Weekly Cyber Security News 07/03/2016

For well over a decade our focus at ionCube has been on PHP security but recently with the release of ionCube24 we have been looking into different kinds of vulnerabilities. This post has a few of the interesting issues we have found this week.

A selection of this week’s more interesting vulnerability disclosures and cyber security news including how a hacker pretended to be the CEO at Snapchat to steal employee data.

General

• $17 smartwatch sends something to random Chinese IP address (The Register)

• 90% of SSL VPNs are hopelessly insecure, say researchers (The Register)

• Amazon quietly drops encryption support from Fire devices (ZDNet)

• Apple Reissues Security Update After Blocking Ethernet on Mac OS X

• Borked ESET antivirus update says entire web is too risky to browse (The Register)

• DROWN protocol flaw allows hackers to break TLS using SSLv2 (The Register)

• Drupal patches 10 security flaws, critical issues (ZDNet)

• Encryption still a low priority for too many cloud users (ZDNet)

• Hacker Pretends To Be Evan Spiegel To Steal Snapchat Employee Data (Forbes)

• Hacker Says He Can Hijack a $35K Police Drone a Mile Away (WIRED)

• Here is how to check a shortened URL (IT Toolbox Blogs)

• Worldpay outs self as provider of easy-to-crack payment services (The Register)

Infrastructure

• Why you probably shouldnt be doing work on that in-flight Wi-Fi (ArsTechnica)

Malware

• Facebook: A new command and control HQ for mobile malware (The Register)

• Largely undetected Mac malware suggests disgraced HackingTeam has returned (ArsTechnica)