Weekly Cyber Security News 25/01/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. While a quiet week in regards to note worthy news, there has been some interesting, and quite starling ones nevertheless. The first, and quite a nasty shock I imagine:

• Hacker Uses Nest Camera to Broadcast Hoax Nuke Alert

A few large scale breaches, but this one, both for the risk it poses to those affected, and for what such companies might be using for their own purposes is a little alarming:

• Online casino group leaks information on 108 million bets, including user details

If those weren’t chilling enough, what about a serious insider breach like this one?

• Former Employee Hacks Popular WordPress Plugin’s Website

 

More to fill the time with:

• GDPR Complaints Filed Against Eight International Streaming Companies

• Millions of financial records leaked from server not protected by password

• Bit-and-Piece DDoS Method Emerges to Torment ISPs Perpetrators are using smaller, bit-and-piece methods to inject junk into legitimate traffic, causing attacks to bypass detection rather than sounding alarms with large, obvious attack spikes.

• BlackRock exposes info on thousands of advisers via website

• Code Execution Vulnerability Impacts Linux Package Manager

• DarkHydrus Hackers Use Google Drive in Recent Attacks

• Evaluating the GCHQ Exceptional Access Proposal

• France Hits Google With 50 Million Euro Data Consent Fine

• Hackers Use PayPal to Phish with Ransomware

• Let’s Encrypt Begins Retirement of TLS-SNI-01 Validation

• Microsoft partner portal “exposes “every” support request filed worldwide” today

• Mozilla is Adding an Ad Blocker to Firefox Focus 9.0

• Two men charged with hacking into SEC in stock-trading scheme

• VLC Responds to Criticism Over Lack of HTTPS for Updates

• Community Project Crushes 100,000 Malware Sites in 10 Months

• Alphabet’s Jigsaw Helps Users Identify Phishing Attacks

• ES File Explorer vulnerabilities potentially impact 100 Million Users

• Twitter Android Glitch Exposed Private Tweets for Years Twitter has fixed the issue, which has been ongoing since 2014.

• A flaw in MySQL could allow rogue servers to steal files from clients

• PHP PEAR official site hacked, tainted package manager distributed for 6 months

• Unofficial Patches Released for Three Unfixed Windows Flaws

• Websites Can Exploit Browser Extensions to Steal User Data