2019 年最可怕的黑客事件与安全漏洞（下）
安全
![](/data/attachment/album/201910/30/234824ok4qo2o5rryyrwd5.png)


是的，这是年终摘要文章之一。这是一篇很长的文章，因为就网络安全新闻来说，2019 年就是一场灾难，每周都会有一个或多个重大事件发生。


以下是按月组织的过去 10 个月安全灾难的摘要。 


### 七月


[哈萨克斯坦政府拦截了所有本地 HTTPS 流量](https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/)：HTTPS 拦截工作[针对 Facebook，Google，Twitter 和其他站点](https://www.zdnet.com/article/kazakhstans-https-interception-efforts-target-facebook-google-twitter-others/)。[苹果、谷歌和 Mozilla](https://www.zdnet.com/article/apple-google-and-mozilla-block-kazakhstans-https-intercepting-certificate/) 最终干预并禁止了用于 HTTPS 中间人攻击的证书。


[黑客窃取了数百万保加利亚人的数据](https://www.zdnet.com/article/hacker-steals-data-of-millions-of-bulgarians-emails-it-to-local-media/)：一名黑客窃取了数百万保加利亚人的个人详细信息，并将窃取的数据的下载链接通过电子邮件发送给了本地新闻出版物。该数据窃取自该国国家税务局，[最终在网上泄露](https://www.zdnet.com/article/bulgarias-hacked-database-is-now-available-on-hacking-forums/)。


[黑客侵入了 FSB 的承包商](https://www.zdnet.com/article/hackers-breach-fsb-contractor-expose-tor-deanonymization-project/)：黑客侵入了俄罗斯国家情报局 FSB 的承包商 SyTech，他们从那里窃取了该公司代表该机构开展的内部项目的信息，包括将 Tor 流量匿名化的信息。


[iMessages 可能使你的 iPhone 变砖](https://www.zdnet.com/article/google-project-zero-reveals-bad-imessages-could-have-bricked-your-iphone/)：该漏洞在被广泛利用之前得到了修补。


[Urgent/11 安全漏洞](https://www.zdnet.com/article/urgent11-security-flaws-impact-routers-printers-scada-and-many-iot-devices/)：TCP 库中的主要错误影响了路由器、打印机、SCADA、医疗设备和许多 IoT 设备。


[苹果公司的 AWDL 协议受到安全漏洞的困扰](https://www.zdnet.com/article/apples-awdl-protocol-plagued-by-flaws-that-enable-tracking-and-mitm-attacks/)：苹果公司在五月份修补了一个错误，但学者说，其余的漏洞需要重新设计某些苹果服务。错误会启用跟踪和中间人攻击。


[DHS 警告小型飞机的 CAN 总线漏洞](https://www.zdnet.com/article/dhs-warns-about-can-bus-vulnerabilities-in-small-aircraft/)：DHS 网络安全机构 CISA 建议这些小型飞机的所有者“尽其所能”限制对飞机的访问，以防止这个漏洞可能被用来破坏飞机。


[GE 麻醉机中发现的漏洞](https://www.zdnet.com/article/vulnerabilities-found-in-ge-anesthesia-machines/)：GE 建议设备所有者不要将脆弱的麻醉机连接到医院的主要网络。该公司否认这些漏洞可能导致患者受到伤害，但后来撤回该说法并承认这些问题可能对人类生命构成危险。


[洛杉矶警方陷入数据泄露](https://www.zdnet.com/article/thousands-of-los-angeles-police-caught-up-in-data-breach-personal-records-stolen/)：黑客窃取了 2500 多名洛杉矶警察的个人记录。黑客直接通过电子邮件发送给该部门，并提供了一些据称是被盗信息的样本以支持他们的说法。


[路易斯安那州州长在当地勒索软件爆发后宣布州紧急状态](https://www.zdnet.com/article/louisiana-governor-declares-state-emergency-after-local-ransomware-outbreak/)：是的。勒索软件变得非常糟糕。然后它[袭击了德克萨斯州](https://www.zdnet.com/article/at-least-20-texas-local-governments-hit-in-coordinated-ransomware-attack/)、[牙医办公室](https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/)和[托管服务提供商](https://www.zdnet.com/article/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems/)。


