Weekly Cyber Security News 20/03/2020

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. As many of us resort to working from home, the collaboration services we normally rely on are beginning to suffer. MS Teams, as well as Facebook and WhatsApp are experiencing unusual load. But apart from a the odd glitch things seem to be hanging on for now:

• Microsoft Scales Back Office 365 Features to Handle High Loads

• Microsoft Teams goes down as Europe starts working from home

I remember seeing a report some time ago about a reduction in crypto-mining malware. Looks like we might be completely free of it at last:

• Remember cryptojacking from way, way back (2019)? Site infections are down 99% – thanks to death of Coinhive

Another wonderful view into the life of a spammer. Always fascinating as it can help us find better ways to defend:

• Nigerian spammer made 3X average national salary firehosing macro-laden Word docs at world+dog

 

Stay safe and enjoy the other news…

• Financial companies leak 425GB in company, client data through open database

• 4:15 p.m.: An urgent message from the CEO

• Adobe Fixes Nine Critical Vulnerabilities in Reader, Acrobat

• APT28 has been scanning vulnerable email servers for more than a year

• Browser vendor leaks data via open server

• Cloud Misconfig Mistakes Show Need For DevSecOps

• Cloudflare Worker Employed as C&C Server by BlackWater Malware

• Financial Services Firms Exposed 500,000 Sensitive Documents

• Firefox to remove support for the FTP protocol

• Food Delivery Service in Germany Under DDoS Attack

• Forget James Bond’s super-gadgets, this chap spied for China using SD card dead drops. Now he’s behind bars

• Freedom of Information coverup clerk stung for £2k after deleting council audio recording

• Guitar Tuition Website Suffers Six-Month Data Breach

• Half of UK Firms Suffer Basic Cyber-Skills Gaps

• HHS Says DDoS Attack Failed to Cause Disruption

• Hong Kong makes wearable trackers mandatory for new arrivals, checks in with ‘surprise calls’ too

• Norsk Hydro Outage May Have Been Destructive State Attack

• NutriBullet Experiences Multiple Magecart Skimmer Infections

• Researchers Hack Windows, Ubuntu, macOS at Pwn2Own 2020

• Slack Vulnerability Allowed Hackers to Hijack Accounts

• Stantinko’s new cryptominer features unique obfuscation techniques

• Tech Companies Partner to Securely Connect IoT to Cloud

• There Are Plenty of Phish in the Sea

• This Stalkerware Delivers Extra-Creepy Features

• UK Spies Hunt Down Covid-19 Threats

• WordPress and Apache Struts account for 55% of all weaponized vulnerabilities

• WordPress to add auto-update feature for themes and plugins

• WordPress, Apache Struts Attract the Most Bug Exploits

• New Nefilim Ransomware Threatens to Release Victims” Data

• Oh-so-generous ransomware crooks vow to hold back from health organisations during COVID-19 crisis

• Azure Red Flag: Microsoft Accidentally Fixes Cloud Config ‘Bug’

• Research Finds Microsoft Edge Has Privacy-Invading Telemetry

• Trend Micro Patches Two Vulnerabilities Exploited in the Wild