Weekly Cyber Security News 13/09/2019

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Wikipedia’s DDOS attack hit the news this week, and their plight drew an amazing donation to help further their defensive capabilities:

• Parts of Wikipedia Offline After ‘Malicious’ Attack

• Wikipedia Gets $2.5m Donation to Boost Cybersecurity

An article on the meaning of CVSS scores caught my attention this week. Its hard to say whether I fall guilty to prioritising the higher rated issues, when in reality it is the context, and even more so, the high probability of a chained attack through lower rated ones could reach the same target. With everything connected to infosec, regular review of our practices is a good thing. Take a look at your own stance in light of this one:

• Stop Using CVSS to Score Risk

Talking of reviewing infosec practices, this little gem certainly should come under the same umbrella!

• From pen-test to penitentiary: Infosec duo cuffed after physically breaking into courthouse during IT security assessment

 

The other items in the news…

• Garmin SA Shopping Portal Breach Leads to Theft of Payment Data

• Major Groupon, Ticketmaster Fraud Scheme Exposed By Insecure Database An exposed database containing 17 million email addresses exposed a massive fraud scheme impacting vendors like Groupon and Ticketmaster.

• UNICEF data leak reveals personal info of 8,000 online learners

• 198 Million Car-Buyer Records Exposed Online for All to See An Elastica DB belonging to Dealer Leads exposed a raft of information collected by _research_ websites aimed at prospective car buyers.

• 281 suspects arrested in massive crackdown against BEC scammers

• Bugs in D-Link and Comba Networking Gear Disclose Passwords

• Chrome 77 Released With Removed EV Certificate Indicator

• Cyber-security incident at US power grid entity linked to unpatched firewalls

• Eco-activists arrested by Brit cops after threatening to close Heathrow with drones

• ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group

• European police arrest Dark Web counterfeit currency traders

• Face Recognition App Leaks Photos Of Suspects From Madurai Police Database

• Fake PayPal Site Spreads Nemty Ransomware

• Google discloses vulnerability in Chrome OS ‘built-in security key’ feature

• Intel server-grade CPUs impacted by new NetCAT attack

• It’s 2019, and Windows PCs can be pwned via a shortcut file, a webpage, an evil RDP server…

• Microsoft Teams Can Be Used To Execute Arbitrary Payloads

• Monster.com says a third party exposed user data but didn’t tell anyone

• Mozilla to gradually enable DNS-over-HTTPS for Firefox US users later this month

• New Simjacker attack exploited in the wild to track users for at least two years

• Over Half of UK Firms Still Not GDPR Compliant

• Preventing GPS spoofing is hard; but you can at least detect it

• Pupils Flagged as Cyber Threat to UK Schools

• Swedish GDPR Fine Highlights Legal Challenges in Use of Biometrics

• Telegram fixes privacy-breaking bug that stopped recipient message and image deletion

• Telnet Backdoor Opens More Than 1M IoT Radios to Hijack Attackers can drop malware, add the device to a botnet or send their own audio streams to compromised devices.

• Telnet backdoor vulnerabilities impact over a million IoT radio devices

• Thousands of servers infected with new Lilocked (Lilu) ransomware

• Toyota Subsidiary Suffers $37m BEC Loss

• Vulnerabilities Exposed 2 Million Verizon Customer Contracts

• GootKit Malware Bypasses Windows Defender by Setting Path Exclusions

• Newly discovered cyber-espionage malware abuses Windows BITS service

• Microsoft Phishing Page Uses Captcha to Bypass Automated Detection

• Critical Exim TLS Flaw Lets Attackers Remotely Execute Commands as Root

• Exim marks the spot of remote code execution: Patch due out today for ‘give me root’ flaw in mail server