Welcome to This Week’s [in]Security. Magecart. ATM Skimming. New breaches: Military, health, SANS. New Ransomware. Facial Recognition. Shame. Robocall honeypot. Disinformation. 0-days. LTE break. Adobe. Citrix. Struts. Motherboards. Wordpress. Cryptanalysis. CRA Credential Stuffing. Linux Malware. BEC. TOR. Phishing. Data Ubiquity. Security Bias. Jobs. Quantum. FireFox. Covid-19: Spread, Curves, Spikes & Waves. Vaccine Progress. And more.
Note: The COVID section appears later in the article.
PCI Compliance and Payments
News and announcements relating to Payment Security, PCI, Card Brands, Payments, Payment Malware and Fraud.
Breaches / Ransomware / Leaks
Covering breaches, leaks, data exposures, ransomware (as potential breach), and their fallout.
-
New breaches:
-
New Ransomware:
-
Follow-ups:
Privacy
Articles about privacy related news, risks, and trends.
Laws & Regulations / Standards
News about laws, regulations, and standards affecting security, privacy, technology, and public interest.
Defense / Techniques / Solutions
Covering developments and opportunities that may help improve security.
Bugs / Design Flaws / Vulnerabilities / Research
Articles about newly discovered vulnerabilities and research.
- Microsoft Put Off Fixing Zero Day for 2 Years https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/
- Two 0-Days Under Active Attack, Among 120 Bugs Patched by Microsoft https://threatpost.com/0-days-active-attack-bugs-patched-microsoft/158280/
- Security researcher publishes details and exploit code for a vBulletin zero-day https://www.zdnet.com/article/security-researcher-publishes-details-and-exploit-code-for-a-vbulletin-zero-day/, and https://threatpost.com/researcher-publishes-bypass-for-patch-for-vbulletin-0-day-flaw/158232/
- ReVoLTE attack can decrypt 4G (LTE) calls to eavesdrop on conversations https://www.zdnet.com/article/re-vol-te-attack-can-decrypt-4g-lte-calls-to-eavesdrop-on-conversations/ and https://arstechnica.com/information-technology/2020/08/your-mobile-calls-may-be-vulnerable-to-a-new-revolting-eavesdrop-attack/
- Critical Adobe Acrobat and Reader Bugs Allow RCE https://threatpost.com/critical-adobe-acrobat-reader-bugs-rce/158261/ and https://www.zdnet.com/article/adobe-tackles-critical-code-execution-vulnerabilities-in-acrobat-reader
- Citrix warns of patch-ASAP-grade bugs in its working-from-home products, just as we're all working from home https://www.theregister.com/2020/08/12/citrix_endpoint_management_critical_bug/
- Researcher Demonstrates Several Zoom Vulnerabilities at DEF CON 28 https://thehackernews.com/2020/08/zoom-software-vulnerabilities.html
- PoC Exploit Targeting Apache Struts Surfaces on GitHub https://threatpost.com/poc-exploit-github-apache-struts/158393/ and https://www.tenable.com/blog/cve-2019-0230-apache-struts-potential-remote-code-execution-vulnerability?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+tenable%2FqaXL+%28Tenable+Network+Security+Blog%29
- 30+ Vulnerabilities Discovered Across 20 CMS Products https://www.securityweek.com/over-30-vulnerabilities-discovered-across-20-cms-products
- Peer-to-peer takes on a whole new meaning when used to spy on 3.7 million or more cameras, other IoT gear https://www.theregister.com/2020/08/10/iot_p2p_horror/
- Critical Intel Flaw Afflicts Several Motherboards, Server Systems, Compute Modules https://threatpost.com/critical-intel-flaw-motherboards-server-compute-modules/158270/
- Kr00k, KRACK, and the Seams in Wi-Fi, IoT Encryption https://www.darkreading.com/iot/kr00k-krack-and-the-seams-in-wi-fi-iot-encryption/d/d-id/1338633
- Google Chrome Browser Bug Exposes Billions of Users to Data Theft (CSP bypass) https://threatpost.com/google-chrome-bug-data-theft/158217/
- Google Awards $10,000 for Remote Code Execution Vulnerability in Chrome https://www.securityweek.com/google-awards-10000-remote-code-execution-vulnerability-chrome?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29
- Google Fixes Mysterious Audio Recording Blip in Smart Speakers https://threatpost.com/google-fixes-mysterious-audio-recording-blip-in-smart-speakers/158219/
- Samsung Quietly Fixes Critical Galaxy Flaws Allowing Spying, Data Wiping https://threatpost.com/samsung-quietly-fixed-critical-galaxy-flaws-allowing-spying-data-wiping/158241/
- Critical Flaws in WordPress Quiz Plugin Allow Site Takeover https://threatpost.com/critical-flaws-wordpress-quiz-plugin-site-takeover/158379/
- Windows Defender Detected Citrix Services as Malware https://www.securityweek.com/windows-defender-detected-citrix-services-malware?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29
- High-Severity TinyMCE Cross-Site Scripting Flaw Fixed https://threatpost.com/high-severity-tinymce-cross-site-scripting-flaw-fixed/158306/
- Interesting talk about inexpesive password cracking beyond 15 characters https://www.youtube.com/watch?v=yK-idC6NZas
- Cryptanalysis of an Old Zip Encryption Algorithm https://www.schneier.com/blog/archives/2020/08/cryptanalysis_o_5.html
- Computation of a 30750-Bit Binary Field Discrete Logarithm (Cyptography impact) https://eprint.iacr.org/2020/965
- Discussion on UltraLoq IoT smart lock failure and lockpicking https://www.schneier.com/blog/archives/2020/08/smart_lock_vuln.html
- Follow-up on Reddit Pro-Trump hack - hijacked non-MFA moderator accounts https://www.securityweek.com/accounts-reddit-moderators-hijacked-pro-trump-hack
Hacking / Malware / Cybercrime / Exploitation
News covering active trends and events.
Other Security / Risk
Articles covering other types of risks.
COVID-19 updates.
COVID related articles. We have been following coronavirus risks since https://controlgap.com/blog/this-weeks-insecurity-issue-147.
-
The spread, curves, spikes, and waves:
-
Guidance, Response and Recovery:
-
Treatments, Testing, Triage, and Trials, and things we learned:
- DOJ Works To Shut Down Over 300 Fraudulent Websites Exploiting Pandemic https://www.pymnts.com/news/security-and-risk/2020/doj-works-shut-down-over-300-fraudulent-websites-exploiting-pandemic/
-
Masks, anti-maskers, and distancing:
Off-Topic / Science & Tech / Lighter Side
A variety of scientific, technical, historical, and more light-hearted news.