Weekly Cyber Security News 3/4/2020

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. In these strange times certain platforms have gained increased popularity, Zoom being one appears to have attracted a lot of attention and not just from it’s users. Both sides of infosec have taken a bite. The news appears to be changing rapidly as Zoom react and deal with it. What is really true about the claims?

• Two Zoom Zero-Day Flaws Uncovered – The zero-day Zoom flaws could give local, unprivileged attackers root privileges, and allow them to access victim’s microphone and camera.

• Zoom Kills iOS App’s Data-Sharing Facebook Feature

• Ex-NSA hacker drops new zero-day doom for Zoom

• The UK Cabinet is meeting on Zoom – here’s the meeting ID

• UK Government Uses Zoom Despite MoD Security Concerns

• Yeah, that Zoom app you’re trusting with work chatter? It lives with “vampires feeding on the blood of human data”

• Zoom Phishers Register 2000 Domains iAnd notn a Month

• Zoom promises to improve its security and privacy as usage (and concern) soars

• Zoom Removes Data-Mining LinkedIn Feature – The feature, criticized for  “undisclosed data-mining”, is only the latest privacy faux pas for Zoom this month.

• Zoom’s end-to-end encryption isn’t actually end-to-end at all. Good thing the PM isn’t using it for Cabinet calls. Oh, for f…

• Zoom’s Security and Privacy Woes Violated GDPR, Expert Says

And what is going on here?

• Houseparty Offers $1m for Info on ‘Smear Campaign’

Not wanting to miss out on the popularity stakes:

• Critical WordPress Plugin Bug Can Lock Admins Out of Websites – A second vulnerability could be used to prevent access to almost all of a site’s existing content, by simply redirecting visitors.

 

 

Other news:

• At the Supreme Court, Morrisons pops data breach liability win into its trolley – but it’s not a get-out-of-compo free card for businesses

• Marriott Reports Data Breach Affecting Up to 5.2 Million Guests

• 44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig – Millions of IDs, charge cards, loyalty cards, gift cards, medical marijuana ID cards and personal information was left exposed to the open internet.

• 8-Year-Old VelvetSweatshop Bug Resurrected in LimeRAT Campaign – An old RAT learns an old trick.

• A crypto-mining botnet has been hijacking MSSQL servers for almost two years

• Actively Exploited Windows Font Parsing Bugs Get Temporary Fix

• Apple’s latest macOS Catalina update mysteriously borks SSH for some unlucky fans. What could be the cause?

• AWS Security Service “Amazon Detective” Now Generally Available

• Cloudflare debuts 1.1.1.1 for Families, comes under fire for blocking LGBTQIA+ sites

• Emerging MakeFrame Skimmer from Magecart Sets Sights on SMBs – Attacks using a brand-new card-harvesting code is targeting small- to medium-sized businesses, claiming 19 sites so far.

• FBI: Hackers Sending Malicious USB Drives & Teddy Bears via USPS

• IE: Data of 9,735 teachers shared after ‘phishing’ email breach

• Industrial Controllers Still Vulnerable to Stuxnet-Style Attacks

• Lack of Understanding of US Legislation Putting UK Business Data at Risk

• Microsoft to Add Compromised Password Notification to Edge

• Missouri law firm sued by insurer for not disclosing 2016 hack by thedarkoverlord

• Network of fake QR code generators will steal your Bitcoin

• Nigerian Threat Actors Specializing in BEC Attacks Continue to Evolve

• Patch Released for Linux Kernel Vulnerability Disclosed at Hacking Contest

• Poured your info out on a call to 118 118 Money? Bad luck. Credit provider ‘fesses up that hacker nabbed customer service phone recordings

• Privacy Snafu Exposes 42 Million ‘Telegram’ Records

• Prosecutors Charge Two Men over Coincheck Hack, But Not For Hacking

• Researcher Finds New Class of Windows Vulnerabilities

• Singapore government scraps physical 2FA tokens for government services

• Twitter discloses bug that cached private files sent or received via DMs

• Vulnerabilities Expose Lexus, Toyota Cars to Hacker Attacks

• You know all those stories of leaky cloud buckets taken offline? Well, some may still be there, just badly hidden

• Zettaset Launches Software-Defined Encryption for Kubernetes Environments

• ‘Secure’ Backup Company Leaks 135 Million Records Online

• LimeRAT malware is being spread through VelvetSweatshop Excel encryption technique

• Why is ransomware still a thing? One-in-three polled netizens say they would cave to extortion demands

• Nation-State Attacks Drop in Latest Google Analysis – Phishing and zero-days continue to be a core part of the APT arsenal.

• Browser Makers Delay Removal of TLS 1.0 and 1.1 Support

• Australian state will install home surveillance hardware to make sure if you’re in virus isolation, you stay there

• Critical Flaw in SEO Plugin Exposed Many WordPress Sites to Attacks

• SMBGhost Vulnerability Allows Privilege Escalation on Windows Systems