[蓝牙漏洞利用可以跟踪和识别 iOS、微软移动设备用户](https://www.zdnet.com/article/bluetooth-vulnerability-can-be-exploited-to-track-and-id-iphone-smartwatch-microsoft-tablet-users/)：尽管存在本机操作系统保护但该漏洞可用于监视用户，它影响 Windows 10、iOS 和 macOS 计算机上的蓝牙设备。其中包括 iPhone、iPad、Apple Watch、MacBook 和微软的平板电脑和笔记本电脑。


[“7-11” 日本的客户由于移动应用漏洞而损失了 50 万美元](https://www.zdnet.com/article/7-eleven-japanese-customers-lose-500000-due-to-mobile-app-flaw/)：7-11 最终关闭了该应用。


### 八月


[SWAPGSAttack CPU 漏洞](https://www.zdnet.com/article/new-windows-hack-warning-patch-intel-systems-now-to-block-swapgsattack-exploits/)：研究人员详细介绍了该硬件漏洞，它绕过了 Windows 系统上针对 Spectre 和 Meltdown CPU 漏洞的缓解措施，并影响了所有使用自 2012 年以来制造的英特尔处理器的系统。


[新的 Dragonblood 漏洞](https://www.zdnet.com/article/new-dragonblood-vulnerabilities-found-in-wifi-wpa3-standard/)：今年四月初，两名安全研究人员披露了 WiFi 联盟最近发布的 WPA3 WiFi 安全和身份验证标准中五个漏洞（[统称为 Dragonblood](https://www.zdnet.com/article/dragonblood-vulnerabilities-disclosed-in-wifi-wpa3-standard/)）的详细信息。


[14 个 iOS 零日漏洞](https://www.zdnet.com/article/google-finds-malicious-sites-pushing-ios-exploits-for-years/)：自 2016 年 9 月以来，谷歌发现了针对 14 个 iOS 漏洞的攻击，这些漏洞分为五个漏洞利用链，并已被广泛部署。


[VPN 安全漏洞](https://www.zdnet.com/article/hackers-mount-attacks-on-webmin-servers-pulse-secure-and-fortinet-vpns/)：黑客对 Pulse Secure 和 Fortinet VPN 发起攻击。


[Windows CTF 漏洞](https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/)：Microsoft CTF 协议中的漏洞可以追溯到 Windows XP。该错误允许黑客劫持任何 Windows 应用，逃脱沙箱并获得管理员权限。


[WS-Discovery 协议被滥用于 DDoS 攻击](https://www.zdnet.com/article/protocol-used-by-630000-devices-can-be-abused-for-devastating-ddos-attacks/)：该协议被 DDoS 租用服务所利用，已在实际攻击中使用。


[Capitol One 黑客事件](https://www.zdnet.com/article/100-million-americans-and-6-million-canadians-caught-up-in-capital-one-breach/)：一名黑客侵入了 Capitol One，从那里窃取了 1 亿用户的记录。她还[入侵了其他 30 家公司](https://www.zdnet.com/article/capital-one-hacker-took-data-from-more-than-30-companies-new-court-docs-reveal/)。


[Hy-Vee 卡泄露](https://www.zdnet.com/article/hy-vee-issues-warning-to-customers-after-discovering-point-of-sale-breach/)：超市连锁店 Hy-Vee 承认其某些 PoS 系统存在安全漏洞。该数据最终被在黑客论坛上出售。 


[员工将核电厂连接到互联网，以便他们可以开采加密货币](https://www.zdnet.com/article/employees-connect-nuclear-plant-to-the-internet-so-they-can-mine-cryptocurrency/)：乌克兰核电厂的员工为了开采比特币而承担了不必要的安全风险。他们最终被捕。


[莫斯科的区块链投票系统在大选前一个月就被攻破了](https://www.zdnet.com/article/moscows-blockchain-voting-system-cracked-a-month-before-election/)：法国研究人员因在基于以太坊的投票系统中发现漏洞而获得 15000 美元的奖金。


