Weekly Cyber Security News 27/09/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Three surprises this week with the first, well, I don’t think any kind of lead in will help. Just go for it, it’s a crazy one:

• Man allegedly used drone to pelt ex-girlfriend’s home with bombs

The second surprise for this week and one epic fail in data protection and a bonus prize for the most straight faced ‘passing the buck’ I’ve ever seen:

• UK: Unshredded NHS records were dumped in a town centre to weigh down scaffolding at art festival

My third and final surprise also comes with no surprise: cloud leakage aka S3 buckets and the rest. It begs the question: What….? There are plenty of ways to ensure things are locked down, in fact there are plenty of companies selling solutions for that as well as home grown scripts and in the case of some provides their own tools via API and consoles. 

• Why do cloud leaks keep happening? Because no one has a clue how their instances are configured

 

The lesser surprises:

• Malindo Air: Data Breach Was Inside Job

• “Carpet-bombing” DDoS attack takes down South African ISP for an entire day

• AT&T redirected pen-test payloads to the FBI”s Tips portal

• Avid Users Are Suddenly Finding That Their Macs Won’t Boot

• Cloudflare, Google Chrome, and Firefox add HTTP/3 support

• Critical Vulnerability Addressed in Jira Service Desk

• DoorDash hack spills loads of data for 4.9 million people

• Four words from Cisco to strike fear into the most hardened techies: Guest account as root

• France Outlines Its Approach to Cyberwar

• Google Wins EU Fight Against Worldwide ‘Right to be Forgotten’

• Heyyo dating app leaked users” personal data, photos, location, more

• HMRC’s HTTPS howler: Childcare payments site cert expired at 1am on Sunday, down for hours

• IE zero-day under active attack gets emergency patch

• Ineffective Package Tracking Facilitates Fraud

• Malicious Ad Blockers for Chrome Caught in Ad Fraud Scheme

• Malicious pop-up ad apps slipped past Google Play security to reach millions

• Massive wave of account hijacks hits YouTube creators

• No summer vacations for Zebrocy

• No, it wasn’t a virus; it was Chrome that stopped Macs from booting

• Percentage-Based URL Encoding Used by Phishers to Evade Detection

• Polish data protection authority issues EUR 645,000 fine to online retailer

• Several months after the fact, CafePress finally acknowledges huge data theft to its customers

• TalkTalk still struggles to shut down legacy email addresses on request

• Vimeo Slapped With Lawsuit Over Biometrics Privacy Policy

• Vodafone customer account details ‘briefly exposed’ after software update

• Magecart skimmers seen targeting routers for customer Wi-Fi networks

• Busy North Korean hackers have new malware to target ATMs

• Dtrack RAT is Behind Virulent ATM-Espionage Campaign

• Microsoft: New Nodersok malware has infected thousands of PCs

• Malicious Android Apps Evade Google Play Protect via Remote Commands

• Selfie Android Apps with 1.5M+ Installs Push Ads, Can Record Audio

• Adobe Unscheduled Update Fixes Critical ColdFusion Flaws Overall