Weekly Cyber Security News 04/01/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Looks like 2019 starts as busy as the previous year ended, breaches and failures all around. Let’s start with a pretty dumb but not uncommon issue – someone entering the wrong email address. How bad can that go?

• Um, I”m not that Gary, American man tells Ryanair after being sent other Gary”s flight itinerary (The Register)

Yet another biometric authentication method suffers a set back:

• Hackers bypassed vein based authentication with a fake hand

I recently had to replace one of my outdoor CCTV cameras and this kind of problem is why I immediately locked down all features and removed phone apps once it was up and running:

• Guardzilla Home Cameras Open to Anyone Wanting to Watch Their Footage The home surveillance cams have hard-coded credentials.

 

Other exciting news to kick start the year:

• Nova warns listeners of data breach affecting more than 260,000 Australians

• Cyberattack Sabotaged Printing and Distribution of Major US Newspapers

• Data of 2.4 million Blur password manager users left exposed online

• First-Ever UEFI Rootkit Tied to Sednit APT Researcher at ESET outlines research on the first successful UEFI rootkit used in the wild.

• Hacked Mt. Gox Bitcoin Exchange Chief Maintains Innocence (InfoRiskToday)

• Hacker Stole 200+ Bitcoin from Electrum Wallet

• Hijacking Online Accounts Via Hacked Voicemail Systems Proof-of-concept hack of a voicemail systems shows how it can lead to account takeovers multiple online services.

• IL: Ousted Ogden Principal Exposed Private Student Info in New Data Breach

• Malware Attack Crippled Production of Major U.S. Newspapers Reports have linked the attack to the Ryuk ransomware.

• Massive Ad Fraud Scheme Relied on BGP Hijacking

• Mining company says first autonomous freight train network is fully operational

• Open-source devs: Wget off your bloated festive behinds and patch this user cred-blabbing bug (The Register)

• PayPal Block The Hacker News

• Pilot project demos credit cards with shifting CVV codes to stop fraud

• The hype around driverless cars came crashing down in 2018

• Website security paradox: What”s a small business to do?

• Windows 10 19H1 Update to Introduce Windows Security App Improvements

• Cyberattack Hits US Newspaper Deliveries: Report

• Beware of American Express Emails With Attached Phishing Form

• Can”t unlock an Android phone? No problem, just take a Skype call: App allows passcode bypass

• Privacy International hits out at unconsented Facebook tracking within apps (ZDNet)

• Guardzilla Security Video System Footage exposed online