[美国军方购买了价值 3280 万美元的具有已知安全风险的电子产品](https://www.zdnet.com/article/us-military-purchased-32-8m-worth-of-electronics-with-known-security-risks/)：国防部购买的易受攻击产品包括 Lexmark 打印机、GoPro相机和联想计算机。


[AT＆T 员工受贿以在公司网络上植入恶意软件](https://www.zdnet.com/article/at-t-employees-took-bribes-to-plant-malware-on-the-companys-network/)：美国司法部指控巴基斯坦男子贿赂 AT＆T 员工超过 100 万美元，以在该公司网络上安装恶意软件，解锁超过 200 万台设备。


[Windows 恶意软件会记录用户在成人网站上的访问](https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/)：新的 Varenyky 木马会记录用户浏览成人网站的桌面视频。当前仅针对法国用户。


[TrickBot 木马具备协助 SIM 交换攻击的功能](https://www.zdnet.com/article/trickbot-todays-top-trojan-adds-feature-to-aid-sim-swapping-attacks/)：TrickBot 木马可以收集 Sprint、T-Mobile 和 Verizon Wireless 帐户的凭据和 PIN 码。


[战争技术](https://www.zdnet.com/article/new-warshipping-technique-gives-hackers-access-to-enterprise-offices/)：黑客可以使用包裹传递服务将黑客设备直接运送到你公司的门口。


[Instagram 踢掉了广告合作伙伴 Hyp3r](https://www.zdnet.com/article/instagram-boots-ad-partner-hyp3r-for-mass-collection-of-user-data/)：Instagram 发现该广告合作伙伴收集其用户数据。 


### 九月


[Simjacker 攻击](https://www.zdnet.com/article/new-simjacker-attack-exploited-in-the-wild-to-track-users-for-at-least-two-years/)：安全研究人员详细介绍了一种基于 SMS 的攻击，该攻击可以通过滥用 SIM 卡上运行的鲜为人知的应用程序，使恶意行为者可以跟踪用户的设备。发现 [29 个国家/地区](https://www.zdnet.com/article/these-are-the-29-countries-vulnerable-to-simjacker-attacks/)的 SIM 卡受到了影响。 还发现了第二起名为 [WIBAttack](https://www.zdnet.com/article/new-sim-card-attack-disclosed-similar-to-simjacker/) 的攻击。


[智能电视间谍活动](https://www.zdnet.com/article/smart-tvs-send-user-data-to-tech-heavyweights-including-facebook-google-netflix/)：两项学术论文发现，智能电视正在收集有关用户的电视观看习惯的数据。


[Checkm8 iOS 越狱](https://www.zdnet.com/article/new-checkm8-jailbreak-released-for-all-ios-devices-running-a5-to-a11-chips/)：针对所有运行 A5 至 A11 芯片的 iOS 设备（在 iPhone 4S 以及 iPhone 8 和 X 上）发布的新 Checkm8 越狱。过去九年来，这是第一个在硬件级别起作用的越狱漏洞。


[数据库泄漏了厄瓜多尔大多数公民的数据](https://www.zdnet.com/article/database-leaks-data-on-most-of-ecuadors-citizens-including-6-7-million-children/)：Elasticsearch 服务器泄漏了有关厄瓜多尔公民其家谱和孩子的个人数据，还泄漏了一些用户的财务记录和汽车登记信息。[该公司高管随后被捕](https://www.zdnet.com/article/arrest-made-in-ecuadors-massive-data-breach/)。


[Limin PDF 泄露事件](https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/)：九月中旬，超过 2430 万 Lumin PDF 的用户详细信息在黑客论坛上被分享。该公司在第二天承认这次泄露。


[Heyyo 约会应用程序泄漏事件](https://www.zdnet.com/article/heyyo-dating-app-leaked-users-personal-data-photos-location-data-more/)：他们泄漏了除私人消息以外的几乎所有内容。


[vBulletin 零日漏洞和随后的黑客攻击](https://www.zdnet.com/article/anonymous-researcher-drops-vbulletin-zero-day-impacting-tens-of-thousands-of-sites/)：一位匿名安全研究人员发布了 vBulletin 论坛软件中的零日漏洞。该漏洞立即被黑客用于入侵一系列论坛。


