Weekly Cyber Security News 26/01/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Oh dear, seems the mad rush for Meltdown has backfired and has turned into a huge embarrassing mess for the industry. What to do…

• HP, Dell Halt BIOS Updates Over Buggy CPU Patches

• Intel Halts Spectre, Meltdown CPU Patches Over Unstable Code

• Intel Says to Stop Applying Problematic Spectre, Meltdown Patch Cause of reboot problems with its Broadwell and Haswell microprocessor patching now identified, the chipmaker said.

• Fallout from Rushed Patching for Meltdown, Spectre Not all systems require full patching for the flaws right now, anyway, experts say.

• Apple Patches Meltdown Flaw in Older Versions of macOS

• Red Hat Pulls Spectre Patches Due to Instability

 

The hype with cryptocurrency looks to have bitten those that were hoping for a quick win. The scammers sure know how to make a great lure it seems:

• Hackers lure victims with fake cryptocurrency SpriteCoin

 

To round off this summary, I loved this little quote… So true, even more so if you expose it to the internet – in which case without a backup you may not have a database for long!

• QOTD Quote of the Day: Until you have backups, you don’t have a database. What you have is a prolonged period of optimism.; Laurie Voss.

Go do a backup and enjoy the weekend.

 

Other bits:

 

• Bell Canada Hit by Data Breach

• Bell Canada Hit with 2nd Breach in 8 Months Less than 100,000 customers affected in latest incident.

• Misconfigured Jenkins Servers Leak Sensitive Data

• 30 Million Possibly Impacted in Crypto-Currency Mining Operation

• Amazon Acquires Threat Hunting Firm Sqrrl

• Gemalto Licensing Tool Exposes ICS, Corporate Systems to Attacks

• How Containers & Serverless Computing Transform Attacker Methodologies

• Is the BSD OS dying? Some security researchers think so

• Kaspersky Lab Seeks Injunction Against US Government Ban Revenues and reputation have taken a hit in the wake of the US Department of Homeland Security’s decision to prohibit use of its products and services by the feds, the company says.

• New Targets, $2 Million in Prizes Announced for Pwn2Own 2018

• Personal details of 220,000 Malaysian organ donors and their next of kin leaked online Sharmila Nair reports

• SamSam Operators Make $325,000 in 4 Weeks

• UK: ICO investigates Age UK after two data breaches Kirsty Weakley writes

• UK: Top 500 Legal Firms Have Over a Million of Their Credentials Leaked on the Dark Web Rafia Shaikh reports

• World Economic Forum Announces Global Centre for Cybersecurity

• Hide ‘N Seek IoT Botnet Ensnares 20,000 Devices in Days

• Mirai-Based Masuta Botnet Weaponizes Old Router Vulnerability

• Chrome 64 Brings Additional Mitigations for CPU Flaw

• Code Execution Flaw Impacts Popular Desktop Apps

• Google Pays Researcher Record $112,500 for Android Flaw The bug bounty reward, given to a researcher who submitted a working remote exploit chain, is Google’s highest for an Android bug.

• Hackers could have exploited flaw in all Blizzard games to hijack millions of PCs

• Seagate Patches Flaws in Personal Cloud, GoFlex Products

• You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting Some bug hunters make 16 times the median salary of software engineers in their home countries.