Daily brief for 2018-09-25

ASIA

1. Snyk gets $22 million for platform that tracks security flaws in open source projects
2. Security Engineer Hacks Hotel WiFi, Fined for Exposing Admin Password
3. Off-the-shelf RATs Targeting Pakistan
4. Malicious Documents from Lazarus Group Targeting South Korea
5. GZipDe: An Encrypted Downloader Serving Metasploit
6. More Details on an ActiveX Vulnerability Recently Used to Target Users in South Korea
7. USB threats from malware to miners

WORLD

8. Ex-NSA Hacker Sentenced to Jail Over Kaspersky Leak
9. Operator of Scan4You Malware-Scanning sentenced to 14 Years in prison
10. Snyk gets $22 million for platform that tracks security flaws in open source projects
11. Astaroth Trojan Resurges in South America
12. BrandPost: Malicious Tactics Have Evolved: Your DNS Needs to, Too
13. Security In The Crypto World: Exchanges, Wallets, Personal Data. Kiev To Host The Largest Cybersecurity Forum In Eastern Europe
14. #SecurityNews: Scottish #Brewery recovers from #ransomware attack. #Arran Brewery in Scotland, received what they thought was a cover letter as part of a job application, but the email attachment contained malware. Read more here: https://bit.ly/2PYAR7k
15. Man gets two years in prison for sabotaging US Army servers with 'logic bomb'
16. Baddies just need one email account with clout to unleash phishing hell
17. Malware Analysis using Osquery Part 1
18. MassMiner Malware Targeting Web Servers
19. 14 years prison for man who helped hackers evade detection by anti-virus software
20. SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users
21. 14 years prison for man who helped hackers evade detection by anti-virus software
22. New malware-as-a-service, Black Rose Lucy targets Android devices

ATTACKS

23. Firefox Monitor provides password breach alerts, Would it convince you to set up a Firefox Account
24. Ex-NSA Hacker Sentenced to Jail Over Kaspersky Leak
25. Malware on SHEIN Servers Compromises Data of 6.4M Customers
26. GrrCon Augusta 2018, Rachel Giacobozzi’s ‘The Hybrid Analyst: How Phishing Created A New Type Of Intel Analyst’
27. Mozilla Launches Firefox Monitor Data Breach Notification Service
28. Tomorrow: Go beyond the usual defenses and *really* protect your email from #spearphishing attacks. Find out how with @AlexanderGTster and @illena_a from @SCmagazine. http://www.workcast.com/register?cpak=2026696370909275&referrer=valimailA …
29. Third-Party Patch Available for Microsoft JET Database Zero-Day
30. 130 Million Hotel Customers Breached Due to Exposed Database
31. State Department data breach exposes employee info (w/ commentary from @TripwireInc’s @craigtweets http://bit.ly/2MTcplE
32. DDoS Attack on Infinite Campus Limits Parent Access http://dlvr.it/QlL12Z
33. DDoS Attack on Infinite Campus Limits Parent Access https://www.infosecurity-magazine.com/news/ddos-attacks-infinite-campus?utm_source=twitterfeed&utm_medium=twitter …
34. New Adwind RAT Campaign Targets Windows, Linux and Mac Users
35. Cisco patches critical default password vulnerability
36. DDoS attack on education vendor hinders access to districts’ online portals
37. Bitcoin Core Team fixes a critical DDoS flaw in wallet software
38. Shein Data Breach Exposes Personal Data and Email Address of 6.42 Million Customers
39. Security researcher fined for hacking hotel Wi-Fi and putting passwords on the internet
40. SHEIN Data breach affected 6.42 million users
41. Security In The Crypto World: Exchanges, Wallets, Personal Data. Kiev To Host The Largest Cybersecurity Forum In Eastern Europe
42. Users fret over Chrome auto-login change
43. Security Engineer Hacks Hotel WiFi, Fined for Exposing Admin Password
44. AdGuard adblocker resets passwords after credential-stuffing attack
45. Symantec accountancy audit uncovers customer transaction recorded as revenue
46. 5 Notable Security Incidents that Recently Affected Federal Entities https://tripwire.me/2xGwKoH
47. Anti-Phishing Requires A Three-Pronged Strategy https://www.infosecurity-magazine.com/white-papers/antiphishing-requires-threepronged?utm_source=twitterfeed&utm_medium=twitter …
48. Microsoft: Here's why we're declaring end of password era
49. Microsoft 'kills' passwords, throws up threat manager, APIs Graph Security
50. Baddies just need one email account with clout to unleash phishing hell
51. Some credential-stuffing botnets don't care about being noticed any more
52. Advanced DDoS Detection and Defense
53. Why Was Equifax So Stupid About Passwords?
54. ZombieBoy
55. NewsNow suffers security breach - passwords should be considered compromised
56. Cisco patches critical default password vulnerability
57. First known malicious cryptomining campaign targeting Kodi discovered
58. SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users
59. macOS zero-day vulnerability leads to user data leaks
60. How Long Does it Take to Find Compromised Data
61. Bitcoin Core Software Patches a Critical DDoS Attack Vulnerability
62. 5 Notable Security Incidents that Recently Affected Federal Entities https://tripwire.me/2xGwKoH
63. DBeaver Community Edition 5.2.1 Releases: Free universal database tool and SQL client

