Weekly Cyber Security News 05/02/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news.

General

• ‘Hopelessly insecure Motorola CCTV cameras belatedly patched (The Register)

• A tale of openssl_seal(), PHP and Apache2handle

• Android security: Google kills remote hacker bug, patches seven critical flaws (ZDNet)

• Avast forked up its Chrome fork, so flings fix after Google goggles (The Register)

• Britain’s HSBC Recovers from Massive DDoS Attack

• Bugtraq: OpenXchange | Information Disclosure OpenXchange | Information Disclosure

• Chrome picks up bonus security features on Windows 10 (ArsTechnica)

• Comodo Browser Breaks Security: Google Researcher (SecurityWeek)

• Crypto flaw was so glaring it may be intentional eavesdropping backdoor (ArsTechnica)

• Cuba announces it will launch broadband home internet (Yahoo Security)

• CVE-2015-7923 Westermo WeOS before 4.19.0 uses the same SSL private key across different customers’ installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.

• CVE-2015-8770 Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.

• CVE-2015-8794 Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.

• CVE-2016-1882 FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.

• Cyber Attack Targets Britain’s HSBC Bank

• Developers Accidentally Ship Dropbox And Gmail Logins In Horribly Insecure Motorola CCTV Cameras (Forbes)

• Disputed eBay platform vuln poses severe risk to tat bazaar’s users (The Register)

• DLink DVG?N5402SP Multiple Vulnerabilities

• eBay Fixes ‘Severe’ Vulnerability But Is Playing Whack-a-Mole With Security (Forbes)

• EU, US Agree to New Internet ‘Privacy Shield’

• Facebook Pays Out $7,500 Bounty for Account Hijacking Flaw

• Firefox Warns of Password Requests Over HTTP (SecurityWeek)

• GCHQs Xmas puzzle proves uncrackable (The Register)

• Go phish your own staff: Dev builds open-source fool-testing tool (The Register)

• Google calls out Chromodo Chrome-knockoff browser as insecure crapware (The Register)

• Google ninjas go public with security holes in Malwarebytes antivirus (The Register)

• Google to deep six dodgy download buttons (The Register)

• Hackers attack 20 million accounts on Alibaba’s Taobao shopping site (Yahoo Security)

• Hackers Could Have Turned Vulnerable Smart Teddy Bear Into Demon Toy (Forbes)

• HSBC Calls In Cops To Chase DDoS Attackers Who Took Online Banking Down (Forbes)

• HSBC fights off denial of service attack on its internet banking systems (ZDNet)

• HSBC online banking suffers major outage, blames DDoS attack (ArsTechnica)

• HSBC online services offline following ‘attack’ on bank (The Register)

• HSBC says internet banking services down after cyber attack: BBC (Yahoo Security)

• Lincolnshire council IT ransomware flingers asked for … 350 (The Register)

• Malwarebytes Launches Bug Bounty Program

• Most Windows security flaws mitigated by ‘removing admin rights’ (ZDNet)

• Mystery hacker pwns Dridex Trojan botnet… to serve antivirus installer (The Register)

• New Cross-Platform Backdoors Target Linux, Windows

• New Intel Chips Pack Hardware Authentication Technology

• OpenBSD rolls in LibreSSL bug fixes (The Register)

• OpenSSL Flaw Enables HTTPS Decryption (InfoRiskToday)

• OpenSSL patch quashes rare HTTPS nasty, shores up crypto chops (The Register)

• PGP co-founder: Ad companies are the biggest privacy problem today, not governments (ZDNet)

• Safe Harbor ripped and replaced with Privacy Shield in last-minute US-Europe deal (The Register)

• Serious Crypto Flaw Found in Socat Tool

• Severe OpenSSL Flaw Exposes TLS Traffic

• Smart toys spring dumb vulns. Again. This time: Cuddly bears, watches (The Register)

• Socat slams backdoor, sparks thrilling whodunit (The Register)

• Supplier promises to nudge UK schools towards secure webmail (The Register)

• Town Faces Ransomware Infection, Blinks (InfoRiskToday)

• Two newly-discovered flaws light fire under IoT security (ZDNet)

• UC Berkeley profs blast secret IT monitoring kit on campus (The Register)

• Using IPv6 with Linux? Youve likely been visited by Shodan and other scanners (ArsTechnica)

• Windows 10 and System Protection for DATA Default is OFF

Malware

• eBay has no plans to fix severe bug that allows malware distribution (ArsTechnica)

• eBay refuses to patch website flaw that can serve up malware (ZDNet)

• WordPress under attack by whack-a-mole ad-scam malware (The Register)

User Space

• Chip chomped as dev’s debug backdoor found in Android phones (The Register)

WordPress

• Mysterious spike in WordPress hacks silently delivers ransomware to visitors (ArsTechnica)

• WordPress 4.4.2 Patches Open Redirect, SSRF Flaws