BF-SIRT Newsletter 2016-28

The top stories from this week consist of stories such as Facebook Messenger deploys Signal Protocol for end to end encryption, and new malware (nukeware) deletes files and zaps system settings. You can also read a story about gaining Control of a .int Domain Name With DNS Trickery, and how to backdoor an AWS account.

And beware of fake Pokemon Go apps.

Top 5 Security Links
Shipping Rust in Firefox
Ciscos NCS 6000 and ASR 5000 routers need some lovin’
Race conditions on the web
SCADA malware caught infecting European energy company
Drowning Dalek commands Siri in voice-rec hack attack

Top 5 Business Intelligence links
Microsoft wins: Court rules feds can’t use SCA to nab overseas data
Private Internet Access Leaves Russia, Following Encryption Ban And Seized Servers
UK gov says new Home Sec will have powers to ban end-to-end encryption
Airtel is sniffing and censoring CloudFlare’s traffic in India and CloudFlare doesn’t even know it.
An online market that offered cheap hacked servers returns

BF-SIRT Newsletter 2016-27

The top stories from this week consist of stories such as Brexit’s Effects on Cyber Security, and 5 Actionable Steps We Can Learn from the SWIFT Banking Attacks. You can also read a story about Avast and AVG: A Future Together, and that Word hole patched in 2012 is ‘unchallenged’ king of Office exploits.

And did you know that UEFA Euro Fans At High Risk Of Online Threats?

Top 5 Security links
10 million Android phones infected by all-powerful auto-rooting apps
Google fixes high-risk Android vulnerabilities in July update
How I Cracked a Keylogger and Ended Up in Someone’s Inbox
Five security settings in iOS 10 you should immediately change
After hiatus, in-the-wild Mac backdoors are suddenly back

Top 5 Business Intelligence links
Security Basics Before the “The Next Best Thing”
Finance, Healthcare,Tech Sectors Highest Users Of Encryption, Survey Says
CEO Fraud
5 years, 2,300 data breaches. What’ll police do with our Internet Connection Records?
Malvertising slowing down, but not out

BF-SIRT Newsletter 2016-26

The top stories from this week is multiple critical vulnerabilities published in Symantec Endpoint Protection, and that StartEncrypt allowed attackers to gain SSL certificates for domains without authentication.

You can also learn about hackers post-intrusion activities in a compromised network, and that the number of corporate users hit by crypto ransomware is skyrocketing.

Beware of new crypto ransomware malware that spreads via sms and pretends to be WhatsApp, Uber and Google Play.

Top 5 Security links
Extracting Qualcomm’s KeyMaster Keys – Breaking Android Full Disk Encryption
A Case Study in Attacking KeePass
Detecting DNS Data Exfiltration
Exploring and exploiting Lenovo firmware secrets
Apple EFI firmware passwords and the SCBO myth

Top 5 Business Intelligence links
Self-Driving Tesla Was Involved in Fatal Crash, U.S. Says
Chinese gambling site served near record-breaking complex DDoS
Google fined in Peru for Ignoring the “Right To Be Forgotten”
Apple rejects Spotify’s app update, Spotify calls approval process a ‘weapon’
Empty DDoS Threats: Meet the Armada Collective