Weekly Cyber Security News 02/08/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Such an amazing choice of juicy news articles this week! I will skip the seriously weird and rapidly escalating circumstances of the Capital One breach, and instead dive into the some of the more low key, but nevertheless interesting items. First up, and for those of you who post infosec articles, something you will understand: stock photos. Yeah, those annoying hackers in a hoodie photos, and in some cases I’ve seen of BEC; hackers in a suit and a balaclava. They are pretty tedious aren’t they? Someone wants to tackle it at last:

• Fed-up graphic design outfit dangles cash to anyone who can free infosec of hoodie pics

You have to admit that the good hackers have amazing skill. Would be nice to refocus that skill to something non-criminal:

• UK, EU police pilot scheme to give wayward teen hackers white hats (ZDNet)

Personal data once ‘out there’, tends to linger for a long time; if not forever. Same goes for viruses. There will always be a vulnerable machine out there can harbour an infection and lay in wait for an opportune moment:

• Notorious MyDoom Worm Still on AutoPilot After 15 Years

 

The merry-go-round:

• Capital One Data Breach Affects 106 Million People, Suspect Arrested

• Seattle woman charged in Capital One breach may have data from other companies

• Hacker ID’d as former Amazon employee steals data of 106 million people from Capital One

• A data breach forced this family to move home and change their names

• EUROFISC Hacked? – EU Anti-Fraud Database Files Leaked

• Lancaster Uni cordons off breached systems a week after thousands of folk’s data pinched

• LAPD Data Breach Exposes Personal Info of Roughly 2.5K Officers

• Unsecured Database Exposes Security Risks in Honda’s Network

• 200 million devices some mission-critical vulnerable to remote takeover

• An exposed password let a hacker access internal Comodo files

• Breach alert in South Korea after 1m card details were put up for sale online

• Brit infosec firms urge PM Boris to reform the Computer Misuse Act

• Chrome 76 Dumps Default Adobe Flash Player Support In addition, Google’s latest Chrome version implements 43 new security fixes.

• Chrome to Add HTTP Cache Partitioning to Block Attacks, Tracking

• Cisco to pay $8.6 million for selling vulnerable software to US government

• Cyberlaw wonks squint at NotPetya insurance smackdown: Should ‘war exclusion’ clauses apply to network hacks (The Register)

• Dark Web drug kingpin charged, forfeits $4 million in Bitcoin

• Google Chrome Hides WWW and HTTPS:// in the Address Bar Again

• Greece, Spain to Be Fined for Not Transposing EU Data Protection Law

• IoT home security camera allows hackers to listen in over HTTP

• It’s 2019, and one third of businesses still have active Windows XP deployments

• Logins Stolen From Admin-Backdoored Club Penguin Rewritten Site

• Malicious “Google” domains used in Magento card card skimmer attacks

• Microsoft-Owned GitHub Blocks Devs in US Sanctioned Countries

• MoD Data and Device Losses Soar 300%

• NAB admits it shared personal info on 13,000 customers with two external parties (ZDNet)

• Outlook Is Down, Users Are Experiencing Sign-in Failures

• People forged judge’s signatures to trick Google into changing results

• Ransomware crooks hit Synology NAS devices with brute-force password attacks (ZDNet)

• Researchers Find 23 Million Stolen Cards For Sale

• Researchers Replace IP Camera Feed With Fake Footage

• SanDisk’s SSD Dashboard uses hardcoded password, lacks encrypted updates

• Scam impersonates WhatsApp, offers ‘free internet’

• Siri records fights, doctor’s appointments, and sex (and contractors hear it)

• UK Firms Move Operations as Brexit Data Fears Grow

• UK made illegal copies and mismanaged Schengen travelers database

• US AG Barr demands tech firms break encryption, “it can and must be done” (ZDNet)

• Voter records for 80% of Chile”s population left exposed online

• Watch as ten cops with guns and military camo storm suspected Capital One hacker’s house!

• Uptick in Ransomware, Mobile Banking Malware

• As the world secures itself, so do crims: Encrypted malware on the rise, warns Sonicwall

• He’s coming home, he’s coming home … Hutchins coming home: British Wannacry killer held in US on malware dev rap set free by judge

• US files lawsuit against Bitcoin exchange that helped launder ransomware profits

• StockX Password Reset Emails Are Legit, Not a Phishing Attack

• Google researchers disclose exploits for “interactionless” iOS attacks

• This new Android ransomware infects you through SMS messages

• DealPly Adware Abuses Microsoft Smartscreen to Boost AV Evasion

• Apple iMessage Flaw Lets Remote Attackers Read Files on iPhones

• Rare Steganography Hack Can Compromise Fully Patched Websites Attackers are hiding PHP scripts in EXIF headers of JPEG images to hack websites, just by uploading an image.