AUSCERT Week in Review for 14th September 2018

Greetings,

Another work week is over and there has probably been significant patching activities again following Microsoft’s patch Tuesday. 17 critical vulnerabilities were addressed and also the recently disclosed Zero-Day Task Scheduler vulnerability.

In one of the articles referenced below, we see another example of private data exfiltration from our personal electronic devices, and this time from one of the big security players (Trend Micro).

Below is a summary (including excerpts) of some of the more interesting stories we’ve seen this week:

—–

Microsoft September 2018 Patch Tuesday Fixes 17 Critical Vulnerabilities

Date Published: 11-09-2018
https://www.bleepingcomputer.com/news/security/microsoft-september-2018-patch-tuesday-fixes-17-critical-vulnerabilities/
Author: Lawrence Abrams

Excerpt: “This Patch Tuesday fixes 17 Critical security vulnerabilities that when exploited could lead to code execution. These vulnerabilities are the most dangerous as if they are exploited could allow a remote attacker to execute commands on a vulnerable computer and essentially take full control.”

—–

Election infrastructure security: Should we use Internet voting?

Date Published: 10-09-2018
https://www.helpnetsecurity.com/2018/09/10/election-infrastructure-security/
Author: Help Net Security

Excerpt: “To protect the integrity and security of U.S. elections, all local, state, and federal elections should be conducted using human-readable paper ballots by the 2020 presidential election, says a new report from the National Academies of Sciences, Engineering, and Medicine.”

—–

NSW puts digital driver’s licence on a blockchain

Date Published: 10-09-2018
https://www.itnews.com.au/news/nsw-puts-digital-drivers-licence-on-a-blockchain-512298
Author: Justin Hendry

Excerpt: “The NSW government’s digital driver’s licence will be underpinned by blockchain technology developed by Australian firm Secure Logic.”

“It plans to make digital driver’s licences and digital photo cards available to citizens across the state by the end of 2019.”

—–

Trend Micro blames data collection issue on code library re-use

Date Published: 11-09-2018
https://www.cyberscoop.com/trend-micro-mac-app-store-browser-history/
Author: Greg Otto

Excerpt: “Cybersecurity giant Trend Micro has apologized after researchers discovered that a number of the company’s consumer-facing apps were collecting users’ browser histories.”

—–

2 Billion Bluetooth Devices Remain Exposed to Airborne Attack Vulnerabilities

Date Published: 13-09-2018
https://www.darkreading.com/attacks-breaches/2-billion-bluetooth-devices-remain-exposed-to-airborne-attack-vulnerabilities/d/d-id/1332815
Author: Jai Vijayan

Excerpt: “One year after security vendor Armis disclosed a set of nine exploitable vulnerabilities in Bluetooth, some 2 billion devices — including hundreds of millions of Android and iOS smartphones — remain exposed to the threat.”

—–

Here are a few of this week’s noteworthy security bulletins:

1) ASB-2018.0211.2

https://portal.auscert.org.au/bulletins/68074

Patch Tuesday Windows Updates.

2) ESB-2018.2682

https://portal.auscert.org.au/bulletins/67966

Multiple vulnerabilities including RCEs patched in Chromium.

3) ESB-2018.2683

https://portal.auscert.org.au/bulletins/67970

Multiple vulnerabilities including RCEs patches in Firefox.

4) ESB-2018.2731