Weekly Cyber Security News 01/06/2018

A selection of this week’s more interesting vulnerability disclosures and cyber security news. We are now in the new world of GDPR and apart from the trolls last week firing off legal cases because they can, we do have two more interesting items that could be real challenges to clarify what this new law can and can not do:

• ‘Embarrassing’ leak shows EU falls short of own GDPR data law Margi Murphy Ben Riley-Smith report

• ICANN Launches GDPR Lawsuit to Clarify the Future of WHOIS

Talking of GDPR, a few lucky escapes perhaps under the new rules?

• Jaguar Land Rover data leak reveals employee records, upcoming layoffs Nick Kurczewski reports

And to finish off with one of my favourite topics – obscure hardware attacks. This one is really nice:

• Sonic Tone Attacks Damage Hard Disk Drives, Crashes OS Attack uses ultrasonic sound waves to disrupt HHD read/write operations, which could lead to a system crash.

Other bits and pieces:

• Attack Bypasses AMD’s Virtual Machine Encryption

• BMO and CIBC-owned Simplii Financial reveal hacks of customer data Pete Evans reports

• Europol Creates Dark Web Investigations Team

• Fraudsters Claim To Hack Two Canadian Banks Two Canadian banks reported that they may be targets of a hack after fraudsters claimed that they electronically accessed personal and account information.

• Hacker Steals $1.35 Million From Cryptocurrency Trading App Taylor Catalin Cimpanu reports

• HTTP Parameter Pollution Leads to reCAPTCHA Bypass

• Huawei Patches Four Server Bugs Rated High Severity Huawei stamps out four high-severity bugs impacting 20 server models ranging from its XH, RH and CH lines.

• Open Source Tool From FireEye Helps Detect Malicious Logins

• Over 5K Gas Station Tank Gauges Sit Exposed on the Public Net

• Remote Code Execution Vulnerability Patched in Git

• SEVered Attack Extracts the Memory of AMD-Encrypted VMs

• Singapore ISP Leaves 1,000 Routers Open to Attack Telcom firm leaves port open on customer routers after maintenance update exposing hundreds of customers to possible attack.

• T-Mobile bug let anyone see any customer’s account details Zack Whittaker reports

• FBI Warns Users to Reboot All SOHO Routers Everyone with a home router should reboot their systems as a precaution in the wake of the recently discovered VPNFilter attack infrastructure.

• Nocturnal Stealer Lets Low-Skilled Cybercrooks Harvest Sensitive Info The low-cost malware lowers the barrier of entry for carrying out advanced data exfiltration.

• Salted Hash: What a TSB phishing attack looks like

• Brazilian Banking Trojan Communicates Via Microsoft SQL Server Researchers have discovered a banking trojan making waves in Brazil with an array of tricks up its sleeve, including using an unusual command and control (C&C) server.

• Google Patches reCAPTCHA Bypass An exploit for the bypass vulnerability required an HTTP parameter pollution in a web application.

• Windows ‘Double Kill’ Attack Code Found in RIG Exploit Kit