Weekly Cyber Security News 11/05/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Apart from a glut of breaches there has been so many interesting items this week. The first of interest are new issues discovered at hardware levels. These of course have far reaching implications across swaths of vendors:

• Misinterpretation of Intel Docs Leads to Flaw in Hypervisors, OSs

• Spectre Returns with 8 New Variants

We’ve seen backdoors embedded in PHP within WordPress plug-ins before, but now it appears JavaScript is a target. A sure sign of its popularity and the wide range of use presenting an alluring target for hackers: 

• Backdoored Module Removed from npm Registry

And back to the usual, an exposed S3 container <groan>:

• Android App With 10 Million Downloads Left User’s Photos and Audio Messages Exposed to Public Lorenzo Franceschi-Bicchierai reports

Lots of other fun stuff!

• 8.7B Identity Records on Surface, Deep, Dark Webs in 2017

• Author of TreasureHunter PoS Malware Releases Its Source Code Leak gives threat actors a way to build newer, nastier versions of the point-of-sale malware, Flashpoint says.

• Hacker Shuts Down Copenhagen’s Public City Bikes System Catalin Cimpanu reports

• CVE-2018-10184 An issue was discovered in HAProxy before 1.8.8

• Firefox 60 Brings Support for Enterprise Deployments

• Hide ‘N Seek IoT Botnet Can Survive Device Reboots

• Phishing Attack Bypasses Two-Factor Authentication

• Publicly Disclosed Breaches Down Drastically in Q1 2018

• Symantec Stock Plunges After Firm Announces Internal Probe

• Telegram Rivaling Tor as Home to Criminal ‘Forums’

• UK: Data stolen in Sheffield Credit Union cyber attack BBC reports

• Who wants to go threat hunting?

• ‘I’m hacked’ message left on dozens of defaced Canon IoT security cameras in Japan

• GandCrab Ransomware Breaks Windows 7 Systems

• SynAck Ransomware Gets Dangerous ‘Doppleganging’ Feature

• Phishers Use New Method to Bypass Office 365 Safe Links

• Google Brings Android to Internet of Things

• LG Patches Serious Vulnerabilities in Smartphone Keyboard

• Bitcoin network 3 to 10 times more ‘evil’ than the rest of the internet

• Critical Code Execution Flaw Patched in Flash Player

• Electroneum Cryptomining Targets Microsoft IIS 6.0 Vulnerability

• Hackers Target Flaws Affecting a Million Internet-Exposed Routers

• Logitech Patches Several Flaws in Harmony Hub

• Microsoft Patches Two Windows Zero-Day Vulnerabilities

• Microsoft’s Patch Tuesday Fixes Two CVEs Under Active Attack