Weekly Cyber Security News 22/03/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. A news busy week this has been, from a catastrophic malware hit against an global manufacturer to startling breaches from the usual players. Which to pick out then? OK, a wonderful article by Krebs that caught my attention today. I find it interesting that we seem to latch on to certain technologies that as they become so entwined in our lives, we then find it hard to admit that they are flawed when we stretch their use to areas where they were never intended to go:

• Why Phone Numbers Stink As Identity Proof

A rather scary near miss this one!

• Hacked tornado sirens taken offline in two Texas cities ahead of major storm

And to lighten the mood, and to feed the inner geek over the weekend:

• UK code breakers drop Bombe, Enigma and Typex simulators onto the web for all to try

 

If you want to dive back in, then here is the rest of the news…

• Aluminium Giant Norsk Hydro Suffers Major Cyber-Attack

• Norsk Hydro Restoring Systems, But Not Paying Ransom

• Norsk Hydro Calls Ransomware Attack ‘Severe’ When asked if the company plans to pay the ransom, its CFO said its main strategy is to use the backup data stored in the system.

• EU Fines Google for Anti-trust Breach

• Finland to Investigate Suspected Nokia Chinese Data Breach

• Secur Solutions Group data leak exposes 800,000 Singapore blood donors

• “100 unique exploits and counting” for latest WinRAR security bug

• 18-Year Old Arrested in Japan for Stealing $130k in Cryptocurrency

• 89% of EU Government Sites Infiltrated by Ad Tracking Scripts

• Ad Trackers Found on 89% of EU Gov Sites

• Alert: Bancor Hackers move 25433 Ethereum

• Attackers Sending Fake Copyright Infringement Notices to Instagram Users

• Bad cup of Java leaves nasty taste in IBM Watson”s “AI” mouth: Five security bugs to splat in analytics gear (The Register)

• Brace yourselves: New variant of Mirai takes aim at a new crop of IoT devices

• Carolina coward fesses up: I was a tech support scambag, and I made millions out of defrauding the elderly

• Chrome, Firefox Get Windows Defender Application Guard Extensions

• Dark web crackdown: Germans want to criminalize anyone providing a platform (ZDNet)

• Database leaks 250K legal documents, some marked ‘not designated for publication’

• E-Com Site Gearbest Exposed Millions of Records

• Education and Science Giant Elsevier Left User’s Passwords Exposed Online

• EPIC Promises to Fix Game Launcher after Privacy Concerns

• EU Adopts New Response Protocol for Major Cyberattacks

• Facebook apps logged user’s passwords in plaintext, because why not

• Facebook blocked over 1.2 million New Zealand shooting videos at upload (ZDNet)

• Facebook Fixed, but Did Outage Hurt Trust?

• Firefox Send Set To Reform The File Transfer Service Market

• Fourth Major Credential Spill in a Month Hits DreamMarket Gnosticplayers has released about 26 million records from what he said are breaches of six new companies.

• Fraudsters Band Together, Shift to Bot Attacks

• Google+ Gives Final Warning to Backup Data Before It”s Deleted

• How an unsecured Elasticsearch server exposed customer order information and passwords

• Is it still a good idea to publish proof-of-concept code for zero-days? (ZDNet)

• Just One Third of UK’s Small Firms Have Security Strategy

• KDE Connect Kicked From Google Play, Returns Less the App It Was

• Lithuanian Pleads Guilty to Stealing $100 Million From Google, Facebook

• London’s Tourist Hot Spots Suffer 100m+ Cyber-Attacks

• Myspace apparently lost 12 years worth of music, and almost no one noticed

• MySpace has lost all the music users uploaded between 2003 and 2015

• New EU Protocol Preps for X Border Cyber-Attacks

• New HTTPS Interception Tools Available from Cloudflare

• New Jersey becomes second state to ban cashless shops and restaurants

• New Tune Extension Turns Google Chrome Into a Safe Space

• Not Proud of Hacker Past, Beto Tells Iowa Voters

• Old Tech Spills Digital Dirt on Past Owners Researcher buys old computers, flash drives, phones and hard drives and finds only two properly wiped devices out of 85 examined.

• Over 100,000 GitHub repos have leaked API or cryptographic keys (ZDNet)

• Payment Card Thieves Slip into MyPillow and AmeriSleep Bedding Sites

• PuTTY in your hands: SSH client gets patched after RSA key exchange memory vuln spotted (The Register)

• Researcher Finds Novel Bug Class in Windows Kernel

• Round 4: Hacker returns and puts 26Mil user records for sale on the Dark Web (ZDNet)

• The Growing Importance of “Security by Design” (InfoRiskToday)

• Uber Deployed ‘Surfcam’ Spyware in Australia to Crush the Competition Until a report this week, Uber’s Surfcam’s use was thought to be limited to incidents uncovered in Singapore in 2017.

• Vulnerability in SoftNAS Cloud allows attackers to bypass authentication

• What was that P word? Ah. Privacy. Yes, we”ll think about privacy, says FCC mulling cellphone location data overhaul

• Zillow sued for $60 million after mansion listing hijacked

• Brit Police Federation cops to ransomware attack on HQ s

• Unpatched Plugin Cost MSP To Fall For Ransomware Infection

• Google Took Down 2.3 Billion Bad Ads in 2018

• 80% of the Top Exploited Vulnerabilities Targeted Microsoft in 2018

• Lithuanian man pleads guilty to scamming Google and Facebook out of $123 million

• Microsoft ships antivirus for macOS as Windows Defender becomes Microsoft Defender

• Sorry, Linux. We know you want to be popular, but cyber-crooks are all about Microsoft for now

• You should pick your Android security app wisely, test shows

• Critical flaw lets hackers control lifesaving devices implanted inside patients

• OceanLotus adopts public exploit code to abuse Microsoft Office software (ZDNet)