[大量的帐户劫持事件袭击了 YouTube 创作者](https://www.zdnet.com/article/massive-wave-of-account-hijacks-hits-youtube-creators/)：汽车社区的 YouTube 创作者遭受了鱼叉式网络钓鱼攻击，这些攻击可以绕过 2FA，从而使黑客可以接管其 Google 和 YouTube 帐户。


[Lilocked（Lilu）勒索软件](https://www.zdnet.com/article/thousands-of-servers-infected-with-new-lilocked-lilu-ransomware/)：成千上万的 Linux 服务器感染了新的 Lilocked（Lilu）勒索软件。


[超过 47,000 台超微服务器正在互联网上暴露了其 BMC 端口](https://www.zdnet.com/article/over-47000-supermicro-servers-are-exposing-bmc-ports-on-the-internet/)：研究人员在超微服务器上发现了一个新的远程攻击方式，发现它在互联网上暴露了其 BMC 端口。


[勒索软件事件给公司造成了高达 9500 万美元的损失](https://www.zdnet.com/article/ransomware-incident-to-cost-danish-company-a-whopping-95-million/)：丹麦制造助听器 Demant 的勒索软件事件造成了近 9500 万美元的损失，这是迄今为止最昂贵的事件之一。


[Exim 漏洞（CVE-2019-15846）](https://www.zdnet.com/article/millions-of-exim-servers-vulnerable-to-root-granting-exploit/)：数百万的 Exim 服务器容易受到一个安全漏洞的攻击，利用该漏洞可以使攻击者能够以 root 特权运行恶意代码。 


### 十月


[Avast 黑客事件](https://www.zdnet.com/article/avast-says-hackers-breached-internal-network-through-compromised-vpn-profile/)：这家捷克的杀毒软件制造商在 2017 年遭受攻击之后，披露了其受到了第二次攻击，旨在破坏 CCleaner 版本。该公司表示，黑客通过受损的 VPN 配置文件破坏了该公司。


[被广泛利用的 Android 零日漏洞](https://www.zdnet.com/article/google-finds-android-zero-day-impacting-pixel-samsung-huawei-xiaomi-devices/)：Google Project Zero 研究人员发现了被广泛利用的 Android 零日漏洞，影响了 Pixel、三星、华为、小米设备。


[Alexa 和 Google Home 设备再次被利用来网络钓鱼和窃听用户](https://www.zdnet.com/article/alexa-and-google-home-devices-leveraged-to-phish-and-eavesdrop-on-users-again/)：亚马逊、Google 在首次报告后一年多未能解决 Alexa 和 Home 设备中的安全漏洞。


[捷克当局拆除了据称是俄罗斯的网络间谍网络](https://www.zdnet.com/article/czech-authorities-dismantle-alleged-russian-cyber-espionage-network/)：捷克官员说，俄罗斯特工利用当地公司对外国目标发起网络攻击。官员们表示，运营得到了俄罗斯国家情报局 FSB 的支持以及当地大使馆的财政帮助。


[约翰内斯堡被黑客团伙勒索赎金](https://www.zdnet.com/article/city-of-johannesburg-held-for-ransom-by-hacker-gang/)：一个名为“Shadow Kill Hackers”的组织正在向当地官员索要 4 枚比特币，否则他们将在线发布该城市数据。这是在七月遭到勒索软件攻击之后对约翰内斯堡的第二次重大袭击，当时导致一些当地居民[断电](https://www.zdnet.com/article/ransomware-incident-leaves-some-johannesburg-residents-without-electricity/)。


[CPDoS 攻击事件](https://www.zdnet.com/article/cpdos-attack-can-poison-cdns-to-deliver-error-pages-instead-of-legitimate-sites/)：CloudFront、Cloudflare、Fastly、Akamai 等受到新的 CPDoS Web 缓存中毒攻击的影响。


[被广泛利用的 PHP7 RCE](https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/)：新的 PHP7 错误 CVE-2019-11043 甚至可以使非技术攻击者接管运行 PHP-FPM 模块的 Nginx 服务器。


