Weekly Cyber Security News 17/05/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. An bumper crop this week of news items of note, had to seriously prune them down to a manageable number which is a shame.

First up; is it art, or history, or an accident waiting to happen?

• Laptop Running Six Most Dangerous Malware up for Auction

In another case of déjà vu (but isn’t most infosec news like that?), where fake celebs were trying to get your data, even the real ones are at it. Who would be daft enough to oblige? Plenty it seems:

• Zara Larsson wants your password so she can watch Game of Thrones

Yet another batch of IoT fails. I wanted to select just one, but hey, they are all deserving:

• Spying on personal alarms and GPS trackers is as simple as sending an SMS

• Panic as panic alarms meant to keep granny and little Timmy safe prove a privacy fiasco

• Alexa Guard now turns your smart speaker into a home security device (ZDNet)

 

Something to peruse later:

• GDPR: Europe Counts 65,000 Data Breach Notifications So Far (InfoRiskToday)

• MI5 slapped on the wrist for “serious” surveillance data breach (The Register)

• New Class of Vulnerabilities Leak Data From Intel Chips

• Stack Overflow says hackers breached production systems

• Trend Micro Admits it Was Hacked, Symantec Denies Claims of _Fxmsp_ Breach

• A large chunk of Ethereum clients remain unpatched (ZDNet)

• Billions of Malicious Bots Take to Cipher-Stunting to Hide Attackers have been tampering with TLS signatures at a scale never before seen using a technique called cipher-stunting.

• Burger King’s Online Store for Kids Exposes Customer’s Info

• Double-sided printing data ballsup leaves insurance giant Chubb with egg on its face

• Fake Pirate Chick VPN Pushed AZORult Info Stealing Trojan

• Forbes Site Up, Then Down Again after Magecart Attack

• Google Titan Security Key Recalled After Bluetooth Pairing Bug Google is offering free replacements for its Titan Security Key after discovering a misconfiguration in its pairing protocols.

• Hackers are collecting payment details, user passwords from 4,600 sites

• Hackers Inject Magecart Card Skimmer in Forbes Subscription Site

• Magecart Used Same Skimmer against Two Web-Based Suppliers

• Microsoft SharePoint servers are under attack

• Only 0.25% of Reported Data Breaches Have Led to Fines Under GDPR

• Over 25,00 smart Linksys routers are leaking sensitive data

• Over 757K Fraudulently Obtained IPv4 Addresses Revoked by ARIN

• Personal Information of 2.25 Million Russian Citizens Exposed Online

• Remote Code Execution Vulnerability Impacts SQLite

• San Francisco Votes to Ban Facial Recognition

• SHA-1 collision attacks are now actually practical and a looming danger (ZDNet)

• SMS Spammers Expose 80 Million Records Online

• Software update crashes police ankle monitors in the Netherlands (ZDNet)

• UK Fraud Complaints Surge Over 40%

• UK Supreme Court Overturns Ultimate Authority of Investigatory Powers Tribunal

• WhatsApp Zero-Day Exploited in Targeted Spyware Attacks WhatsApp has patched a vulnerability that allowed attackers to install spyware on victims’ phones.

• ASUS WebStorage abused to spy on users at the router level (ZDNet)

• Plead malware distributed via MitM attacks at router level, misusing ASUS WebStorage

• Nigerian Cybercrime ‘Group’ Has 400 Malicious Actors

• Oh, the irony – Malware spread via Best of the Web security seals

• Twitter Collected and Shared iOS Location Data

• Its 2019 and a WhatsApp call can hack a phone: Zero-day exploit infects mobes with spyware

• Linux Kernel Flaw Allows Remote Code-Execution The bug is remotely exploitable without authentication or user interaction.