Weekly Cyber Security News 26/02/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news including how banking security is being replaced with photos of yourself instead of a password.

Drupal

• Critical Drupal Updates Patch Several Vulnerabilities
• Drupal drips out ten new patches, one worthy of immediate attention (The Register)

General

• Awoogah red alert: OpenSSL preps ‘high severity’ security fixes (The Register)

• Browser made by China’s top search engine leaks almost everything (The Register)

• Card-Free ATMs: No More Skimming? (InfoRiskToday)

• Child tracker outfit uKnowKids admits breach, kicks off row with security researcher (The Register)

• CloudFlare launches registrar to prevent DNS hijacking attacks (ZDNet)

• Comodo Support Tool Allowed Attackers to Elevate Privileges (SecurityWeek)

• Cryptography and carbon: How nanotubes could improve security (ZDNet)

• CVE-2016-2537 The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports[‘utc-millisec’] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string. (CVSS:0.0) (Last Update:2016-02-23)

• Don’t take a Leaf out of this book: Nissan electric car app has ZERO authentication (The Register)

• Eavesdropping by the Foscam Security Camera (Schneier blog)

• Google punts freebie DDoS shield to hacks, human rights worthies (The Register)

• I could have made you homeless: What happens when you dare hackers to do their worst? (Yahoo Security)

• MasterCard’s ‘Selfie’ App Aims to Replace Passwords (InfoRiskToday)

• More insecure security software: Comodos on-by-default VNC app (ArsTechnica)

• Nissans connected car app offline after shocking vulnerability revealed (ArsTechnica)

• OpenSSL Preparing Patches for High Severity Flaws

• Twitter Patches Bug Exposing Details of 10,000 Users (SecurityWeek)

Infrastructure

• Asus agrees to 20 years of security audits in router flaws settlement (The Register)

• Most will connect to an unsecured Wi-Fi hotspot if its free: study (ZDNet)

Malware

• Linux Mint hit by malware infection on its website, forum after hack attack (ArsTechnica)

User Space

• Source Code of Android Banking Trojan quot;GM Botquot; Leaked (SecurityWeek)

WordPress

• Bugtraq: WordPress plugin wp-ultimate-exporter SQL injection vulnerability WordPress plugin wp-ultimate-exporter SQL injection vulnerability

• Ransomware springboards from WordPress to Joomla domains (ZDNet)