THREATS

64. Open-source reuse has left Android’s most-popular apps laced with critical vulnerabilities
65. The MITRE ATT&CK Framework: Exfiltration https://tripwire.me/2NDbSJV
66. Monero bug could have allowed hackers to steal massive amounts of cryptocurrency
67. New Linux 'Mutagen Astronomy' security flaw impacts Red Hat and CentOS distros
68. Once Popular Online Ad Format Opens Top Tier Sites to XSS Attacks
69. Malware on SHEIN Servers Compromises Data of 6.4M Customers
70. Third-Party Patch Available for Microsoft JET Database Zero-Day
71. Over 80 Cisco Products Affected by FragmentSmack DoS Bug
72. Operator of Scan4You Malware-Scanning sentenced to 14 Years in prison
73. MacOS Mojave zero-day privacy vulnerability uncovered
74. New Adwind RAT Campaign Targets Windows, Linux and Mac Users
75. Cryptomining Malware Continues Rapid Growth: Report
76. Freelancers baited with job offers to download malicious macros
77. Snyk gets $22 million for platform that tracks security flaws in open source projects
78. Cisco patches critical default password vulnerability
79. Twitter fixes API bug that shared data with wrong developers
80. DanaBot trojan sets sights on Europe, new features
81. Crooks turn to Delphi packers to evade malware detection
82. Mac Mojave Zero-Day Allows Malicious Apps to Access Sensitive Info
83. Bitcoin Core Team fixes a critical DDoS flaw in wallet software
84. Astaroth Trojan Resurges in South America
85. BrandPost: Malicious Tactics Have Evolved: Your DNS Needs to, Too
86. Bloodhound – A Tool For Exploring Active Directory Domain Security
87. No Takers for Zero-Day Vulnerabilities on the Dark Web
88. macOS Mojave Patches Vulnerabilities, But New Flaws Already Emerge
89. #SecurityNews: #Cryptocurrency mining soars 459% from 2017 to 2018 with no indication of slowing down. Read more about this story here: https://bit.ly/2PXYSew
90. New CVE-2018-8373 Exploit Spotted in the Wild
91. #SecurityNews: Scottish #Brewery recovers from #ransomware attack. #Arran Brewery in Scotland, received what they thought was a cover letter as part of a job application, but the email attachment contained malware. Read more here: https://bit.ly/2PYAR7k
92. Man gets two years in prison for sabotaging US Army servers with 'logic bomb'
93. Malware Analysis using Osquery Part 2
94. Off-the-shelf RATs Targeting Pakistan
95. Malware Analysis using Osquery Part 1
96. Malicious Documents from Lazarus Group Targeting South Korea
97. GZipDe: An Encrypted Downloader Serving Metasploit
98. More Details on an ActiveX Vulnerability Recently Used to Target Users in South Korea
99. Satan Ransomware Spawns New Methods to Spread
100. MassMiner Malware Targeting Web Servers
101. Vulnerability Spotlight: Epee Levin Packet Deserialization Code Execution Vulnerability
102. 14 years prison for man who helped hackers evade detection by anti-virus software
103. USB threats from malware to miners
104. DanaBot trojan sets sights on Europe, new features
105. Twitter fixes API bug that shared data with wrong developers
106. Stealthy cryptomining apps still on Google Play
107. New Version of GandCrab Ransomware Appends 5 Character Extension To Encrypted Files
108. Cisco patches critical default password vulnerability
109. White hat hacker found a macOS Mojave privacy bypass 0-day flaw on release day
110. First known malicious cryptomining campaign targeting Kodi discovered
111. 14 years prison for man who helped hackers evade detection by anti-virus software
112. macOS zero-day vulnerability leads to user data leaks
113. New malware-as-a-service, Black Rose Lucy targets Android devices
114. Bitcoin Core Software Patches a Critical DDoS Attack Vulnerability
115. Vulnerability in macOS Mojave allows access to protected files
116. Firefox bugs can cause browsers and even the entire operating system to crash directly
117. Domain registrar oversteps taking down Zoho domain, impacts over 30Mil users
118. Why the market for zero-day vulnerabilities on the dark web is vanishing

CRIME

119. Ex-NSA Hacker Sentenced to Jail Over Kaspersky Leak
120. Porous portals, Newegg is a broken egg, and Mirai’s creators have new hats
121. Operator of Scan4You Malware-Scanning sentenced to 14 Years in prison
122. Cryptomining Malware Continues Rapid Growth: Report
123. Bitcoin Core Team fixes a critical DDoS flaw in wallet software
124. SHEIN Data breach affected 6.42 million users
125. #SecurityNews: #Cryptocurrency mining soars 459% from 2017 to 2018 with no indication of slowing down. Read more about this story here: https://bit.ly/2PXYSew
126. Man gets two years in prison for sabotaging US Army servers with 'logic bomb'
127. Microsoft: Here's why we're declaring end of password era
128. Malware Analysis using Osquery Part 2
129. Malware Analysis using Osquery Part 1
130. ZombieBoy
131. Malicious Documents from Lazarus Group Targeting South Korea
132. MassMiner Malware Targeting Web Servers
133. 14 years prison for man who helped hackers evade detection by anti-virus software
134. DanaBot trojan sets sights on Europe, new features
135. Stealthy cryptomining apps still on Google Play
136. First known malicious cryptomining campaign targeting Kodi discovered
137. 14 years prison for man who helped hackers evade detection by anti-virus software
138. Bitcoin Core Software Patches a Critical DDoS Attack Vulnerability

POLITICS

139. Ex-NSA Hacker Sentenced to Jail Over Kaspersky Leak
140. Man gets two years in prison for sabotaging US Army servers with 'logic bomb'
141. Vulnerability in macOS Mojave allows access to protected files