5G, Zero-Days, & National Museum – Paul’s Security Weekly #593

5G networks must be secured from hackers and bad actors, zero-day vulnerability highlights the responsible disclosure dilemma, a flaw in multiple airline systems exposes passenger data, security bugs in video chat tools enable remote attackers, and an original World War 2 German message decrypts to go on display at the National Museum of Computing!

Paul’s Stories

  1. 5G networks must be secured from hackers, bad actors, US senator says
  2. Unlimited crypotocurrency? Zcash fixes counterfeiting flaw
  3. National pen test execution standard would improve network security
  4. Security expert Marco Ramilli released for free the Malware Hunter tool
  5. Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma | SecurityWeek.Com
  6. What do successful pentesting attacks have in common? – Help Net Security
  7. Lookalike domains: Artificial intelligence may come to the rescue – Help Net Security
  8. 8 months of GDPR: 59,000+ reported breaches, 91 fines – Help Net Security
  9. Flaw in Multiple Airline Systems Exposes Passenger Data
  10. When 911 Goes Down: Why Voice Network Security Must Be a Priority
  11. Micro-segmentation Security Firm Illumio Raises $65 Million | SecurityWeek.Com
  12. Security Bugs in Video Chat Tools Enable Remote Attackers
  13. Half of IoT devices let down by vulnerable apps
  14. Original WWII German message decrypts to go on display at National Museum of Computing

Jeff’s Stories

  1. Today is Shine a Light on Slavery Day Born out of the belief that even one person trapped in slavery is too many, #ENDITMOVEMENT is a coalition of the leading organizations in the world in the fight for freedom.
  2. Fewer Breaches in 2018, But More Sensitive Data Spilled
  3. What Can We Learn from the Healthcare Data Breach ‘Wall of Shame’?
  4. Tribe of Hackers FREE PDF Cybersecurity advice from the best hackers in the world
  5. Does HIPAA Apply to Medical Marijuana Facilities?

Lee’s Stories

  1. Authentication and Key Management flaws in 5G Authentication and Security issues are being revealed in 5G which allow MITM and collection of other mobile user information. May also impact 4G & 3G protocols. Expect fixes by end of 2019 with second phase deployment.
  2. Phone number porting scam Scenario where you’re being asked to call someone who says you must provide a PIN first, this is the PIN for completing a phone port to Google Voice of your number.
  3. Discarded smart lightbulbs can reveal your passwords Discarded Lifx lightbulbs were found to store WiFi passwords and RSA private keys in the clear.
  4. LibreOffice and OpenOffice RCE flaw disclosed. Exploits the Python file parsing code to call functions and pass parameters. LibreOffice has a patch. Workaround: disable python support by renaming or removing pythonscrypt.py
  5. Vaporworms – a new variant of fileless malware threat. Preditcted to be the scourge of 2019 – vaporware is a new twist on fileless malware which is harder to track and find, e.g. payload in one registry key, and execution command in another.
  6. Apple Releases Multiple Security Updates iOS 12.1.4 and OS X 10.14.3 Supplimental Update to address Group FaceTime issue. Group FaceTime still appears disabled even with those updates applied as of the broadcast.

Full Show Notes

Follow us on Twitter: https://www.twitter.com/securityweekly

Lee Neely
Lee Neely – Senior Cyber Analyst , Lawrence Livermore National Laboratory.
Jeff Man
Jeff Man – Sr. InfoSec Consultant, Online Business Systems.
Paul Asadorian
Paul Asadorian – CEO, Security Weekly.
  • RSA Conference 2019 is coming up March 4 – 8 in San Francisco! Go to rsaconference.com/securityweekly-us19 to register now using the discount code 5U9SWFD to receive $100 off a full conference pass! If you are interested in booking an interview or briefing with Security Weekly, please go to securityweekly.com/conferencerequest to submit your request!
  • Join us April 1-3, at Disney’s Contemporary Resort for InfoSec World 2019 where you can connect and network with like-minded individuals in search of actionable information. Visit https://infosecworld.misti.com/ and use the registration code OS19-SECWEEK for 15% off the Main Conference or World Pass. If you are interested in booking an interview or briefing with Security Weekly, please go to securityweekly.com/conferencerequest to submit your request!
  • Registration is now open for the first Security Weekly webcast of 2019! You can register for our “Rise Above Complex Workflows: Practical Ways To Accelerate Incident Response” webcast now by going to securityweekly.com/webcasts