Daily brief for 2018-11-09

ASIA

1. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
2. VMware releases security patches for a critical virtual machine escape flaw
3. VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest
4. Chinese headmaster fired after setting up his own secret cryptomining rig at school
5. Chinese headmaster fired after setting up his own secret cryptomining rig at school
6. Playbook Fridays: Domain Spinning Workbench Spaces App
7. A new spam #botnet took advantage of a UPnP vulnerability to infect over 100,000 home routers in India, China and
8. South Korean Hackers Arrested for Infecting Cryto Mining Malware
9. Phishing Attempts Soar to 137 Million in Q3
10. Phishing now possible by exploiting online video function vulnerability in Word
11. Snowden speaks about the role of surveillance firm NSO Group in Khashoggi murder
12. BCMPUPnP_Hunter Botnet infected 400k routers to turn them in email spammers
13. Exposed data of nearly 700k American Express India customers
14. Hack the Air Force 3.0 – New vulnerability bounty program
15. Nearly 700,000 Plaintext Records of American Express India Customers Personal Info Exposed Online

WORLD

16. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
17. Koadic: Security Defense in the Age of LoL Malware, Part IV
18. 'DerpTroll' derps into plea deal, admits DDoS attacks on EA, Steam, Sony game servers
19. Bug Bounty Hunter Ran ISP Doxing Service
20. VMware releases security patches for a critical virtual machine escape flaw
21. The Pentagon is Publishing Foreign Nation-State Malware
22. Stealthy Crypto-Mining Malware Evades Detection
23. Infosec Problems For 2019 and Beyond: Patching, Bug Bounties and Hype
24. Advanced tools: Process Hacker
25. This Week in Security News: Fake Apps & Malicious Bots
26. Inception Attackers Target Europe with Year-old Office Vulnerability
27. Chinese headmaster fired after setting up his own secret cryptomining rig at school
28. Playbook Fridays: Domain Spinning Workbench Spaces App
29. Flaws in Roche Medical Devices Can Put Patients at Risk
30. A new spam #botnet took advantage of a UPnP vulnerability to infect over 100,000 home routers in India, China and
31. Canada Post leaks sensitive information of thousands of cannabis buyers
32. Phishing Attempts Soar to 137 Million in Q3
33. Sony DDoS-er 'DerpTrolling' Pleads Guilty
34. D93 staff accounts compromised through a phishing scam
35. Snowden speaks about the role of surveillance firm NSO Group in Khashoggi murder
36. Canadian Uni Shutters Network After Cryptomining Attack
37. US Air Force invites white hats to find hackable flaws, again
38. Guy Fawkes Day – LulzSec Italy hit numerous organizations in Italy
39. BCMPUPnP_Hunter Botnet infected 400k routers to turn them in email spammers
40. VirusTotal and USCyberCom Join Forces To Identify Malware
41. Exposed data of nearly 700k American Express India customers
42. Hack the Air Force 3.0 – New vulnerability bounty program
43. Hackers hide malware in the Windows installation files to mine cryptocurrency
44. Nearly 700,000 Plaintext Records of American Express India Customers Personal Info Exposed Online
45. U.S. Cyber Command #malware samples will be shared to #VirusTotal by the Cyber National Mission Force and one expert said

ATTACKS

46. Email Stealing Emotet Banking Trojan Resurrected in New Extensive Spam Campaign
47. Oops: Cisco accidentally leaked in-house Dirty COW exploit code with biz conf call software
48. Bug Bounty Hunter Ran ISP Doxing Service
49. DJI drone hack could have exposed sensitive data
50. Trickbot Malware Added Password And Browser History Stealing
51. Man Sent Letter Bomb To Bitcoin Firm Over Password Reset
52. Emotet launches major new spam campaign
53. .@ablaich: “Breaches that include personally identifiable information are always dangerous because they can lead to identity theft... they can also
54. This banking malware just added password and browser history stealing to its playbook
55. Canada Post leaks sensitive information of thousands of cannabis buyers
56. This banking #malware just added #password and browser history stealing to its playbook https://zd.net/2Pl6v31 via @ZDNet & @dannyjpalmer
57. Phishing Attempts Soar to 137 Million in Q3
58. Phishing now possible by exploiting online video function vulnerability in Word
59. D93 staff accounts compromised through a phishing scam
60. Drone vulnerability could compromise enterprise data
61. "If the schemas prove not to be compatible, a backup of the previous version of a database must be used
62. 5 Ways #Cybercriminals Can Access Your Emails Without #Phishing | Check out the full infographic here:
63. Criminals are targeting cardless ATMs with the help of SMS text-based phishing (aka smishing) to drain bank accounts using stolen
64. Exposed data of nearly 700k American Express India customers
65. Nearly 700,000 Plaintext Records of American Express India Customers Personal Info Exposed Online

