Earlier in the month of February, a grey hat hacker named “Stackoverflowin” ran a simple script which resulted in over 150,000 printers, mainly in businesses, printing out pages with some nice ASCII art and a message saying the printer was owned. Many in the media pointed the blame as a printer security issue, but the main reason was horrendously poor firewall configuration. These printers were made vulnerable due to the presence of a highly insecure rule in their network’s firewall, which allowed internally networked printers accessible across the entire internet. It didn’t matter if the printers were large sophisticated multi-functional devices or simple till receipt printers, they all received rogue print jobs directly from the internet thanks to terrible firewall management. Makes you wonder what else is vulnerable on these business’ networks as a result of poor firewall configuration and without the security management safety net of regular network vulnerability scanning and firewall rules review.
Back on the technical security front, Google researchers illustrated security weakness in SHA-1. The cryptographic hashing algorithm has not been considered secure since 2010, so the research is a poignant reminder to never use SHA-1 on new configurations, and to review and phase all SHA-1 usage in any existing solutions, such as site-to-site VPNs and within application development, go for SHA-256 or SHA-3 hashing instead.
- Major CloudFlare Bug Leaked Sensitive Data from Customers’ Websites
- Verizon Yahoo Deal at Lower Price after Hacks
- Sports Direct ‘hid data breach from Staff’
- Google Research Cracks SHA-1 (Cryptographic Hashing Algorithm)
- 40,000 WordPress blogs defaced in Hack Attacks
- Hack of Aberdeen City Council website cost the local authority £10,000
- London Hospital fined £200,000 over fertility Data Breach
- Script-Kiddie Hacker Hijacks Printers through insecure Firewalls
- UK firms ‘chronically understaffed’ in face of Cyber Threat
- Microsoft release 1 Critical Patch for Adobe Flash Player
- Google reveals bug prior to Microsoft patch
- Only 1.2% of Android devices use latest OS
Awareness, Education and Threat Intelligence
*** This is a Security Bloggers Network syndicated blog from IT Security Expert Blog authored by Dave Whitelegg. Read the original post at: http://feedproxy.google.com/~r/securityexpert/~3/_CGED3mrP9w/cyber-security-roundup-for-february-2017.html