Weekly Cyber Security News 19/07/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Going for a theme this week and ignoring the NAS devices spewing data and amusingly named new malware. The theme is Bluetooth.

Just for a moment let these two completely separate articles sink in…

• Security Watch: Elon Musk’s NeuraLink Links Brains to iPhones via Bluetooth Directly linking thoughts to a phone via Bluetooth- what could go wrong?

• Bluetooth exploit can track and identify iOS, Microsoft mobile device users

Or instead of a subtle zombie apocalypse; how about an absolutely terrifying bomb hoax?

• Photo Shared via iPhone Leads to JetBlue Evacuation

And what new IoT hell can we finish with Bluetooth themed you ask? Yep. Hair straighteners. Some wonderful marketing idea gone wrong of course:

• Hacked Hair Straightener Could Set a Fire

 

Here goes the rest of it…

• Sprint says hackers breached customer accounts via Samsung website

• Vulnerability Allows Hackers to Take Control of Drupal 8 Websites

• Attacks in Turkey Used Excel Formula Injection

• BEC Scams Average $301 Million Per Month In Illegal Transfers

• Bitpoint cryptocurrency exchange hacked for $32 million

• Blah blah Blaha: Slovak infosec firm ESET sues politico who called them “outrageous fascists” (The Register)

• Email scammer’s plan to defraud 200,000 airport customers is foiled (ZDNet)

• Evite Invites Over 100 Million People to Their Data Breach

• Evite Reveals Security Incident Potentially Involving Unauthorized Access

• Facebook Set For Record $5bn FTC Fine

• Firefox follows in Chrome’s footsteps and will mark all HTTP pages as “not secure”

• Gigabyte and Lenovo servers impacted by common BMC firmware flaws

• Google to remove Chrome’s built-in XSS protection (XSS Auditor) (ZDNet)

• Hacker steals data of millions of Bulgarians, emails it to local media

• Malicious code ousted from PureScript”s npm installer but who put it there in the first place? (The Register)

• Microsoft to explore using Rust

• NHS Still Running 2000+ XP Computers

• Nigerian scammers slide into DMs, so Ars trolls them

• Only three global banks given top website security score by ImmuniWeb (ZDNet)

• Optus gained exemption to store metadata unencrypted (ZDNet)

• Oracle to Release Critical Patch Update

• Security researcher arrested after data on every adult in Bulgaria hacked from government site

• SLUB Backdoor Spreads via Newly Patched Vulnerability

• SWEED Hackers Target Manufacturing, Logistics Organizations

• Symantec Shares Plunge After Reports of Broadcom Deal Stall

• Tesla Awards Researcher $10,000 After Finding XSS Vulnerability

• Thousands of Legacy Lenovo Storage Devices Exposed Millions of Files

• Threatlist: 68% of Overwhelmed IT Managers Can’t Keep Up with Cyberattacks Most respondents in a recent survey say they’re losing the battle despite having up-to-date protections in place.

• Turla APT Returns with New Malware, Anti-Censorship Angle A dropper called Topinambour_ is the first-stage implant, which in turn fetches a spy trojan built in several coding languages.

• Twitter Can be Tricked Into Showing Misleading Embedded Links

• UK Government Staff Lost 500+ Devices Last Year

• UK: Former motor industry worker ordered to pay £25,500 from proceeds of data theft

• UK’s NCSC Hails Another Successful Year of Cyber Defense

• Unofficial Telegram App with 100K Installs Pushed Malicious Sites

• Zoom RCE only hit those who uninstalled it: Assetnote (ZDNet)

• ZTE launches Brussels cybersecurity lab as a transparency play (ZDNet)

• Brazil is at the forefront of a new type of router attack (ZDNet)

• For nearly a year, Brazilian users have been targeted with router attacks

• EvilGnome Malware Helps Hackers Spy on Linux Users

• Massive Malvertising Campaign Reaches 100M Ads, Manipulates Supply Chain A sophisticated and growing malvertising attacker is partnering with legitimate ad tech platforms to drop malware at scale.

• OpenNIC drops support for .bit domain names after rampant malware abuse (ZDNet)

• Report: Ransomware Targets QNAP Storage Devices (InfoRiskToday)

• American Express Customers Targeted by Novel Phishing Attack

• Microsoft Adds Automatic Phishing Detection to Microsoft Forms

• Hackers Can Manipulate Media Files Transferred via WhatsApp, Telegram

• Instagram Account Takeover Vulnerability Earns Hacker $30,000

• Malware Framework Gathers 1 Billion Ad Impressions in 3 Months

• Security Flaw Exposed Valid Airline Boarding Passes (InfoRiskToday)