Weekly Cyber Security News 10/01/2020

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. Well, the New Year didn’t get off to a good start for some. The most visible of them being Travelex as a result of an unpatched VPN solution. From there things have rapidly fallen apart, and it ain’t over yet…

• Travelex customers left in cashless limbo, ICO not formally alerted to data theft claims

• Travelex Says Financially Unaffected by Hacking

• Pulse Secure VPN Vulnerability Exploited to Deliver Ransomware

• That Pulse Secure VPN you’re using to protect your data? Better get it patched – or it’s going to be ransomware time

• Travelex still offline after discovering malware on New Year’s Eve, and other bank’s currency services are also affected

SQL Injection can cause a lot of damage, but what if it could create new laws?

• I’m the queen of Gibraltar and will never get a traffic ticket… just two of the things anyone could have written into country’s laws thanks to unsanitised SQL input vuln

A bit of legal action I hope the developer community is watching as to how it will pan out and affect us all:

• Oracle copied Amazon’s API – was that copyright infringement?

 

The rest of the news:

• IT exec sets up fake biz, uses it to bill his bosses $6m for phantom gear, gets caught by Microsoft Word metadata

• InfoTrax Gets Slap on The Wrist After Being Breached 20+ Times

• Microsoft Access Files Could Include Unintentionally Saved Sensitive Data

• Antivirus Vendors Patch Bug First Discovered 10 Years Ago

• Don’t Xiaomi pics of other people’s places!

• Exploit Fully Breaks SHA-1, Lowers the Attack Bar – Users of GnuPG, OpenSSL and Git could be in danger from an attack that”s practical for ordinary attackers to carry out.

• Hackers probe Citrix servers for weakness to remote code execution vulnerability

• Half of the websites using WebAssembly use it for malicious purposes

• Interpol Announces Successful Operation Against Cryptojacking in Southeast Asia

• Japanese Love Hotel Site Breached

• Linux Gamers Banned in Battlefield V if Using Wine and DXVK

• Mozilla Patches Firefox Zero-Day Exploited in Targeted Attacks

• Nepal Deports 122 Chinese Nationals After Cyber Raid

• New year, new critical Cisco patches to install

• Only 9.27% of all npm developers use 2FA

• Operation Goldfish Alpha reduces cryptojacking across Southeast Asia by 78%

• PayPal Patches Vulnerability That Exposed User Passwords

• Ring Fired Employees for Watching Customer Videos

• TrickBot Operators Create New Backdoor for Important Targets

• UK government investigates possible cyberattack link to London Stock exchange outage

• UK man sentenced to prison for hacking and spying on victims through their webcams

• Company Told Employees to Seek Other Work After Ransomware Attack