Weekly Cyber Security News 12/05/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Some pretty dire issues this week, some fixed and some not going to be fixed. On the plus side spotted this pretty handy password scoring tool, and glad to see that my usual password approach scores highly. Does yours?:

• Clever New Tool Will Keep You From Creating Bad Passwords (Forbes)

The stuff of nightmares can be found below:

• Funding Circle Error Exposes 6,000 SSNs Of American Clients Thomas Fox-Brewster reports

• Cisco kills leaked CIA 0-day that let attackers commandeer 318 switch models (ArsTechnica)

• Crooks can nick Brits’ identities just by picking up the phone and lying (The Register)

• Debenhams Flowers shoppers stung by bank card-stealing tech pest (The Register)

• Dell patches AMT-vulnerable systems (The Register)

• Exploitable Details of Intel’s ‘Apocalyptic’ AMT Firmware Vulnerability Disclosed

• Google Researchers Say They Found A ‘Crazy Bad’ Windows Bug (Forbes)

• How to remote hijack computers using Intel’s insecure chips: Just use an empty login string (The Register)

• It’s 2017 and Windows PCs are being owned by EPS files, webpages (The Register)

• Keylogger Discovered in Some HP Laptops Researchers discovered the audio driver in some HP laptops contains a tool to record and save users’ keystrokes.

• Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable (ArsTechnica)

• Microsoft Releases Emergency Patch For RCE Vuln

• NYU Accidentally Exposed Military Code-breaking Computer Project to Entire Internet Sam Biddle reports

• Realistic Brits want at least 3 security steps on bank accounts (The Register)

• Russian RATs bite Handbrake OSX download mirror (The Register)

• User Security is a Responsibility, Not an Excuse

• ‘Crazy bad’ bug in Microsoft’s Windows malware scanner can be used to install malware (The Register)

• How do ransomware scum decide what to charge you? The Big Mac index (The Register)

• SLocker Ransomware Variants Surge

• Software Download Mirror Distributes Mac Malware

• Thousands of Devices Hacked by Rakos Botnet

• Google phishing attack was foretold by researchersand it may have used their code (ArsTechnica)

• Google Tightens OAuth Rules to Combat Phishing
  

• Android O-mg. Google won’t kill screen hijack nasties on Android 6, 7 until the summer (The Register)

• High-Profile Targets Attacked via Software Update Mechanism

• More Android phones than ever are covertly listening for inaudible sounds in ads (ArsTechnica)
  

• Google Researcher Details Linux Kernel Exploit

• The hijacking flaw that lurked in Intel chips is worse than anyone thought (ArsTechnica)
  

• Malware Sends Stolen Cookies to Fake WordPressAPI Site