Weekly Cyber Security News 15/12/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Quite a batch this week to liven up a cold wet Friday… Ever wondered why a video streaming site was laggy? Might not be a bandwidth or GPU issue after all…

• Popular streaming sites secretly mine cryptocurrency while you watch free movies

When they are determined to get you:

• Text alert: the ‘bank’ message that cost a student £5,400 of her loan money Miles Brignall has a report that I would encourage you to read

The joys of Bluetooth…. Companies adding ‘features’ because they can without little thought about if its any good…

• Researchers use BlueSteal to remotely crack ‘smart’ handgun safe in seconds

 

And what’s left:

• eBay Privacy Breach Exposes Customer Names on Google Ina Steiner reports

• Microsoft Says ERP Product Private Key Leak Posed Little Risk

• Researchers’ tool uncovers website breaches

• Top Security Firm Admits to MitM Security Incident Catalin Cimpanu reports

• 4 Applied Materials executives fleece company and get indicted

• 8 Out of 10 Employees Use Unencrypted USB Devices

• Adobe Patches ‘Business Logic Error’ in Flash Player

• Critical 0-Day Allows Remote Hacking of DirecTV Video Bridge

• Dormant Keylogging Functionality Found in HP Laptops

• Google Details How It Protects Data Within Its Infrastructure

• macOS Backdoor Uses Innovative Disguise Technique

• Millions Impacted by Credential-Stealers in Google Play

• Old Crypto Vulnerability Hits Major Tech Firms

• Orcus RAT Campaign Targets Bitcoin Investors

• Philippine Bank Accuses Bangladesh of Heist ‘Cover-Up’

• Stealthy Admin Accounts Found in Hybrid Office 365 Deployments

• Traffic to Major Tech Firms Rerouted to Russia

• TRITON Attacker Disrupts ICS Operations, While Botching Attempt to Cause Physical Damage

• UK Spy Chiefs Peel Back Secrecy- to Fight Cybercrime

• Employees on Public WiFi Rarely Face Man-in-the-Middle Attacks

• IoT Botnet Used in Website Hacking Attacks

• Basic training in avoiding phishing is no longer sufficient

• Golduck Malware Infects Classic Android Games

• Vulnerability Allows Modification of Signed Android Apps

• BlueBorne Attack Highlights Flaws in Linux, IoT Security Bluetooth vulnerabilities let attackers control devices running Linux or any OS derived from it, putting much of the Internet of Things at risk, including popular consumer products.

• Microsoft Azure AD Connect Flaw Elevates Employee Privilege

• Microsoft Issues Emergency Patch for ‘Critical’ Flaw in Windows Security Remote code execution vulnerability in Microsoft Malware Protection Engine was found by UK spy agency’s National Cyber Security Centre (NCSC).

• Microsoft Patches 19 Critical Browser Vulnerabilities

• NIST Publishes Second Draft of Cybersecurity Framework