Weekly Cyber Security News 26/07/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Social media take-overs can be quite disastrous, and a recent UK law inforcement breach certainly caused a lot of embarrassment:

• Scotland Yard Twitter and Emails Hacked

Might want to stay away from those dodgy websites while waiting for some fixes…

• Several Vulnerabilities Found in Comodo Antivirus

Something I’m already familiar with from back in my electronics days, and with the increase in use of such hardware, and coupled with the need to wire up the pins for both input and output, a spurious bit flip could prove interesting:

• CVE-2019-13991 Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photosensitivity.

 

The rest of the news:

• Citrix Completes Investigation into Data Breach

• Hackers breach 62 US colleges by exploiting ERP vulnerability (ZDNet)

• Amazon Alexa, Google Home On Collision Course With Regulation Threatpost talks to Tim Mackey with Synopsys about recent Amazon Echo and Google Home privacy faux pas. Will GDPR and other regulations catch up to the voice assistants?

• Attackers Turn Elasticsearch Databases Into DDoS Bots

• BEC Scammers Turn to Aging Reports in New Twist

• Five Zero-Days Found in Comodo Antivirus Software

• Four Arrested Over Hacking of Brazil Justice Minister’s Phone

• Keep Calm, Carry On. VLC Not Affected by Critical Vulnerability

• Marketing biz bares folk’s data in the act of asking for their GDPR comms preferences

• Microsoft SmartScreen Data Collection Raises Privacy Concerns

• Orlando scraps Amazon Rekognition pilot program (ZDNet)

• Police arrest man after Lancaster University hacking attack

• Popular File-Sharing Service WeTransfer Used in Malicious Spam Campaigns WeTransfer is being used by hackers to circumvent email gateways looking to zap malicious links.

• ProFTPD Vulnerability Can Expose Servers to Attacks

• Siemens contractor pleads guilty to planting logic bomb in company spreadsheets

• Sky worries users with phishy-looking password reset email

• Still available via Google Analytics: Data slurped from 4 million browsers

• UK: Estate agency fined £80,000 after accidentally exposing personal info online for two years

• US company selling weaponized BlueKeep exploit

• Using AWS Session Manager with Enhanced SSH and SCP Capability

• Google wraps up lawsuits over age discrimination, Wi-Fi snooping, child data sharing (ZDNet)

• Elusive MegaCortex Ransomware Found Here is What We Know

• Johannesburg Electricity Provider Falls Victim to Ransomware Attack

• New Loader Variant Behind Widespread Malware Attacks Malware infection technique called TxHollower gets updated with stealthy features.

• QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack

• Lancaster University Says Phishing Attack Behind Data Breach

• This strange new phishing attack uses a surprise bill to trick you into clicking (ZDNet)

• It’s 2019 and you can still pwn an iPhone with a website: Apple patches up iOS, Mac bugs in July security hole dump (The Register)

• Critical flaw in Palo Alto VPN solution impacts Uber, other enterprises may be at risk (ZDNet)

• Recently Disclosed WordPress Plugin Flaws Exploited in Malvertising Operation