Weekly Cyber Security News 08/06/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. A real mixed bag of articles this week. The first is quite a starling claim and time will tell how viable the attack turns out to be:

• Researcher Succesfully Hacked In-Flight Airplanes From the Ground IOActive researcher will demonstrate at Black Hat USA how satellite equipment can be ‘weaponized.’

On more stable ground we have an old bug patched which could have turned nasty:

• Valve patched decade-old bug that hackers could exploit to take over Steam users’ PCs

However, some patches have still yet to be applied to something that is being actively attacked in the wild:

• Drupalgeddon 2.0 Still Haunting 115K+ Sites

• Many Drupal Sites Still Vulnerable to Drupalgeddon2 Attacks

 

In other news:

• DNA Testing Service MyHeritage Leaks User Data of 92 Million Customers

• WordPress Disables Plugins That Expose e-Commerce Sites to Attacks

• Hacker Defaces Ticketfly’s Website, Steals Customer Database Lorenzo Franceschi-Bicchierai reports

• HR Software Firm PageUp Suffers Data Breach

• Punycode Makes SMiShing Attacks More Deceiving

• 26 Million Users Hit by Ticketfly Hack

• Cloudflare Gets Transparent on DNS Resolver Outage

• Fitness app PumpUp leaked health data, private messages Zack Whittaker reports

• Google Password Protects Pixel 2 Firmware

• Honda, Universal Music Group Expose Sensitive Data in Misconfig Blunders

• Microsoft to Acquire GitHub for $7.5 Billion

• Mirai Variants Continue to Spawn in Vulnerable IoT Ecosystem

• Morinaga Milk customer data stolen after website hacking JiJi Press reports

• New Backdoor Based on HackingTeam’s Surveillance Tool

• Oops! Botnet Operators Use Default Credentials on Command and Control Server

• Personal Data Compromised in Ticketfly Hack

• Phishing Scams Target FIFA World Cup Attendees

• Public Google Groups Leaking Sensitive Data at Thousands of Orgs

• Thousands of Organizations Expose Sensitive Data via Google Groups

• Ticketfly, Major Concert Venues Still Offline After Hack

• Apple Touts Privacy Features of New Operating Systems

• WARDroid Uncovers Mobile Threats to Millions of Users Worldwide

• Researchers Warn of Microsoft Zero-Day RCE Bug

• Telegram: Apple Has Blocked Updates since April

• Apple Patches Dozens of Flaws in macOS, iOS, Safari

• Browser Side-Channel Flaw De-Anonymizes Facebook Data