Weekly Cyber Security News 29/11/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Well what an amazing choice this week, it has been hard to choose. But this first one, one that appear just before I started writing this blog entry has to make it as the top story. It is so bizarre and a real first!

• Hackers Demand Beer

Continuing the party theme; let’s party like it’s 1999 again!

• Splunk Faces Y2K Bug-Like Problem Unless Patched

If that bug doesn’t kill the party mood you then this one might!

• HP Warns That Some SSD Drives Will Fail at 32,768 Hours of Use

 

Party on with this lot:

• Exploit code published for dangerous Apache Solr remote code execution flaw

• AccorHotels subsidiary Gekko Group exposes hotels and travelers data in massive data leak

• Adobe discloses security breach impacting Magento Marketplace users

• Data-Enriched Profiles on 1.2B People Exposed in Gigantic Leak

• NYPD Fingerprint Database Taken Offline to Thwart Ransomware

• Order Information of OnePlus Customers Exposed in Data Breach

• Target Sues Insurer Over Data Breach Costs

• A hacking group is hijacking Docker systems with exposed API endpoints

• Cloudflare Open-Sources Network Vulnerability Scanner

• Dozens of VNC Vulnerabilities Found in Linux, Windows Solutions

• Experts discovered control systems for aircraft warning lights open online

• Extensive hacking operation discovered in Kazakhstan

• French Hotel Giant Leaks 1TB+ of Client Data

• Google is killing Google Cloud Print

• ID Thieves Turn to Snail Mail as Juicy Target for Financial Crimes.

• IoT Smartwatch Exposes Kid’s Personal, GPS Data

• It’s Way Too Easy to Get a .gov Domain Name

• Kaspersky online protection API left open to abuse by websites

• Nominet Tackles Cybercrime with 29,000 .UK Domain Suspensions

• Over One Billion Consumers Exposed in Data Leak

• Personal and social information of 1.2B people exposed on an open Elasticsearch install

• Private equity firm buys .org domain months after ICANN lifted price caps

• Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains

• Scammers try a new way to steal online shopper’s payment-card data

• Smash-and-grab car thieves use Bluetooth to target cars containing tech gadgets

• This week, we give thanks to Fortinet for reminding us what awful crypto with hardcoded keys looks like

• Top 25 Most Dangerous Vulnerabilities Refreshed After 8 Years

• Upbit cryptocurrency exchange loses $48.5 million to hackers

• Twitter finally upgrades its 2FA security feature. Mobile number no longer required!

• Catch Says POS Malware Incident Might Have Exposed Customer’s Data

• New DeathRansom Ransomware Begins to Make a Name for Itself

• Payment solutions giant Edenred announces malware infection

• TrickBot Evolves to Go After SSH Keys – The info-stealing malware has updated its password-grabbing module.

• Fullz House hackers pivot from phishing to Magecart card skimming attacks

• Magecart Group Switches Up Tactics with MiTM, Phishing

• Two third-party SDKs allowed secret harvesting of Twitter and Facebook user data

• Windows 7 end-of-life is coming. How much should you worry?

• Many Apps Impacted by GIF Processing Flaw Patched Recently in WhatsApp