Hot Cyber Security Weekly News

Dear readers, today we offer you a selection of the five hot news in the field of Cyber Security over the past week:

Slider Revolution Plugin Critical Vulnerability Being Exploited;

Microsoft, eBay apps open to man-in-the-middle MITM attacks;

A previously unknown variant of the APT backdoor XSLCmd – OSX.XSLCmd;

Hackers break into server for Obamacare website;

Facebook will teach users to protect private data.

Slider Revolution Plugin Critical Vulnerability Being Exploited

Mika Epstein, Ipstenu, of Dreamhost, notified of a serious vulnerability in the WordPress Slider Revolution Premium plugin (This a very popular plugin, and appears to be one of the most downloaded slider plugins from Envato’s Marketplace) which was patched silently.

It turns out that the vulnerability was disclosed via some underground forums. ThemePunch confirms that their plugin was patched in version 4.2 for those that purchase the plugin directly from them, and they include an auto-updater which would address the problem. The real issue lies in the way the plugin is wrapped into theme packages. ThemePunch’s approach to disclosing the issue was based on guidance they received. The vulnerability is severe enough that the attackers are able to compromise websites through it.

Link: WordPress Slider Revolution Vulnerability

Microsoft, eBay apps open to man-in-the-middle MITM attacks

At least 350 Android apps are open to man-in-the-middle MITM attacks, thanks to code that fails to validate certificates over secure sockets layer (SSL), says US Computer Emergency Response (CERT) security pro Will Dormann.

Popular vulnerable apps include the Microsoft Tech Companion, an eBay Germany app and software for the Australian supermarket chain Coles’ Credit Card.

The apps can be found in the Google Play and Amazon stores and have been included in a continually updated document created by the CERT.

Link: Microsoft, eBay apps open to man-in-the-middle diddle

A previously unknown variant of the APT backdoor XSLCmd – OSX.XSLCmd

FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd – OSX.XSLCmd – which is designed to compromise Apple OS X systems. This backdoor shares a significant portion of its code with the Windows-based version of the XSLCmd backdoor that has been around since at least 2009.

This discovery, along with other industry findings, is a clear indicator that APT threat actors are shifting their eyes to OS X as it becomes an increasingly popular computing platform.

Link: Forced to Adapt: XSLCmd Backdoor Now on OS X

Hackers break into server for Obamacare website: U.S. officials

An unknown hacker or hackers broke into a computer server supporting the HealthCare.gov website through which consumers enroll in Obamacare health insurance, a government cybersecurity team discovered last week, apparently uploading malicious files.

The malware uploaded to the server was designed to launch a distributed denial of service, or DDoS, attack against other websites, not to steal personal information, Albright said.

Link: Hackers break into server for Obamacare website

Facebook will teach users to protect private data

Social Network has launched a campaign in which users incrementally explain all privacy settings The main purpose of the program is to help users of the social network to better manage the dissemination of information and publications.

The new system uses a blue dinosaur explaining the privacy settings you need to know when publishing personal information and posts.

Dinosaur appears after logging in to Facebook, and explains the user step by step all the privacy settings – from personal information to applications that access the data of the social network.

The campaign on the page of each user will now be placed shortcut to go to the privacy settings.

Note that the intention to implement a plan to “check the privacy» Facebook announced back in June of this year. The reason was concern about the safety of users’ private data.

Link: Privacy Checkup Is Now Rolling Out