Weekly Cyber Security News 14/06/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Privacy is understandably a concern for all, and for those that are not that bothered and opt-in to give it away, I’m sure they assume it is for monitoring of their activities online. However, in this enterprising case, it appears to go beyond the virtual to physical and not where you would suspect…

• La Liga fined after Android app spied on football fans

Cryptocurrency mining is such a draw now it seems that some people go to amazing lengths to obtain it:

• Fish ponds disguised theft of oil field power in cryptocurrency mining scheme

Browser fingerprinting evasion which limits identification during online activity looks to be taking a new bashing with this fascinating article:

• JavaScript Template Attacks expose new browser fingerprinting vectors (ZDNet)

 

More news here…

• RAMBleed picks up Rowhammer, smashes DRAM until it leaks apps” crypto-keys, passwords, other secrets

• Stop using terrible PIN codes  (ZDNet)

• XSS Vulnerability Exposed Google Employees to Attacks

• China Telecom Routes European Traffic to Its Network for Two Hours

• Data Breach Disclosed by Online Invitation Firm Evite Evite’s data breach, stemming from an – inactive data storage file,_ is only one of many breaches to be disclosed this week.

• Data Breach Exposes 100K U.S. Traveler Photos, License Plates A recent breach of U.S. Customs and Border Protection traveler photo and license plate data has led experts to condemn the collection and storage of facial recognition data.

• Evite Confirms Data Breach After Hacker Sells User Data On Dark Web.

• Gaming Site Emuparadise Suffered Data Breach of 1.1M Accounts

• 5 reasons why you should use a password manager

• 8.4TB in email metadata exposed in university data leak

• Bad Cert Vulnerability Can Bring Down Any Windows Server

• Bug bounty drives VLC”s biggest patch but attracts “assholes, scriptkiddies, scammers” (ZDNet)

• CBP says hackers stole license plate and travelers” photos

• Critical Vulnerability Exposes Oil Tank Monitoring Devices to Attacks

• Cyberattack Risk: Scans Find Big Businesses Exposed (InfoRiskToday)

• DDoS attack that knocked Telegram secure messaging service offline linked to Hong Kong protests

• Diebold Nixdorf warns customers of RCE bug in older ATMs

• Employees Out of Work after ASCO Hit by Ransomware

• Evernote Chrome extension vulnerability allowed attackers to steal 4.7M users” data (TechRepublic)

• Facebook Offers to Pay Users for Sharing Information

• FIN8 hackers return after two years with attacks against hospitality sector

• Food Bank Hit By Ransomware, Needs Your Charity to Rebuild

• Fortune 500 company leaked 264GB in client, payment data (ZDNet)

• Gaming”s All Fun and Games Till Someone Gets Hacked

• Hackers Infect Businesses with CryptoMiners Using NSA Leaked Tools

• Intel fixes severe NUC firmware, web console vulnerabilities

• Linux Command-Line Editors Vulnerable to High-Severity Bug A bug impacting editors Vim and Neovim could allow a trojan code to escape sandbox mitigations.

• Major HSM vulnerabilities impact banks, cloud providers, governments

• Majority of FTSE 250 Companies Expose Multiple Weaknesses to Internet: Analysis

• Mozilla Makes Firefox its Own Brand Name, Releases New Logos

• Radiohead Releases OK Computer Sessions After Hack, Won”t Pay Ransom

• SEC security alert warns about misconfigured NAS, DBs, and cloud storage servers

• Troy Hunt Looks to Sell Have I Been Pwned _Project Svalbard_ has commenced, as Hunt looks for the right company to take over the password-focused service.

• Twitter URLs Can Be Manipulated to Spread Fake News and Scams

• VLC Player Gets Patched for Two High-Severity Bugs Popular media player receives 33 security bug fixes, two of which are rated high severity.

• WordPress Sites Worldwide Hit with ‘Call-Girl’ Search-Engine Pollution A web spam campaign targeting Koreans is affecting non-hacked websites worldwide.

• Yubico YubiKey lets you be me: Security blunder sparks recall of govt-friendly auth tokens (The Register)

• Google Calendar Attacks Target Unwitting Mobile Users Automatic invite notifications are spreading malicious links.

• Ancient ICEFOG APT malware spotted again in new wave of attacks

• GoldBrute Botnet Brute-Force Attacking RDP Servers

• New Malware Lays P2P Network on Top of IPFS

• This data-stealing malware has returned with new attacks and nasty upgraded features (ZDNet)

• FBI Warns of HTTPS Abuse in Phishing Campaigns

• More than 3B fake emails sent daily as phishing attacks persist