to a simple attack (TechRepublic)

• Tip for darknet drug lords: Don’t wear latex gloves to the post office (The Register)

• Use Panopticlick to find out if you’ve been betrayed by your browser (TechRepublic)

• 20 Million Mobile Devices at High Risk of Attack, Study Finds Meanwhile, a separate report by Google says half of all Android devices didn’t install a single security update in 2016.

• Non-Targeted Malware Hits 3,000 Industrial Sites a Year: Study (SecurityWeek)

• How one man’s phishing scam cost two major US tech companies $100M (TechRepublic)

• Necurs Botnet Shifts from Ransomware to Pump-and-Dump Scam (InfoRiskToday)

• Attackers Can Hijack Security Products via Microsoft Tool

• Shielding MAC addresses from stalkers is hard and Android fails miserably at it (ArsTechnica)

• LastPass Fixes Serious Security Flaw in Chrome, Firefox Extensions Password manager LastPass creates a workaround for a serious vulnerability affecting browser extensions in Chrome, Firefox, and Microsoft Edge.

• McDonalds India’s delivery app was a golden honeypot (The Register)

• Serious Flaws Found in Moodle Learning Platform (SecurityWeek)