Cyber Security News- 14/08/15

Electric skateboards are being hacked to make riders fall off; making for a light-hearted read in this week’s Cyber Security News. We also read how Gliffy users can access private diagrams of other users without knowing the account holder. Free accounts on Gliffy only allow for public diagrams which make use of an incremental ID. Using this knowledge means a user can access any public diagram just by changing the ID until something of interest is found. More news below…

 

General

• 0-day attack on Firefox users stole password and key data: Patch now! (ArsTechnica)

• 0-day bug in fully patched OS X comes under active exploit to hijack Macs (ArsTechnica)

• Adobe updates Flash Player and AIR, fixes 35 bugs (SC Magazine)

• Aussies finger Russian in stock hack (SC Magazine)

• Bugtraq: QNAP crypto keys logged on unencrypted disk partition in world accessible files

• Carphone Warehouse Data Breach Could Affect 2.4 Million Customers (SecurityWeek)

• Dropbox adds USB security keys (ZDNet)

• Dropbox Enhances Authentication Security With USB Second Factor

• Hackers Can Seize Control of Electric Skateboards and Toss Riders (WIRED)

• Hover Resets User Passwords Due to Possible Breach
  

• Popcorn Time vulnerability could allow hackers to take over your computer (Yahoo Security)

• QNAP crypto keys logged on unencrypted disk partition in world accessible files

• Researchers Hack Car via Insurance Dongle (SecurityWeek)

• RIG Exploit Kit 3.0 Used to Infect Over 1.3 Million Computers Worldwide

• RIG exploit kit crimewave infects millions (ZDNet)

• Symantec Patches Critical Vulnerabilities in Endpoint Protection (SecurityWeek)

• Trawling Gliffy for Sensitive Data (Reddit)

• Ubiquiti Networks discloses they lost $46.7M from social engineering event targeting the finance dept. CAO fired (Reddit)

Malware

• Bypassing Malware Scanning in Sophos UTM Web Protection – Again (Reddit)

• Flash bites again: Huge malware campaign hits Yahoo ads (ZDNet)

• Flash bites again: Huge malware campaign on Yahoo ads hits millions (ZDNet)

• Hackers exploit Flash in one of the largest malware attacks in recent history (Yahoo Security)

User Space

• Check Point: Certifi-Gate-based attacks could take complete control of Android devices (ZDNet)

• Check your Android device for the Stagefright vulnerability (ZDNet)

• Google and some Android phone vendors introduce welcome changes to security update process (TechRepublic)

• Hackers can remotely steal fingerprints from Android phones (ZDNet)

• IBM discovers Android serialization vulnerability allows arbitrary code execution (ZDNet)

• New Android ‘Certifi-gate’ Bug Found (InfoRiskToday)