[遭受 DDoS 攻击的 macOS 系统](https://www.zdnet.com/article/macos-systems-abused-in-ddos-attacks/)：多达 4 万个 macOS 系统在线暴露了一个特定的端口，该端口可能被滥用于相当大的 DDoS 攻击。 


OK
[2010s: The Decade in Review](/topic/decade-in-review/)

# The scariest hacks and vulnerabilities of 2019

![catalin-cimpanu.jpg](https://www.zdnet.com/a/img/resize/cfe8bff3bdc8af3f2ab8d2a4252f39ca491137af/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/catalin-cimpanu.jpg?auto=webp&fit=crop&frame=1&height=192&width=192)

Yes, this is one of those end-of-year summaries. And it's a long one, since 2019 has been a disaster in terms of cyber-security news, with one or more major stories breaking on a weekly basis.

Below is a summary for the past 10 months of security disasters, organized by month.

### January

[ Severe vulnerability in Apple FaceTime](https://www.zdnet.com/article/apple-facetime-exploit-found-by-14-year-old-playing-fortnite/) - A bug in Apple's FaceTime app let attackers call and self-answer a FaceTime call without any user interaction from the callee, opening the door for secret surveillance.

[ North Korean hackers infiltrate Chile's ATM network after Skype job interview](https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/) - the article's title is self-explanatory, and the story is worth your time to read.

[ Hackers breach and steal data from South Korea's Defense Ministry](https://www.zdnet.com/article/hackers-breach-and-steal-data-from-south-koreas-defense-ministry/) - Seoul government said hackers breached 30 computers and stole data from 10. The hacked computers stored data on weapons and munitions acquisition.

[ Someone hacked the PHP PEAR website](https://www.zdnet.com/article/mystery-still-surrounds-hack-of-php-pear-website/) - We still don't know what happened there, but some hacker breached the PHP PEAR repo and backdoored a version of the PHP PEAR package manager.

[ Security flaws found in 26 low-end cryptocurrencies](https://www.zdnet.com/article/security-flaws-found-in-26-low-end-cryptocurrencies/) - This report shows just how dangerous some low-end, no-name cryptocurrencies are, and how hackers could steal funds en-masse at any time.

[ Oklahoma gov data leak exposes FBI investigation records](https://www.zdnet.com/article/oklahoma-gov-data-leak-exposes-millions-of-department-files-fbi-investigations/) - An Oklahoma Department of Securities server allowed anyone to download government files, such as internal files, and even FBI investigations.

[ Iranian hackers suspected in worldwide DNS hijacking campaign](https://www.zdnet.com/article/iranian-hackers-suspected-in-worldwide-dns-hijacking-campaign/) -

[FireEye](https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html), and later

[Cisco Talos](https://blog.talosintelligence.com/2019/04/seaturtle.html), disclosed a global campaign carried out by Iranian hackers who redirected traffic from companies all over their globe through their Iranian servers, recording company credentials for future attacks.To do this, they hacked DNS management accounts at domain name registrars, in order to execute DNS hijacking attacks. These same hackers also

[breached Greece's top-level domain registrar](https://www.zdnet.com/article/hackers-breached-greeces-top-level-domain-registrar/).

[ SCP implementations impacted by 36-years-old security flaws](https://www.zdnet.com/article/scp-implementations-impacted-by-36-years-old-security-flaws/) - All SCP (Secure Copy Protocol) implementations from the last 36 years, since 1983, were found to be vulnerable to four security bugs that allowed a malicious SCP server to make unauthorized changes to a client's (user's) system and hide malicious operations in the terminal.

**Yearly LTE security flaws** - Two sets of new LTE security flaws were discovered this year. One that impacted [3G, 4G, and 5G](https://www.zdnet.com/article/new-security-flaw-impacts-5g-4g-and-3g-telephony-protocols/), and a second set of [36 vulnerabilities](https://www.zdnet.com/article/researchers-find-36-new-security-flaws-in-lte-protocol/) found found after a fuzzing project carried out by South Korean security researchers.

[ Websites can steal browser data via extensions APIs](https://www.zdnet.com/article/websites-can-steal-browser-data-via-extensions-apis/) - Researcher finds nearly 200 Chrome, Firefox, and Opera extensions vulnerable to attacks from malicious sites.