THREATS

66. Hackers Target Bitcoins and USCYBERCOM Shares Malware | Avast
67. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
68. Koadic: Security Defense in the Age of LoL Malware, Part IV
69. Recently-Patched Adobe ColdFusion Flaw Exploited By APT
70. Email Stealing Emotet Banking Trojan Resurrected in New Extensive Spam Campaign
71. StatCounter fingers cache-poisoning caper for Bitcoin-slurping JavaScript hijack
72. Zero-day in popular WordPress plugin exploited in the wild to take over sites
73. Bug Bounty Hunter Ran ISP Doxing Service
74. VMware releases security patches for a critical virtual machine escape flaw
75. Ransomware Still the Top Malware Threat During 2018 According to Europol
76. The Pentagon is Publishing Foreign Nation-State Malware
77. Cryptomining Malware Uses Rootkit to Hide on Infected Linux Systems
78. The Week in Ransomware - November 9th 2018 - Mostly Dharma Variants
79. Stealthy Crypto-Mining Malware Evades Detection
80. Infosec Problems For 2019 and Beyond: Patching, Bug Bounties and Hype
81. Advanced tools: Process Hacker
82. Trickbot Malware Added Password And Browser History Stealing
83. Man Sent Letter Bomb To Bitcoin Firm Over Password Reset
84. This Week in Security News: Fake Apps & Malicious Bots
85. "Inception Attackers" Combine Old Exploit and New Backdoor
86. Linux cryptocurrency miners are installing rootkits to hide themselves
87. VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest
88. Chinese headmaster fired after setting up his own secret cryptomining rig at school
89. Kraken Ransomware
90. Inception Attackers Target Europe with Year-old Office Vulnerability
91. Chinese headmaster fired after setting up his own secret cryptomining rig at school
92. Playbook Fridays: Domain Spinning Workbench Spaces App
93. Flaws in Roche Medical Devices Can Put Patients at Risk
94. This banking malware just added password and browser history stealing to its playbook
95. Inception hackers target European organisations with old Office flaw
96. A new spam #botnet took advantage of a UPnP vulnerability to infect over 100,000 home routers in India, China and
97. South Korean Hackers Arrested for Infecting Cryto Mining Malware
98. Serious XSS Vulnerability Patched in Evernote
99. #Cyberespionage hackers have used stolen #DigitalCertificates to steal data. Expert Michael Cobb of @thehairyITdog explains how hackers sign Plead
100. Update now! WordPress sites vulnerable to WooCommerce plugin flaw
101. Are you prepared for #ransomware? Download this how-to guide to learn how to prepare for and detect an attack before
102. This banking #malware just added #password and browser history stealing to its playbook https://zd.net/2Pl6v31 via @ZDNet & @dannyjpalmer
103. The Morris Worm Turns 30
104. Phishing now possible by exploiting online video function vulnerability in Word
105. Idaho Falls School District Struck by a Computer Virus Attack
106. Vulnerabilities in Our Infrastructure: 5 Ways to Mitigate the Risk
107. OSX/SurfBuyer: Real malware is in the eye of the device holder
108. No, You Don't Need a Blockchain
109. Cisco fixes two critical bugs, recommends workaround for a third
110. Canadian Uni Shutters Network After Cryptomining Attack
111. Drone vulnerability could compromise enterprise data
112. US Air Force invites white hats to find hackable flaws, again
113. How is Plead malware used for cyberespionage attacks?
114. Prioritizing Flaws Based on Severity Increasingly Ineffective: Study
115. DJI Drone Can be Hacked using New Vulnerability To Steal Drone’s Flight logs, Photos & Videos
116. Adobe ColdFusion Vulnerability Exploited in the Wild
117. VirusTotal and USCyberCom Join Forces To Identify Malware
118. Combination of bugs in WordPress and WooCommerce allows website hijacking
119. Hack the Air Force 3.0 – New vulnerability bounty program
120. Hackers hide malware in the Windows installation files to mine cryptocurrency
121. Visiting Bitcoin City.
122. Seagate and IBM Work Together to Help Reduce Global Hard Drive Counterfeiting with Blockchain Technology
123. U.S. Cyber Command #malware samples will be shared to #VirusTotal by the Cyber National Mission Force and one expert said

CRIME

124. Email Stealing Emotet Banking Trojan Resurrected in New Extensive Spam Campaign
125. 'DerpTroll' derps into plea deal, admits DDoS attacks on EA, Steam, Sony game servers
126. Bug Bounty Hunter Ran ISP Doxing Service
127. Ransomware Still the Top Malware Threat During 2018 According to Europol
128. Advanced tools: Process Hacker
129. This Week in Security News: Fake Apps & Malicious Bots
130. Chinese headmaster fired after setting up his own secret cryptomining rig at school
131. Playbook Fridays: Domain Spinning Workbench Spaces App
132. .@ablaich: “Breaches that include personally identifiable information are always dangerous because they can lead to identity theft... they can also
133. South Korean Hackers Arrested for Infecting Cryto Mining Malware
134. #Cyberespionage hackers have used stolen #DigitalCertificates to steal data. Expert Michael Cobb of @thehairyITdog explains how hackers sign Plead
135. DerpTrolling game server DDoS attacker pleads guilty
136. Phishing Attempts Soar to 137 Million in Q3
137. Sony DDoS-er 'DerpTrolling' Pleads Guilty
138. D93 staff accounts compromised through a phishing scam
139. How is Plead malware used for cyberespionage attacks?
140. Criminals are targeting cardless ATMs with the help of SMS text-based phishing (aka smishing) to drain bank accounts using stolen
141. Latest Hacking News Podcast
142. Notorious "DerpTrolling" Pleads Guilty to DDoS Attacks on EA & Sony

POLITICS

143. This Week in Security News: Fake Apps & Malicious Bots
144. Chinese headmaster fired after setting up his own secret cryptomining rig at school
145. Chinese headmaster fired after setting up his own secret cryptomining rig at school
146. #Cyberespionage hackers have used stolen #DigitalCertificates to steal data. Expert Michael Cobb of @thehairyITdog explains how hackers sign Plead
147. Phishing Attempts Soar to 137 Million in Q3
148. Snowden speaks about the role of surveillance firm NSO Group in Khashoggi murder
149. How is Plead malware used for cyberespionage attacks?
150. Guy Fawkes Day – LulzSec Italy hit numerous organizations in Italy
151. Exposed data of nearly 700k American Express India customers