Weekly Cyber Security News 27/04/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Remember my biometrics comments last week? Well a whole new area of disturbing ‘use’ of biometrics appeared in my feed this week:

• Cops go into funeral home, attempt to unlock phone with dead man’s fingerprint

Drupal has taken a bit of a hit again this week, and if going by the weblogs I’ve seen, if you’ve not patched yet then you are likely to be compromised:

• Drupal to Release Second Drupalgeddon2 Patch as Attacks Continue

• Drupal Patches New Flaw Related to Drupalgeddon2

• More Threat Hunting with User Agent and Drupal Exploits, (Fri, Apr 27th)

In my hunt for the more amazing technical mastership of hardware hacking, I take my hat off for these guys:

• Hackers built a ‘master key’ for millions of hotel rooms Zack Whittaker reports

The other news….

• TSB chaos after online banking data leak Kayleigh Bateman reports

• Equifax has spent $242.7 million on its data breach so far Larry Dignan reports

• Careem knew ‘ or should have known ‘ that they had a serious problem last year

• Dubai’s Careem admits to data breach of 14 million users Khaleej Times reports

• $35 Million Penalty for Not Telling Investors of Yahoo Hack

• ‘Orangeworm’ Cyberspies Target Healthcare Sector in US, Europe, Asia

• Authorities Take Down Largest DDoS Services Marketplace

• Golden Galleon Raids Maritime Shipping Firms A new Nigerian criminal gang is launching attacks on the maritime industry.

• Google Discloses Windows Lockdown Policy Zero-Day

• Google Ramps Up Gmail Privacy Controls in Major Update

• How Microsoft, Amazon, Alphabet Are Reshaping Security Tech’s biggest giants are shifting the cybersecurity landscape as they incorporate security into their products and services.

• Malicious Network Traffic From /bin/bash, (Wed, Apr 25th)

• New Tool Detects Evil Maid Attacks on Mac Laptops

• Oath Pays $400,000 in Bug Bounties in One Day

• Revealed: How Kenyan hacker flew into the trap of US security agents The Standard reports

• Western Digital Cloud Storage Device Exposes Files to All LAN Users

• Why Information Integrity Attacks Pose New Security Challenges

• City of Atlanta Ransomware Attack Proves Disastrously Expensive

• Low-Cost Crimeware Kit Gaining Popularity in Underground Markets At $150 for a three-month subscription

• New Advanced Phishing Kit Targets eCommerce

• New Phishing Attack Targets 550M Email Users Worldwide In an attempt to steal financial data, the attack bribes users with coupons in exchange for taking an online quiz.

• ‘Stresspaint’ Targets Facebook Credentials

• 13 Year-Old Configuration Flaw Impacts Most SAP Deployments

• Critical Hikvision flaw could be remotely exploited to hijack cameras, DVRs and accounts

• Internet Exposure, Flaws Put Industrial Safety Controllers at Risk of Attacks