Weekly Cyber Security News 31/03/2017

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Threats are everywhere now, and this article below shows what can be at stake in just one country:

• Financial fraud losses in the UK last year topped 20m a day report (The Register)

How does this level of fraud take place? Yet another article gives an idea of how much information we are loosing (>44 records per second):

• World+dog had 1.4 BEEEELLION of its data records exposed last year (The Register)

Methods of ex-filtration vary of course, and again, other articles this week highlight the scale of risk:

• Doxed by Microsofts Docs.com: Users unwittingly shared sensitive docs publicly (ArsTechnica)

• Let’s Encrypt Issues 15,000 Fraudulent _PayPal_ Certificates Used for Cybercrime

Once again, vigilance for anything out of the ordinary, and good security practice can go a long way.

 

The rest of the news along with some nasty ones too!

• Botnet Pummels Retail Websites in Hunt for Gift Card Balances

• CVE-2017-5850 httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.

• Dishwasher has directory traversal bug (The Register) 

• FYI Office 365 subs: You may have leaked your passwords, personal info on Docs.com thousands already have (The Register)

• Hacking the Business Email Compromise BEC attacks are on the rise, but plain-old spoofing of business executives’ email accounts remains more prevalent.

• Hong Kong Loses 3.7 Million Voter Registration Records (InfoRiskToday)

• Is Your FTP Server Waiting for a Hacker? (InfoRiskToday)

• Laptops containing 3.7 million Hong Kong voters data stolen after chief executive election Ng Kang-chung reports

• LastPass confirms another major flaw, courtesy of Google’s bugfinders (The Register)

• Millions of Websites Affected by IIS 6.0 Zero-Day

• More fun in the sandbox: Experts praise security improvements to Edge (The Register)

• New Mirai Variant Unleashes 54-Hour DDoS Attack (SecurityWeek)

• NukeBot Source Code Leaked After Marketing Fail (SecurityWeek)

• Researchers steal data from shared cache of two cloud VMs (The Register)

• Someone is putting lots of work into hacking Github developers (ArsTechnica)

• Strange Mirai botnet brew blamed for powerful application layer attack (The Register)

• US-CERT’s Warning on SSL Interception vs. Security is a False Dichotomy (SecurityWeek)
  

• Cerber Ransomware Now Evades Machine Learning New variant has been broken into separate harmless-looking components to fool ML-based detection systems, Trend Micro says.

• PyCL Ransomware Test Campaign Spotted in the Wild (SecurityWeek)

• Apple squashes cert-handling bug affecting macOS and iOS (The Register)

• WONTFIX: No patch for Windows Server 2003 IIS critical bug Microsoft (The Register)

• CVE-2017-7240 An issue was discovered on Miele Professional PG 8528 PST10 devices.

• Google Researcher Finds New Flaw in LastPass

• Patch Unlikely for Widely Publicized Flaw in Microsoft IIS 6.0 Microsoft recommends upgrade to latest operating system for more protection.

• Potent LastPass exploit underscores the dark side of password managers (ArsTechnica)