Weekly Cyber Security News 15/01/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

General

• ‘High risk’ for users of FRITZ!Box routers (SC Magazine)

• Adobe Patches 17 Vulnerabilities in Reader, Acrobat (SecurityWeek)

• An Easy Way for Hackers to Remotely Burn Industrial Motors (WIRED)

• Analysis confirms coordinated hack attack caused Ukrainian power outage (ArsTechnica)

• Android Trojan Intercepts Voice Call-Based 2FA: Symantec

• As easy as ‘Citrix123’ Hacker claims he popped Citrix’s CMS (The Register)

• CVE-2015-8769 SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

• Data centre outfit Interxion admits to contact detail security breach (The Register)

• Drupal Starts Patching Update Process Flaws (SecurityWeek)

• Drupal uncrosses fingers, promises secured patching (The Register)

• Et tu, Fortinet? Hard-coded password raises new backdoor eavesdropping fears (ArsTechnica)

• Fitbit Hack: What Are the Lessons? (InfoRiskToday)

• Fortinet Denies Existence of Malicious Backdoor in FortiOS (SecurityWeek)

• Fortinet Refutes SSH ‘Backdoor’ Report (InfoRiskToday)

• Fortinet tries to explain weird SSH ‘backdoor’ discovered in firewalls (The Register)

• Google security researcher excoriates TrendMicro for critical AV defects (ArsTechnica)

• Hacking Teams Leak Helped Researchers Hunt Down a Zero-Day (WIRED)

• I put together a list of all the Security Conferences from 2015 that have their talks on YouTube. Enjoy. (Reddit)

• Internet Explorer 8, 9, 10 Lose Security Updates This Month (SecurityWeek)

• Juniper Firmware: New Crypto Flaw Found (InfoRiskToday)

• Microsoft ends support for old Internet Explorer versions Jan. 12 (SC Magazine)

• Mozilla reverses course on SHA-1 (SC Magazine)

• New Discovery Around Juniper Backdoor Raises More Questions About the Company (WIRED)

• NVIDIA GPUs give smut viewed incognito a second coming (The Register)

• Open Web Application Security Project issues new secure coding bible (The Register)

• Patch Tuesday: Microsoft starts off the year with nine bulletins (SC Magazine)

• Teen who hacked CIA directors email hits Director of National Intelligence next (Yahoo Security)

• Trend Micro AV gave any website command-line access to Windows PCs (The Register)

• Trend Micro patched flaws would let hackers execute malicious code (SC Magazine)

• WhatsApp users need to know about these 2 key threats (Yahoo Security)

• Windows 10 shattered Remote Desktop’s security defaults so get patching (The Register)

• Windows users face a dangerous world with end of support for older Internet Explorer versions (ZDNet)

• Your boss yells ‘build a secure IoT gadget’ and you don’t know where to start? Take a look at this (The Register)

Infrastructure

• One Ring to pwn them all: IoT doorbell can reveal your Wi-Fi key (The Register)

Malware

• $5,000 Malware Allows Anyone To Empty ATMs- But It Isn’t Worth The Trouble (Forbes)

• Forbes asked readers to turn off ad blockers before serving pop-under malware (Angler EK) (Reddit)

• Hackers used malware to confuse utility in Ukraine outage report (Yahoo Security)

User Space

• Nasty _Brain Test_ Android Malware Returns to Google Play