Weekly Cyber Security News 05/07/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Well, I hope everyone’s recovered from the annoying network outages this week. I’m not going to talk about that, instead here is something to bring other annoyances: How UI done badly can be really bad…

• Behold, the most (intentionally) poorly designed website ever created

People are people, and while there are often oversights in locking down systems, they often still fall prey to moments of madness which starts a chain towards disaster. Here is an interesting article about such a chain:

• Smart Home Hacked via Vulnerabilities, Social Engineering

And talking of not locking down systems, let’s instead have wide open doors…

• Here’s a great idea: Why don’t we hardcode the same private key into all our smart home hubs? (The Register)

• Hardcoded Credentials Expose SICK Controllers to Remote Attacks

 

The order news:

• Cop a load of this: 1TB of police body camera videos found lounging around public database (The Register)

• Open Marketing Database Exposes 5 Million Personal Records

• “Silence” hackers hit banks in Bangladesh, India, Sri Lanka, and Kyrgyzstan

• $30/month email upstart Superhuman brought low with a blast of privacy Kryptonite

• Adware Gathers 9 Million Downloads in Google Play

• Almost half of US home security system owners admit their systems were switched off before a break in (ZDNet)

• Amazon confirms Alexa customer voice recordings are kept forever (ZDNet)

• Americans Want to Protect Their Information, but Don’t Know How: Survey

• Black Hat Survey Reveals Cyber Concerns

• Brits Shun Biometric Authentication for Traditional Passwords, Report

• Bulgarian IT expert arrested after demoing vulnerability in kindergarten software

• Cirque du Soleil app gives attackers same admin rights as operators (ZDNet)

• Cloudflare stutters and the internet stumbles (ZDNet)

• D-Link to undergo security audits for 10 years as part of FTC settlement

• Engineer faces 219 years in prison for smuggling US military chips to China

• Facebook staff sarin for a bad day: Suspected chemical weapon parcel sent to Silicon Valley HQ (The Register)

• Firefox finally fixes the problems with antivirus apps crashing HTTPS websites (ZDNet)

• Florida city fires IT employee after paying ransom demand last week (ZDNet)

• G20 supports proposal to make cryptocurrency exchanges hand over user data

• Google hopes to standardize robots.txt by going open source

• Google Project Zero reveals bad iMessages could have bricked your iPhone (ZDNet)

• Google Releases Basic Homomorphic Encryption Tool

• Illegal Card Enrollment Services Hijack Online Bank Accounts

• Magecart Campaign Offers Customizable Payload

• Malware makes an exhibition of itself

• Many Phoenix Contact PLCs Still Vulnerable Months After Researcher Issues Warning

• Many VMware Products Affected by SACK Linux Vulnerabilities

• Microsoft asks to join private Linux security developer list (ZDNet)

• MYOB in payslip privacy bungle

• New Avast CEO to Give Away Annual Salary to UK Charity

• NHS “Urgently” Needs to Invest In Cybersecurity Measures Says Latest Report

• OpenID Foundation says “Sign In with Apple” is not secure enough (ZDNet)

• Over Half of Employees Don”t Adhere to Email Security Protocols

• Popular grief support page hacked, ignored for weeks by Facebook

• Scumbags can program vulnerable MedTronic insulin pumps over the air to murder diabetics insecure kit recalled (The Register)

• Security Camera Firm Arlo Zaps High-Severity Bugs Bugs in Arlo Technologies – equipment allow a local attacker to take control of Alro wireless home video security cameras.

• Seriously? Cisco put Huawei X.509 certificates and keys into its own switches (ZDNet)

• Silence Group Likely Behind Recent $3M Bangladesh Bank Heist

• Slack Is Experiencing Worldwide Outage, Degraded Performance

• Smart home maker leaks customer data, device passwords (ZDNet)

• The Internet broke today: Facebook, Verizon, and more see major outages

• Thousands Left Vulnerable in Nexus Repository

• Threat Actor Poisons OpenPGP Certificates

• UK ISP group names Mozilla “Internet Villain” for supporting “DNS-over-HTTPS” (ZDNet)

• UK: Former company director believed to have profited by more than £1.4 million after selling personal data illegally

• US Cyber Command issues alert about hackers exploiting Outlook vulnerability (ZDNet)

• US wants to isolate power grids with “retro” technology to limit cyber-attacks

• YouTube policy on removing instructional hacking content causes infosec community outrage (ZDNet)

• Yubico Security Keys with a Crypto Flaw

• Dridex Operators Use New Trojan Downloader

• First-ever malware strain spotted abusing new DoH (DNS over HTTPS) protocol (ZDNet)

• New Golang malware plays the Linux field in quest for cryptocurrency

• Sodinokibi ransomware is now using a former Windows zero-day (ZDNet)

• St John Ambulance service hit by ransomware attack

• Ten years later, malware authors are still abusing “Heaven”s Gate” technique

• Fake Samsung firmware update app tricks more than 10 million Android users

• House Democrats issue letter to Facebook to halt Libra project (ZDNet)

• Magento Patches Flaws Leading to Site Takeover

• Sophos Proof-of-Concept Exploit Shows Dangers of BlueKeep (InfoRiskToday)