Weekly Cyber Security News 29/06/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news.Well, what a week for interesting and often explosive news. To start off let’s first point out a follow-up article to last week’s theme. A quite disturbing one actually and well worth consideration:

• Not hackers but exes are remotely controlling smart devices for domestic abuse

Lots of news this week and the one that really rises to the top is a huge leak of demographic data which could be quite revealing:

• Marketing Firm Exactis Leaked a Personal Info Database With 340 Million Records Andy Greenberg reports

• Newly Revealed Exactis Data Leak Bigger Than Equifax’s Marketing data firm left its massive database open to the Internet

And finally to round off with a nasty issue that is going to affect a lot of web sites if they make use of the login feature for users:

• Unpatched WordPress Flaw Leads to Site Takeover, Code Execution

Here are the other bits that just couldn’t quite fit in:

• Comcast fixes another Xfinity website data leak Zack Whittaker reports

• Education Scotland order hard reset on school social networking app following major security breach Derek Healey reports.

• Possible Data Breach at Adidas Could Impact Millions of U.S. Customers

• Ticketmaster Chat Feature Leads to Credit-Card Breach Name, address, email address, telephone number, payment details and Ticketmaster login details were potentially compromised for tens of thousands of customers.

• Ticketmaster investigates potential data security breach Jackie Fox reports

• ‘Have I Been Pwned’ Now Built into Firefox, 1Password

• ‘Pay Up or Get WannaCry Hit’ Extortion Email Spreading

• 65% of Resold Memory Cards Still Pack Personal Data Analyzed cards, mainly from smartphones and tablets, contained private personal information, business documentation, audio, video, and photos.

• Cracking Cortana: The Dangers of Flawed Voice Assistants

• EFF Secures Email Delivery With STARTTLS Everywhere

• Facebook, Google ‘Manipulate’ Users to Share Data Despite EU Law

• Fastbooking Hack Leaves Japan Hotel Red-Faced

• First Nationwide Undercover Operation Targeting Darknet Vendors Results in Arrests of More Than 35 Individuals

• Hackers Plant Malicious Code on Gentoo Linux GitHub Page

• Industrial IoT: Protecting the Physical World from Cyber Attacks

• Mobile Devices Exposed to Spying via Malicious Batteries

• Necurs Campaign Uses Internet Query File Attachments

• New Encrypted Downloader Delivers Metasploit Backdoor

• NSA-Linked Implant Patched to Work on Windows Embedded

• Rewards Points Targeted by Teens in Hack of 500K Accounts

• Significant DDoS Attack on ProtonMail Blamed on Russia-Linked Group

• SSDP Diffraction Abused for DDoS Amplification

• UK Publishes Minimum Cyber Security Standard for Government Departments

• UK Tax Agency Collects 5.1M Biometric Voice IDs, May Violate GDPR The agency doesn’t ask for explicit consent to collect the voiceprints; and, the deletion and erasure process lacks transparency.

• WebAssembly Changes Could Ruin Meltdown and Spectre Browser Patches The planned threading in shared memory update gives bad actors a way around the timer mitigations released by browser vendors.

• Window Snyder Joins Intel as Chief Software Security Officer

• Wi-Fi Alliance Launches WPA3 Security Standard

• Coin Miner Malware Spikes 629% in ‘Telling’ Q1

• Free Thanatos Ransomware Decryptor Released

• WannaCry Extortion Fraud Reemerges

• Watch Out for Fileless Ransomware

• 1.7 Million Phishing Emails Blocked in June: Barracuda Networks

• 4 scams that illustrate the one-way authentication problem

• Fortnite Fraudsters Infest the Web with Fake Apps, Scams Malefactors have doubled down on duping Fortnite enthusiasts

• Apple comments on erroneous reports of iPhone brute force passcode hack Rene Ritchie reports

• iOS Hack Lets Attackers Brute Force iPhone, iPad Passcodes A vulnerability in Apple’s iOS lets anyone with a Lightning cable bypass the passcode entry restriction designed to protect the company’s devices.

• Malicious App Infects 60,000 Android Devices – But Still Saves Their Batteries A battery-saving app enables attackers to snatch text messages and read sensitive log data but it also holds true to its advertising.

• Norwegian Agency Dings Facebook, Google For ‘Unethical’ Privacy Tactics Facebook and Google are doing anything they can to nudge users away from data privacy, a Norwegian agency alleged in a new report.

• ‘Wavethrough’ Bug in Microsoft Edge Leaks Sensitive Information

• Hackers Exploit Drupal Flaw for Monero Mining

• Roku TV, Sonos Speaker Devices Open to Takeover The Roku streaming video device and the Sonos Wi-Fi speakers suffer from the same DNS rebinding flaw reported in Google Home and Chromecast devices earlier this week.