Cybersecurity News Roundup, August 5 - 11
Qrator Newsletter

This post represents a regular Cybersecurity Newsletter issue, available at the dedicated subscribe page.

This time, we are between August 5 and 11 with the best articles, blog posts, and preprints.

 

The 8chan controversy, Cloudflare and everything else:

Initial Cloudflare statement: https://new.blog.cloudflare.com/terminating-service-for-8chan/;

Additional stories on the outage: https://arstechnica.com/information-technology/2019/08/8chan-is-all-the-way-down-its-dns-its-always-dns/https://techcrunch.com/2019/08/05/8chans-new-internet-host-was-kicked-off-its-own-host-just-hours-later/;

Bloomberg on Section 230: https://www.bloomberg.com/news/features/2019-08-07/section-230-was-supposed-to-make-the-internet-a-better-place-it-failed.

 

An IoT intrusion path found by Microsoft: https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/.

Qualcomm chips vulnerabilities described at the Tencent blog: https://blade.tencent.com/en/advisories/qualpwn/.

KDE run into a bit of an issue last week: https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt.

A great story from StackOverflow developer on how they cache things: https://nickcraver.com/blog/2019/08/06/stack-overflow-how-we-do-app-caching/.

Reuters on UN report, stating that North Korea profits from cyberattacks: https://www.reuters.com/article/us-northkorea-cyber-un/north-korea-took-2-billion-in-cyberattacks-to-fund-weapons-program-u-n-report-idUSKCN1UV1ZX.

Electron-based apps compromised: https://arstechnica.com/information-technology/2019/08/skype-slack-other-electron-based-apps-can-be-easily-backdoored/.

The "warshipping" hacking technique by X-Force Red: https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/.

Bypassing authentication trojan, targeting China: https://www.fortinet.com/blog/threat-research/chinese-targeted-trojan-analysis.html.

Black Hat 2019 brought a bunch of terrific stories last week, here's one of them: https://research.checkpoint.com/black-hat-2019-whatsapp-protocol-decryption-for-chat-manipulation-and-more/.

HTTP Desync Attacks, from DEF CON https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn.

LAN-based Blind SSRF Attack Primitive for Windows: https://initblog.com/2019/switcheroo/.

Another one DEF CON story: https://shenaniganslabs.io/2019/08/08/Lock-Screen-LPE.html.

New AMD server processors found big customers: https://cloud.google.com/blog/products/compute/amd-epyc-processors-come-to-google-and-to-google-cloudhttps://www.reuters.com/article/us-amd-alphabet/amd-lands-google-twitter-as-customers-with-newest-server-chip-idUSKCN1UX2KL.

RIPE Labs analysis of CDN Performance: https://labs.ripe.net/Members/emirb/analysing-global-cdn-performance.

Encrypted DSLR camera: https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera/.

Coinbase story of responding to 0-days in the wild: https://blog.coinbase.com/responding-to-firefox-0-days-in-the-wild-d9c85a57f15b.

Eclypsium found dozens of security flaws in kernel drivers: https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/.

 

Have a productive week and feel free to write us back at cybersec@qrator.net!