Gatekeeper, WannaCry, and BlueKeep- Paul’s DigitalMunition #606

In the security news, giving you the latest on thousands of infected servers from a cryptojacking campaign, an open letter to the GCHQ calling out spy agencies, and a new vulnerability that makes you WannaCry!

Paul’s Stories

1. Redditor can stay anonymous, court rules
2. The industrys best-kept secret: why mobile ad fraud prevention is just too good to be true
3. Spies with that? Police can snoop on McDonald’s and Westfield wifi customers
4. 8 Ways to Authenticate Without Passwords
5. Flipboard Resets User Passwords in Response to Data Breach | SecurityWeek.Com
6. Eternally Blue: Baltimore City leaders blame NSA for ransomware attack
7. Docker Vulnerability Gives Arbitrary File Access to Host | SecurityWeek.Com
8. Trends in Cybersecurity to Watch
9. Majority of CISOs plan to ask for an increase in cybersecurity investment – Help Net Security
10. Hackers actively exploit WordPress plugin flaw to send visitors to bad sites
11. Virus-packed laptop sells as artwork for over RM5.5mil
12. Technology is Not Our Problem | SecurityWeek.Com
13. What a teen grade hackers confession can teach us
14. The cryptominer that kept coming back
15. InfoSec Handlers Diary Blog – Analyzing First Stage Shellcode
16. Malware Found on PoS Systems at Checkers and Rally’s Restaurants | SecurityWeek.Com
17. High-Risk Flaws Found in Process Control Systems From B&R Automation | SecurityWeek.Com
18. macOS Gatekeeper Bypass Exploits Trust on Network Shares | SecurityWeek.Com
19. InfoSec Handlers Diary Blog – nmap Service Fingerprint
20. Killer SecOps Skills: Soft Is the New Hard
21. Old Threats Are New Again

Larry’s Stories

1. Researchers have discovered one million devices that are vulnerable to a “wormable” Microsoft flaw, which could open the door to a WannaCry-like cyberattack
2. Researcher Filippo Cavallarin disclosed a bug in the macOS security feature Gatekeeper – Allows malicious code execution on systems running the most recent version of Mojave (10.14.0)
3. Up to 50,000 servers were infected over the past four months as part of a high-profile cryptojacking campaign – Believed to orchestrated by Chinese-language adversaries
4. Apple, Google, WhatsApp, Microsoft, along with 43 security experts and privacy advocates, have signed an open letter to the GCHQ calling out the UK spy agency’s “ghost proposal.” – If they back down from one country, where will they draw the line?]
5. Would your average Internet user be any more vigilant against phishing scams if he or she faced the real possibility of losing their job after falling for one too many of these emails? – Recently, I met someone at a conference who said his employer had in fact terminated employees for such repeated infractions. As this was the first time I’d ever heard of an organization actually doing this, I asked some phishing experts what they thought (spoiler alert: they’re not fans of this particular teaching approach)
6. BlueKeep PoC

Full Show Notes

Follow us on Twitter: https://www.twitter.com/securityweekly

http://traffic.libsyn.com/sw-all/Gatekeeper_WannaCry_and_BlueKeep-_Pauls_Security_Weekly_606_converted.mp3