Weekly Cyber Security News 05/05/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. I feel like Billy-no-mates this week, I somehow missed out on the Google Docs scam email storm.

• A Massive Google Docs Phish Might Have Stolen A Load Of Gmail Accounts (Forbes)

• Don’t click that Google Docs link! Gmail hijack mail spreads like wildfire (The Register)

• Don’t trust OAuth: Why the Google Docs worm was so convincing (ArsTechnica)

• All your Googles are belong to us: Look out for the Google Docs phishing worm (ArsTechnica)

• Bug behind Google Docs phishing phrenzy was discovered five years ago! (The Register)

• Google Docs Phishing Attack Abuses Legitimate Third-Party Sharing Phishing messages appear nearly identical to legitimate requests to share Google documents, because in many ways, they are.

• Google Docs Phishing Scam Doused After Catching Fire (SecurityWeek)

• That Massive Google Docs Phishing Attack Has Taken A Weird Turn (Forbes) 

 

However, a pretty concerning issue has been seen that I don’t think is particularly uncommon for some websites I’ve been to:

• Meet Greyhound.com, the site that doesn’t allow password changes (ArsTechnica)

 

The rest of the scary stuff….

 

• Flaws Found in Evoko Meeting Room Management Devices (SecurityWeek)

• IBM Supply Chain Breached as Storwize USBs Ship With Malware (SecurityWeek)

• IP Freely? Mr IP Freely? VoIP-for-suits firm battens down hatches after PBX data breach (The Register)

• 135 MEELLION Indian government payment card details leaked (The Register) 

• ATM security devs rush out patch after boffins deliver knockout blow (The Register)

• Botnet of Thousands of Servers Mines for Crypto-Currency

• Carbanak Hackers Refine Intrusion Tactics (SecurityWeek)

• Confirmed: Intel patches remote execution hole that’s been hidden in its chips since 2008 (The Register)

• Email Security Device quot;nomxquot; Has Serious Flaws: Researchers (SecurityWeek)

• Fuze Collaboration Platform Allowed Anyone to Download Recorded Meetings

• IBM admits it sent malware-infected USB sticks to customers (TechRepublic)

• Intel patches remote code-execution bug that lurked in CPUs for 10 years (ArsTechnica)

• Intel Warns of Critical Vulnerability in Processor Firmware

• Last year’s ICO fines would be 79 times higher under GDPR (The Register)

• Mozilla Tells Symantec to Accept Google’s CA Proposal

• Qubes kicks Xen while it’s down after finding ‘fatal, reliably exploitable’ bug (The Register)

• Thieves drain 2fa-protected bank accounts by abusing SS7 routing protocol (ArsTechnica)

• TrickerBot Trojan Targets Private Banking (SecurityWeek)

• Unity Forum Hack  Update Andreas Haugsnes writes

• Unity Game Engine Forum Hacked

• You only need 60 bytes to hose Linux’s rpcbind (The Register)

• WordPress Attacks Powered by Router Botnet Drop Rapidly 

• Doctors Regain EHR Access After Ransomware Targets Vendor (InfoRiskToday) 

• Google, Facebook Swindled in $100M Payment Scam Lithuanian man impersonated an Asian-based manufacturer to trick Facebook and Google into paying him $100 million.

• Pen-tester gets past Microsoft VB macro barriers (The Register)

• After years of warnings, mobile network hackers exploit SS7 flaws to drain bank accounts (The Register)

• Intel Alert: Critical Security Flaw Affects Many Chipsets (InfoRiskToday)

• Unpatched WordPress Password Reset Flaw Disclosed (SecurityWeek)