Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here.
Top headlines this week
- The U.S. warned Germany that using Huawei’s 5G technology could result in a drop in information-sharing. American officials have consistently criticized the use of the Chinese company’s technology, saying they pose a national security risk. If other countries were to use Huawei’s 5G network, the U.S. says it would fear its intelligence was not being kept safe.
- It is reported that a hacking group stole an estimated six terabytes of data from the Citrix enterprise network. The company said it took steps to contain this data breach after it was alerted by the FBI, but thousands of customers’ information could still be at risk. It is not yet known what the nature of the information taken was.
- Adobe fixed multiple remote code execution vulnerabilities in Photoshop and Digital Editions. The company released its monthly security update earlier this week. Two of the vulnerabilities were classified as critical, as an attacker could exploit them to execute code under the context of the current user.
From Talos
- A new point-of-sale malware known as “GlitchPOS” has popped up on some online marketplaces. The malware is easy enough to install and use that virtually any user could buy their way into setting up their own botnet. We believe with high confidence that this is not the first malware created by this actor.
- Microsoft released its monthly security update earlier this week, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 64 vulnerabilities, 17 of which are rated “critical,” 45 that are considered “important” and one “moderate” and “low” vulnerability each. This release also includes two critical advisories — one covering security updates to Adobe Flash Player and another concerning SHA-2.
- CleanMyMac X contains a privilege escalation vulnerability in its helper service due to improper updating. The application fails to remove the vulnerable components upon upgrading to the latest version, leaving the user open to attack. CleanMyMac X is an all-in-one cleaning tool for Macs from MacPaw.
The rest of the news
- Video app TikTok paid a $5.7 million fine to the Federal Trade Commission this week as part of a settlement. The FTC rules that the app, which allows users to upload short videos of them performing songs, improperly handled the data of users who are under the age of 13.
- Two U.S. Senators introduced a new bill that would overhaul the country’s child privacy laws. The new bill would give parents complete control over their children's data online, and even allow them to completely erase information from certain websites. It would also ban targeted ads toward anyone under the age of 13.
- Security researchers discovered a critical flaw in Switzerland’s new voting system that would allow attackers to manipulate votes. The group is now urging the Swiss government to halt the rollout of the online system.
- Social media hackers are stepping up their activity as Brexit votes continue in the U.K. Researchers discovered an uptick in fake accounts that are spreading pro-Brexit sentiment over the past several weeks.
- The U.S.’s Office of the Inspector General says NASA’s information security program contains several critical vulnerabilities. A new report states that the space agency could be open to an attack from a nation-state actor.
Article Link: http://feedproxy.google.com/~r/feedburner/Talos/~3/KECe7WC0UNM/cyber-security-week-in-review-march-15.html