Weekly Cyber Security News 19/04/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. While not as main stream as Skype, Matrix has certainly gained a good following (one I’ve been personally watching for a few years myself). The announcement of a major breach via vulnerabilities in it’s Jenkins CI system do highlight that any door in will be taken and used to pivot into where the jewels really are:

• Attacker Offers Advice to Matrix.org After Hacking Its Systems

Slightly embarrassing news for Alexa, where they previously claimed that no voice recordings are kept…

• Amazon Auditors Listen to Echo Recordings, Report Says Amazon is under fire for its privacy policies after a Bloomberg report revealed that the company hires auditors to listen to Echo recordings.

And to round off with a swipe at consumer tech… The ever popular GPS tracking IoT market. Seems to be an endless stream of fails in a rush to market:

• TicTocTrack Smartwatch Flaws Can Be Abused to Track Kids A popular Australian smartwatch’s tracking capabilities expose its user’s locations, personal data and more.

Lots of more news here!

• Microsoft loses control over Windows Tiles subdomain (ZDNet)

• Mailgun hacked part of massive attack on WordPress sites (ZDNet)

• Cost of Data Breach in UK Increases More Than 41% in Two Years

• Microsoft discloses security breach impacting some Outlook accounts (ZDNet)

• Two Thirds of Hotel Sites Leak Guest Booking Info to Third-Parties

• Symfony, jQuery Vulnerabilities Patched in Drupal

• Apple scammed by college students through fake iPhone replacement scheme (ZDNet)

• Client-attorney privilege? Not when you”re accused of leaking Vault 7 CIA code

• Coin Mining Attack Cripples Production at Japanese Firm

• Cybercrime market selling full digital fingerprints of over 60,000 users (ZDNet)

• Ecuador Hit With “Cyberattacks” After Assange”s Arrest (InfoRiskToday)

• Ethical Hacking In 50 Universities Created Panic For Students In UK

• EU Citizen’s Hit by UK Government Data Leak

• European Commission: No Evidence of Issues With Kaspersky Products

• Evernote Fixes Remote Code Execution Vulnerability in macOS App

• Fake Instagram Apps on Google Play Harvest User Logins The apps, which claim to help users rack up followers, are well-rated and have been downloaded tens of thousands of times.

• FBI Non-Profit Probes Agent Data Breach

• Important Severity Remote Code Execution Vulnerability Patched in Tomcat

• Juniper slips out update after hardcoded credentials left in switches (The Register)

• New Module Suggests Fourth Team Involved in Stuxnet Development

• NoScript extension officially released for Google Chrome

• Oracle splats 300 vulns in MySQL, Database, Fusion, etc, pours fresh brew of Java SE terms

• Patched Windows Zero-Day Provided Full Control Over Vulnerable Systems

• Police use AI to track down cryptocurrency Ponzi scheme swindlers (ZDNet)

• Pregnancy club fined 400,000 for illegally sharing data of over 14 million people (ZDNet)

• Scranos Operation Uses Signed Rootkit to Steal Login and Payment Info

• Script Kiddies Do What They Do Best: Infect Themselves

• Student used ‘USB Killer’ device to destroy $58, 000 worth of college computers

• TSB Offers to Cover APP Fraud Losses

• UK Wants to Hold Companies Liable for Harmful Online Behavior

• Bug-hunters punch huge holes in WPA3 standard for Wi-Fi security

• Cars Exposed to Hacker Attacks by Hardcoded Credentials in MyCar Apps

• Large-scale DDoS Attack Abuses HTML’s Hyperlink Audit Ping Facility

• Students Hack High School WiFi to Get Out of Tests

• TP-Link Routers Vulnerable to Zero-Day Buffer Overflow Attack Consumer router models allowed authenticated users to take unrestricted remote control over TL-WR940N and TL-WR941ND routers.

• Bayrob malware gang convicted of infecting over 400,000 computers worldwide, stealing millions through online auction fraud

• Lazarus Group rises again from the digital grave with Hoplight malware for all (The Register)

• Open Source Tool From FireEye Automates Analysis of Flash Files

• Triton Hackers Focus on Maintaining Access to Compromised Systems: FireEye

• 25% of Phishing Emails Bypass Office 365 Default Security

• Insane in the domain: Sea Turtle hackers pwn DNS orgs to dash web surfers on the rocks of phishing pages

• The Nasty List Phishing Scam is Sweeping Through Instagram

• EU to check for GDPR violations in Microsoft products across EU institutions (ZDNet)

• Hackers could read user’s Outlook, Hotmail, and MSN email via compromised Microsoft support account

• Kaspersky Labs Discovers “Previously Unknown Vulnerability” in Microsoft Windows

• Samsung Galaxy S10 Fingerprint Sensor Duped With 3D Print The Samsung Galaxy S10 fingerprint sensor can be fooled in a hack that takes a mere 13 minutes and involves a 3D printed fingerprint.

• Sophos Investigates Microsoft Reboot Failures Following Software Update

• Adblock Plus filter can be exploited to execute arbitrary code in web pages

• Broadcom WiFi Driver Flaws Expose Computers, Phones, IoT to RCE Attacks

• eGobbler hackers used Chrome bug to deliver 500Million+ ads to iOS users

• Intel finally issues Spoiler attack alert: Now non-Spectre exploit gets CVE but no patch (ZDNet)

• Microsoft Refuses to Patch Zero-Day Exploit in Internet Explorer

• Windows Flaw Exploited to Deliver PowerShell Backdoor

• WPA3 flaws may let attackers steal Wi-Fi passwords