Weekly Cyber Security News 22/06/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Some pretty astounding news this week, instead, I want to highlight what some could say are softer cybercrimes, which nevertheless are cybercrimes and possibly happen far to regularly and under the radar to be reported as such:

• Impatient former Hong Kong library worker arrested after stealing customer’s personal data to borrow books faster I know

• The story of Mary

• When your career is derailed by your girlfriend tampering with your email

Continuing the email theme, this one shows what can go horribly wrong when someone doesn’t pay attention to what they are clicking on:

• Email providers blacklist oregon.gov, now state can’t email some members of the public

OK, I can’t resist, let’s have an IoT story…

• ‘Unbreakable’ Smart Lock Tapplock Issues Critical Security Patch Researchers were able to discover a way to hack the device in less than an hour.

 

Some issues of the week…

• Details of 15,000 Orange users hacked Alan Hope reports

• Google Devices Leak Precise Physical Locations

• Google Home, Chromecast Leak Location Information

• macOS QuickLook Feature Leaks Data Despite Encrypted Drive Researchers demonstrate how an encrypted macOS hard drive can still leak unprotected data via the operating system’s Finder and QuickLook feature.

• macOS’ Quick Look Cache May Leak Encrypted Data

• Thousands of Mobile Apps Leak Data from Firebase Databases

• ‘Hidden Tunnels’ Help Hackers Launch Financial Services Attacks Hackers are using the infrastructure, meant to transmit data between applications, for command and control.

• 22K Open, Vulnerable Containers Found Exposed on the Net Attackers can remotely access the infrastructure to install, remove or encrypt any application that the affected companies are running in the cloud.

• AU: University of New South Wales loses data after IBM storage failure Julian Bajkowski reports

• Authorities shut down Dark Web marketplace ‘Black Hand’ Carolina reports

• Axis Cameras Riddled With Vulnerabilities Enabling ‘Full Control’ The IP cameras have a slew of bugs allowing bad actors to control them, add them to a botnet, or render them useless.

• Compromised GitHub Account Spreads Malicious Syscoin Installers

• Exposed Container Orchestration Systems Putting Many Orgs at Risk More than 22,600 open container orchestration and API management systems discovered on the Internet.

• F-Secure Acquires MWR InfoSecurity for 91 Million

• French Nationals Arrested for ‘Rex Mundi’ Hacks

• Gamers: Is Red Shell ‘spyware’ being used in the games you play?

• Hackers Crack iPhone Defense Built to Block Forensic Tools Grayshift, the company behind a system to help police break into iPhones, says it found a workaround for USB Restricted Mode.

• Hackers Steal $30 Million From Top Seoul Bitcoin Exchange

• Hackers want millions from Liberty Life, or will start releasing sensitive data

• Mylobot Botnet Emerges with Rare Level of Complexity A new botnet from the Dark Web displays a never-before-seen level of complexity in terms of the sheer breadth of its various tools.

• Tesla Employee Steals, Sabotages Company Data

• Apple Removes iPhone USB Access Feature, Blocking Out Hackers, Law Enforcement The move escalates tensions between the phone giant and federal law enforcement when it comes to mobile security.

• Kardon Loader Allows Anyone to Build a Distribution Network

• Phishers Use ‘ZeroFont’ Technique to Bypass Office 365 Protections

• Critical Flaws Expose 400 Axis Cameras to Remote Attacks

• Multi-Layered Infection Attack Installs Betabot Malware

• Researchers disclose 7 flaws in 390 Axis IP cameras, remote attacker could take control