Weekly Cyber Security News 02/03/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. I’m all for raising the awareness of the risk of IoT vulnerabilities however this new idea by McAfee leaves me wondering if users will be left with a false sense of security. It will have to be rock solid and from experience in the IT industry over the last couple of decades has been proved wrong so many times: 

• Alexa, ask McAfee to scan my network

A new and interesting attack vector. Considering how prevalent this subsystem is they could score well:

• Memcached Servers Being Exploited in Huge DDoS Attacks

More data exposed, from who knows where…

• 2,844 new data breaches with 80M records added to Have I Been Pwned

• Another day and Another Bulk Breach Dump Totaling over 3.4 Billion Credentials

Other news

• New details emerge on Roomsurf hack

• Another massive DDoS internet blackout could be coming your way

• GitHub Enforces Stronger Encryption

• GitLab Patches Domain Hijacking Vulnerability

• Intel Releases Spectre Patches for Broadwell, Haswell CPUs

• Russian computer hackers in Colorado sold stolen credit card numbers for $3.6 million Kirk Mitchell reports

• UK: Hackers break into school’s CCTV system and stream footage of pupils live on the internet James Tozer reports

• ‘Critical’ T-Mobile Bug Allowed Hackers To Hijack User’s Accounts Lorenzo Franceschi-Bicchierai reports

• _RedDrop_ Mobile Malware Records Ambient Audio

• Avoid Becoming a Crypto-Mining Bot: Where to Look for Mining Malware and How to Respond

• Use of Fake Code Signing Certificates in Malware Surges

• NZ: Cryptolocker malware hits Inland Revenue, locks 3500 files Rob O’Neill reports

• Adobe Flash Vulnerability Reappears in Malicious Word Files CVE-2018-4878, a Flash zero-day patched earlier this month, has resurfaced in another campaign as attackers capitalize on the bug.

• Dozen Flaws Found in Trend Micro Email Encryption Gateway

• Facebook Flaw Exposed Page Administrators

• SAML Flaw Lets Hackers Assume Users’ Identities