Weekly Cyber Security News 17/01/2020

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. Cast your mind back to the Ashley Madison breach and the black-mailing of members revealed in that breach. I don’t recall another like it until recently. This time though, with how common ransomware has become, are we going to see more victims approached as well as the source of the data breach?

• Patients of Hacked US Surgical Company Hit with Ransom Demands

Two major large scale technology stacks have revealed vulnerabilities that will provide handy pivot points for attack and eventual compromise:

• Proof-of-concept code published for Citrix bug as attacks intensify

• Hundreds of millions of Broadcom-based cable modems at risk of remote hijacking, eggheads fear

The nightmare for those affected by Travelex continues:

• Travelex want you to know that everything’s going really really well

 

More news…

• Equifax Settles Class-Action Breach Lawsuit for $380.5M – Class members have until Jan. 22, next week, to claim benefits.

• Man jailed for using data breach info leaks to claim over $12 million in IRS tax refunds

• Tinder, Grindr Accused of Illegally Sharing User Data

• 49 million user records from US data broker LimeLeads put up for sale online

• A billion medical images are exposed online, as doctors ignore warnings

• Amazon fires employees for leaking customer email addresses and phone numbers

• Amazon takes a swipe at PayPal’s $4 billion acquisition

• Cable Haunt: Hundreds of millions of cable modems may be vulnerable to hijacking attack

• Dixons Carphone Receives Maximum Fine for Major Breach

• FBI arrests man suspected of orchestrating dozens of ‘swatting’ calls

• Go Huawei: UK PM Challenges US Critics of China Firm

• Google Researchers Detail Critical iMessage Vulnerability

• Google Says it Will Phase Out Web-Tracking “Cookies”

• Lifeline Assistance Phone Users Targeted with ‘Uninstallable’ Adware

• Mozilla lays off 70 people as non-search revenue fails to materialize

• New Bill Would Prohibit Intelligence Sharing With Countries That Use Huawei

• Oil-and-Gas Specialist APT Pivots to U.S. Power Plants

• Online Pharmacy PlanetDrugsDirect Discloses Security Breach

• Smart cities with not-so-smart security – again!

• Top Euro court tells cops, spies that yelling “national security” isn’t enough to force ISPs to hand over massive piles of people’s private data

• UK data watchdog kicks £280m British Airways and Marriott GDPR fines into legal long grass

• Christmas Ransomware Attack Hit New York Airport Servers

• Google details its three-year fight against the Bread (Joker) malware operation

• Maze Ransomware Publishes 14GB of Stolen Southwire Files

• NSA Discloses Serious Windows Vulnerability to Microsoft

• Cisco Webex Bug Allows Remote Code Execution – Cisco patched two high-severity flaws this week, in its Webex and IOS XE Software products.

• Intel Fixes High-Severity Flaw in Performance Analysis Tool – The flaw, in Intel VTune Profiler, could enable privilege escalation.

• Critical WordPress Bug Leaves 320,000 Sites Open to Attack