July 27, Threatpost – (International) Android Stagefright flaws put 950 million devices at risk. Security researchers at Zimperium zLabs reported that about 950 million Android devices are vulnerable to flaws in the operating system’s (OS) Stagefright media engine, in which excessive permissions could allow an attacker to send a Multimedia Messaging Service (MMS) or Google Hangouts message to trigger the vulnerability, granting system access on the affected device. Source
July 27, Securityweek – (International) Many high-profile firms using vulnerable PHP File Manager: researcher. A security researcher identified several vulnerabilities in Revived Wire Media’s PHP File Manager application, including the existence of a default user account with backdoor access to systems running the software, lack of protection for the user database, and arbitrary file upload vulnerabilities, among other flaws. Many firms reportedly still use the application even though it has not been updated since its release in 2010 – 2011. Source
July 27, Help Net Security – (International) Over 5,000 mobile apps found performing in-app ad fraud. Security researchers from Forensiq discovered at least 5,000 mobile applications being used for mobile hijacking ad fraud worldwide that were observed affecting 12 million unique devices over a 10-day period. Source
July 27, Threatpost – (International) Pair of bugs open Honeywell home controllers up to easy hacks. Researchers discovered vulnerabilities in Honeywell’s Tuxedo touch devices used for controlling home systems, including an authentication bypass bug that could grant access to restricted systems, and a cross-site request forgery bug that an attacker could use during an active authenticated session to execute the same commands as the user. Source
July 25, Military Times – (National) GAO: defense installation utilities at risk of cyber attack. A recent report released by the U.S. Government Accountability Office warned against vulnerabilities in the military’s industrial control systems (ICS) network controlling essential services to military installations worldwide. A 2018 deadline set by the Pentagon to address limited cyber defenses for the ICS will be difficult to meet due to delays and unreliable data, according to the report. Source