Weekly Cyber Security News 18/08/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Oh the joys and risks of 3rd party services and what you give to them that could then be used against you:

• Engineering Firm Exposed Electrical Infrastructure Details: Researchers

A popular VPN tunnel product which can be very easily switched off and expose who and where you are. Might want to check that out folks:

• TunnelBear VPN Audit Finds Few Vulnerabilities

Now, I’m generally quite cynical over technology because, well, often its a dream of the marketing department or someone wanting some gimmick to take your cash. In this case while not one of those, it seems to be a bit of a gimmick perhaps. Biometics are the cool thing to do now, but considering what pilot friends have told me about issues with fly-by-wire in the commercial world, I would hope that nothing goes horribly wrong for a pilot when the aircraft suddenly decides that the pilot is not supposed to be flying. The consequences could be dire:

• U.S. Army to Protect Warfighters With Continuous Biometric Authentication

Other news:

• US Voting Machine Supplier Leaks 1.8 Million Chicago Voter Records Dell Cameron reports

• Access Bypass Vulnerabilities Patched in Drupal 8

• 70% of DevOps Pros Say They Didn’t Get Proper Security Training in College

• Amazon Tackles Security of Data in S3 Storage

• Backdoors Found in Tools Used by Hundreds of Organizations

• BEC Attacks Don’t Always Require Sophistication

• Cerber Fights Anti-Ransomware Tools 

• Hackers Say Humans Most Responsible for Security Breaches

• Hijacked Extensions Put 4.7 Million Chrome Users at Risk

• Millions of Endpoints Exposed via RDP

• Overall Security of Password Managers Debatable, Cracking Firm Says

• TrickBot Using Legitimate Looking Sites With SSL Certificates

• APT28 Uses EternalBlue to Spy on Hotel Wifi Networks

• British Researcher Pleads Not Guilty to Creating Malware

• Cerber Ransomware Creates Self-Inflicted Canary Vaccine

• Locky Ransomware Campaign Ramps Up

• Nigerian Behind Attacks Against Over 4,000 Businesses

• SonicSpy Authors Spin Out Over 1,000 Spyware Apps

• Peace Breaks Out Between Microsoft and Kaspersky Lab

• SonicSpy Spyware Found in Over One Thousand Android Apps

• Google Pays $10,000 Bug Bounty to High School Student

• New _Disdain_ Exploit Kit Spotted on Underground Forums

• Password Flaws Patched in PostgreSQL

• Unnamed Firm Offers $250,000 for VM Hacks