Weekly Cyber Security News 20/07/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Starting off this week, something that is becoming a regular occurrence; researchers against vs vendor battles. This one in particular have flavours of MongoDB about it, and they eventually backed down and couldn’t depend on the users doing the right thing. This vendor may also have to take that route eventually:

• Vulnerability or Not? Pen Tester Quarrels With Software Maker

While we all know about news of world events being a lure for phishing the inattentive public, on the other side of the coin, various interested parties also want to inside news but decide to go for the direct option:

• Russia Targeted by Almost 25 Million Cyber-Attacks During World Cup: Putin

• Cyberattacks in Finland Surge During Trump-Putin Summit

Seeing its a ‘thing’ now in this slot to have a bash at IoT, what about this one? I just love the thought of this…

• IoT Robot Vacuum Vulnerabilities Let Hackers Spy on Victims Two vulnerabilities were discovered on Dongguan Diqee-branded vacuum cleaners, Thursday.
• New Scanner Aims to Protect Home Networks Software pinpoint vulnerabilities and offers suggestions for remediation.

• Robotic Vacuums May Hoover Your Data Researchers have discovered a pair of vulnerabilities that allow unauthorized code execution in a robotic vacuum.

 

Other fun news:

• Proposed EU Cybersecurity Product Certification Scheme Has Global Effects

• Huawei security concerns Angus Grigg reports

• Telefonica breach exposes personal data of ‘millions’ of customers Carly Page reports

• 800K Patient Records At Issue in ProCare Health

• Charitable Hackers Collaborate in Deep Web Forums

• Malicious ESLint Packages Steal Software Registry Login Tokens

• Malware Creator Admits to Building and Selling LuminosityLink RAT

• Oracle Sets All-Time Record with July Critical Patch Update

• Peer-to-Peer Crypto-Exchanges

• RATs Bite Ukraine in Ongoing Espionage Campaign

• Support for Python Packages Added to GitHub Security Alerts

• Symantec Launches Email Threat Isolation Solution

• Thousands of Mega logins dumped online, exposing user files Zack Whittaker reports

• UK: Independent Inquiry into Child Sexual Abuse fined £200,000 for revealing identities of possible abuse victims in mass email

• ZoomEye IoT search engine cached login passwords for tens of thousands of Dahua DVRs

• ‘IT system issue’ caused cancellation of British Airways cancelled flights at Heathrow

• Attackers Target iPhones Using Open Source MDM Solution

• How crooks conduct Money Laundering operations through mobile games

• ‘Blackgear’ Cyberspies Resurface With New Tools, Techniques

• A few days after discovery of GandCrab ransomware ver 4.0, experts found 4.1 version

• CSE Malware ZLab ‘Operation Roman Holiday’ Hunting the Russian APT28

• Samsam infected thousands of LabCorp systems via brute force RDP Steve Ragan reports

• Stealthy Malware Hidden in Images Takes to GoogleUserContent

• DanaBot Trojan Targets Bank Customers In Phishing Scam A new phishing scam purports to be MYOB invoices but really contains a novel banking trojan.

• Cyber espionage campaign targets Samsung service centers in Italy

• Researchers Stealthily Manipulate Road Navigation Systems

• No Evidence of GandCrab Leveraging SMB Exploit – Yet

• Siemens Informs Customers of New Meltdown, Spectre Variants