Security Newsletter

Issue #97 · 5 October 2018

50 million Facebook accounts exposed. China accused of hardware tampering. Minimal mode.

Sponsorships

1Password for Teams and Business1password.com

I use 1Password to securely share passwords and notes with my colleagues. Can't recommend them enough and I'm super honoured to have them as a sponsor.

Application layer security for modern teamstemplarbit.com

Incredible organisations from startups to some of the worlds largest enterprises trust Templarbit to protect their web applications, APIs and microservices. Run a next-gen WAF or ship a smart Content Security Policy workflow in minutes.

News

Brucon - minimal mode

This week I'm at the Brucon security conference (and recovering from a 9-hour timezone difference), so we're in minimal mode again. This means I select news and articles that look interesting, but with less stringent filtering and summarising than usual. Regular service should resume next week.

Dieter Van der Stock

Breaches and leaks

  • Facebook: well, this was a big one. By abusing the "View as" function the attackers were able to access the accounts of 50 million users.
  • Chegg: not exactly small either. Chegg, a textbook rental service, had a data breach affecting over 40 million customers.

Dieter Van der Stock

Updates

  • Adobe fixes 47 critical vulnerabilities in Acrobat and Reader: link
  • Foxit fixed more than a 100(!) vulnerabilities in their PDF reader: link
  • Mozilla patched seven vulnerabilities in Thunderbird, one of them being critical link

Dieter Van der Stock