Security News – PSW #638

 

 

In the Security News, Twitter fixes API bug that can reveal users, Microsoft patches flaws in Azure stack, 8 cities that have been crippled by cyber attacks and how they fought against it, and so much more!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Full Episode Show Notes

To learn more about our sponsors visit: The Security Weekly Sponsor’s Page

Security News

Paul’s Stories

  1. Ghost in the shell: Investigating web shell attacks – Microsoft Security
  2. I Sabotaged My Boss With Ransomware From the Dark Web – I hope this person knew what they were doing. First concern is permission. Second concern is, even with permission, what if something bad happens? Also, how did you verify and validate the malicious code you got on the dark web? Much of the software has backdoors…
  3. Expert released PoC exploit code for unpatched backdoor in HiSilicon chips
  4. Tesla, Mobileye Autopilots Duped By Phantom Images
  5. Google Shared Private Videos With Wrong Users | SecurityWeek.Com
  6. Department of Energy Adds Attivo Decoys for Critical Infrastructure Security
  7. LCD pwn System: How to modulate screen brightness to covertly transmit data from an air-gapped computer… slowly
  8. Hacking Wi-Fi networks by exploiting a flaw in Philips Smart Light Bulbs
  9. cdpwn Millions of devices at risk due to flaws in implementations of Cisco Discovery Protocol (CDP)
  10. How your network could be hacked through a Philips Hue smart bulb
  11. DLL Hijacking Vulnerability Found in Realtek HD Audio Driver | SecurityWeek.Com
  12. Buggy Iowa Caucus App Is Buggy, Security Experts Say
  13. Russian disinformation ‘ongoing problem’ says FBI chief
  14. Iranian Hackers Target Journalists in New Phishing Campaign | SecurityWeek.Com

Patrick’s Stories

  1. No way! The Iowa election results web app is hackable! Who could have guessed? While there is no evidence hackers intercepted or tampered with the results, Veracode found that the app lacks key safeguards.

Jeff’s Stories

  1. This Sculpture Holds a Decades-Old C.I.A. Mystery. And Now, Another Clue.
  2. Documents Reveal How the NSA Cracked the Kryptos Sculpture Years Before the CIA
  3. Ransomware Attack on Hospital Shows New Risk for Muni-Bond Issuers
  4. Critical Cisco ‘CDPwn’ Flaws Break Network Segmentation
  5. Facebook urged to halt encryption push over child abuse concerns

Lee’s Stories

  1. Sudo bug lets non-privileged Linux and MacOS users run commands as root CVE-2019-18634 affects Sudo 1,8.26 and earlier – stack based buffer overflow – patches in MacOS 10.13,6, 10.14.6, 10.15.2 and Sudo 1.8.30
  2. Ashley Madison Breach data now being used for Extortion Scam targets hundreds of users, demanding .1188 BTC.
  3. Twitter fixes API bug Bug in API that could be used to reveal users by matching names and phone numberes, if they have the “let people who have your phone number find you on Twitter” setting on.
  4. Microsoft patches flaws in Azure stack CVE-2019-1372, a high risk vulnerability as it allows RCE as system & CFE-201-1234, a low risk vulnerability.
  5. 8 cities that have been crippled by Cyberattacks and what they did to fight them Here is how attacks on Atlanta, Baltimore, St. Lucie, New Bedford, New Orleans, Greenville, Pensacola, and Wilmer were handled.
  6. Hackers Can Hijack Your House Through Your Lightbulb, Researchers Warn ZigBee flaw permits Philips Hue lightbulb takeover. Low risk, CVE-2020-6007 patch available from Phillips. Report from Check Point
  7. 5 router settings to keep hackers off your cameras, smart speakers and network Some basic settings that help raise the bar on home network security. See also Joff’s Blog 10 Ways to Protect Your Online Digital Life – Black Hills Information Security
  8. Reaearcher finds over 60 vulnerabilities in Physical Security systems Researcher Joachim Kerschbaumer identified 60 vulnerabilities across 20 physical security products, including flaws that allow takeover.

Tyler’s Stories

  1. Hacking Air Gapped Computers
  2. The 2020 Disinformation War
  3. Charming Kitten Hackers Impersonate Journalist in Phishing Attacks
  4. Community Housing Nonprofit Hit with $1.2M Loss in BEC Scam
  5. Adversary Exposed How One Criminal Attempted to Sell an Msp on the Dark WEb
  6. Hack WhatsApp
  7. Facebook Gets Patent to Track Users’ Television Viewing
  8. Hackers took over Twitter accounts for the NFL and a bunch of teams, including Super Bowl contenders 49ers and Chiefs
  9. Hacking Leads to Fake Story Claiming US Soldier in Lithuania Has CoronaVirus
  10. Google admits it sent private videos in Google Photos to strangers
  11. Iowa Precinct Chair Reports Stuggles with Caucus Phone App
  12. Twitter Says an Attacker Used its API to Match Usernames to Phone Numbers
  13. Ex-CIA Engineer Goes on Trial for Massive Leak
  14. Ex-CIA Engineer Goes on Trial for Massive Leak
  15. Graduation Day Cyber Threat Intelligence Intelligence
  16. There’s No Evidence Saudis Hacked Jeff
  17. Ashley Madison Breach from 2015 Being Used in Sextortion Scams
  18. Where Computing is Headed Beyond Quantum
  19. 5 Zero-day Vunlerabilities in Cisco Discovery Protocol Impacting Tens of Millions of Devices

Joff’s Stories

  1. 10 Ways to Protect Your Online Digital Life – Black Hills Information Security Basic advice in human terms to secure your online digital life.

Hosts

Jeff Man
Jeff Man – Sr. InfoSec Consultant
Joff Thyer
Joff Thyer – Security Analyst
Lee Neely
Lee Neely – Senior Cyber Analyst
Patrick Laverty
Patrick Laverty – Security Consultant
Paul Asadoorian
Paul Asadoorian – Founder & CTO
Tyler Robinson
Tyler Robinson – Managing Director of Network Operations

Guests

Announcements

  • Our next webcast is February 13th with Sri Sundaralingam, Vice President, Product and Solutions Marketing at ExtraHop where we will discuss Cloud Native Network Detection and Response! Register for our upcoming webcasts by visiting securityweekly.com, selecting the webcast drop down from the top menu bar and clicking registration.
  • Join us at InfoSecWorld 2020 – March 30 – April 1, 2020 at the Disney Contemporary Resort! Security Weekly listeners save 15% off the InfoSec World Main Conference or World Pass! Visit securityweekly.com/ISW2020, click the register button to register with our discount code or the schedule button to sponsor a micro-interview!
  • Attend RSA Conference 2020, February 24-28 in San Francisco, CA! Visit securityweekly.com/rsac2020 to sponsor an interview with us on-site at the conference or register using our code to save $150!