Weekly Cyber Security News 29/01/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerbility disclosures and cyber security news.

• ‘Critical’ Israel power grid attack was just boring ransomware (The Register)

• 500Gbps DDoS attack flattens world record (The Register)

• Apple can read your iMessages despite them being encrypted (SC Magazine)

• Bug in Magento puts millions of e-commerce merchants at risk of takeover (ArsTechnica)

• Cisco drops 11 clock-crashing patches for 46 things, probes 142 more (The Register)

• Commuters slam UK rail operator c2c. You slow, late, er… privacy violator (The Register)

• cPanel TSR-2016-0001 Full Disclosure (Reddit)

• cPanel User Database Targeted by Hackers (SecurityWeek)

• Critical Magento Flaws Expose Sites to Takeover (SecurityWeek)

• Ebay Magento Bug Bounty #2 Persistent Web Vulnerability

• Firefox 44 Drops RC4, Gets Push Notifications (SecurityWeek)

• Google Chrome update includes 37 patches, two for high-risk vulnerabilities (SC Magazine)

• Gotcha: Symantec fires reseller nabbed in tech support scam (The Register)

• Hackers launch cyberattack against cPanel systems (ZDNet)

• Hot-patching method melts security hole in Apple’s App Store (The Register)

• How Amazon customer service was the weak link that spilled my data (ArsTechnica)

• If you’re using Magento stop whatever you’re doing and patch now (The Register)

• Internet of Things security is so bad, theres a search engine for sleeping kids (ArsTechnica)

• LG Patches Severe Smartphone Hijack Vulnerability

• Magento issues fixes for 20 vulnerabilities, two rated critical (SC Magazine)

• Magento update fixes critical XSS flaws (ZDNet)

• Malware Developers Blackmail Creator of Open-Source Ransomware

• Microsoft Finally Hides IP Addresses by Default in Skype

• Mozilla Firefox 44 update fixes critical vulnerabilities (ZDNet)

• Now you can easily see if a site’s HTTP headers are insecure, beams dev (The Register)

• NSAs top hacking boss explains how to protect your network from his attack squads (The Register)

• RSA event asking security execs for Twitter passwords (SC Magazine)

• Sainsbury’s Bank web pages stuck on crappy 20th century crypto (The Register)

• Stop the music! Booby-trapped song carjacked vehicles security prof (The Register)

• Stored XSS in Magento (Reddit)

• Symantec reseller caught using Norton name in tech support scam (SC Magazine)

• TP-Link Routers Fail Sniff Test (InfoRiskToday)

• US Blocks Philips LED Unit Sale To Chinese Group For National Security Reasons (Forbes)

• Vital OpenSSL patch coming (ZDNet)

• Website admin cPanel hacked, loses a bunch of folks’ contact details (The Register)

• Would you like fraud with that? Burger chain giant Wendy’s ‘hacked’ (The Register)

• Samsung security update fixes critical bugs hidden in Galaxy devices, Android OS (SC Magazine)