Weekly Cyber Security News 06/03/2020

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. I have a great weird and wonderful selection for you this week. OK, I could have just opted for the usual major breaches and boy, don’t we have a few of those? No, instead some really odd geeky and perhaps quite pointless ones caught my attention. First is a look at air craft hacking. A really scary one and in a ‘Die Hard 2’ like situation some pilots are put to the test:

• Fancy that: Hacking airliner systems doesn’t make them magically fall out of the sky

Of the most pointless of the bunch the award goes to this gem. Someone really must have had too much time on their hands:

• Windows 10 Y3K Bug: Won’t Install After January 18, 3001

My favourite though is another of those deep dives into the hardware. Maybe, just maybe we might hear from this one again in some spy class:

• “Unfixable” boot ROM security flaw in millions of Intel chips could spell “utter chaos” for DRM, file encryption, etc

 

The breaches and other stuff you like this week….

 

• Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punter’s records into wrong hands from insecure database

• T-Mobile Notifying Customers of Data Breach

• UK Home Office breached GDPR 100 times through botched management of EU Settlement Scheme

• 49 Million Unique Emails Exposed Due to Mishandled Credentials

• Alleged Vault 7 leaker trial finale: Want to know the CIA’s password for its top-secret hacking tools? 123ABCdef

• Americans worry more about identity theft than being murdered

• Canada’s Auditor General: “Our Main IT System Is Running on DOS”

• Carnival Cruise Line Operator Discloses Potential Data Breach

• Delicious irony: Credit rating builder Loqbox lets customer details and card numbers slip after “sophisticated attack”

• Enable that MF-ing MFA: 1.2 million Azure Active Directory accounts compromised every month, reckons Microsoft

• Facebook sues Namecheap to unmask hackers who registered malicious domains

• GCHQ’s infosec arm has 3 simple tips to secure those insecure smart home gadgets

• Ghostcat bug impacts all Apache Tomcat versions released in the last 13 years

• Have I Been S0ld? No, trusted security website HIBP off the table, will remain independent

• It has been 15 years, and we’re still reporting homograph attacks – web domains that stealthily use non-Latin characters to appear legit

• Let’s Encrypt? Let”s revoke 3 million HTTPS certificates on Wednesday, more like: Check code loop blunder strikes

• Let’s Encrypt Hits One Billion Certificate Milestone

• Maersk prepares to lay off the Maidenhead staffers who rescued it from NotPetya super-pwnage

• Microsoft, Google, Facebook, and others join forces with law enforcement on child abuse crackdown

• Ransomware Attackers Use Your Cloud Backups Against You

• Southern Water not such a phisherman’s phriend, hauls itself offline to tackle email lure

• Staffer emails compromised and customer details exposed in T-Mobile US”s third security whoopsie in as many years

• UK Cybersecurity Defense Standards Slip, Calls Made for Improvement

• UK: Boots Advantage Card hit by cyber attack

• UK: Tesco issues 600,000 new Clubcards after credential stuffing attack

• ‘Shark Tank’ TV star loses almost $400,000 in Business Email Compromise scam

• Critical Netgear Bug Impacts Flagship Nighthawk Router – Dozens of routers are patched by Netgear as it snuffs out critical, high and medium severity flaws.

• Microsoft OneNote Used To Sidestep Phishing Detection – A recent phishing campaign used OneNote to distribute the Agent Tesla keylogger.

• Police raid tech support scam centre who had their CCTV hacked by vigilantes

• MediaTek Bug Actively Exploited, Affects Millions of Android Devices – An exploit published by a developer is easy to use and has already been used to build malicious apps that gain root access on Android devices.

• Patches Released for WordPress Plugin Vulnerabilities Exploited in Attacks