[ WiFi firmware bug affects laptops, smartphones, routers, gaming devices](https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/) - Major security flaw found in Marvell Avastar chipset. List of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices.

**Malware found preinstalled on Android devices** - Happened twice in 2019. First, in January, when researchers found [malware inside an Alcatel app preinstalled on Alcatel smartphones](https://www.zdnet.com/article/malware-found-preinstalled-on-some-alcatel-smartphones/). Second, in June, when Germany's cyber-security agencies found [a backdoor in four Chinese smartphone models](https://www.zdnet.com/article/germany-backdoor-found-in-four-smartphone-models-20000-users-infected/).

### February

[ Leaky DB exposes China's Muslim-tracking practices](https://www.zdnet.com/article/chinese-company-leaves-muslim-tracking-facial-recognition-database-exposed-online/) - Security researcher Victor Gevers found a leaky DB from a Chinese company that exposed its Muslim-tracking facial recognition software, inadvertently revealing China's Uyghur-tracking practices.

[ Major WinRAR bugs exposed](https://www.zdnet.com/article/winrar-versions-released-in-the-last-19-years-impacted-by-severe-security-flaw/) - Check Point researchers found a WinrAR bug that impacted all the WinRAR versions releassed since 2000. Over 500 million WinRAR users were at risk.

[The bugs eventually become widely used](https://www.zdnet.com/article/100-unique-exploits-and-counting-for-latest-winrar-security-bug/)by cyber-criminals and nation-state hackers at the same time.

[ New WinPot malware can make ATMs spit out cash](https://www.zdnet.com/article/this-malware-turns-atm-hijacking-into-slot-machine-games/) - WinPot has been on sale on underground forums since March 2018.

[ Tor traffic from individual Android apps detected with 97% accuracy](https://www.zdnet.com/article/tor-traffic-from-individual-android-apps-detected-with-97-percent-accuracy/) - New machine learning algorithm can detect when Tor users are using a specific app, such as YouTube, Instagram, Spotify, others, via Tor.

[ Hackers wipe US servers of email provider VFEmail](https://www.zdnet.com/article/hackers-wipe-us-servers-of-email-provider-vfemail/) - Hackers did not ask for a ransom. VFEmail described the incident as "attack and destroy."

[ Thunderclap vulnerability](https://www.zdnet.com/article/thunderclap-flaws-impact-how-windows-mac-linux-handle-thunderbolt-peripherals/) - The security flaw impacts how Windows, Mac, Linux handle Thunderbolt peripherals. They allow the creation of highly dangerous malicious peripherals that can steal data from OS memory.

**PDF protocol attacks** - A team of German academics found [a way to fake signatures](https://www.zdnet.com/article/researchers-break-digital-signatures-for-most-desktop-pdf-viewers/) in PDF documents, and later this year, [a way to break PDF encryption](https://www.zdnet.com/article/researchers-break-digital-signatures-for-most-desktop-pdf-viewers/).

**Hiding malware using the CPU** - Academics have found ways to hide malware on a computer [using speculative execution](https://www.zdnet.com/article/researchers-hide-malware-in-benign-apps-with-the-help-of-speculative-execution/) and [Intel's SGX enclave system](https://www.zdnet.com/article/researchers-hide-malware-in-intel-sgx-enclaves/).

### March


[ Hackers take tornado sirens offline before major storm](https://www.zdnet.com/article/hacked-tornado-sirens-taken-offline-in-two-texas-cities-ahead-of-major-storm/) - Yeah. That was just evil.

[ The ASUS supply-chain hack](https://www.zdnet.com/article/supply-chain-attack-installs-backdoors-through-hijacked-asus-live-update-software/) - Hackers hijacked the ASUS Live Update utility to deploy malware on users' systems. The hack took place in 2018, but was disclosed in March.

[Over one million PCs](https://www.zdnet.com/article/researchers-publish-list-of-mac-addresses-targeted-in-asus-hack/)were believed to have been impacted.

[ Ring of GitHub accounts promoting 300+ backdoored apps](https://www.zdnet.com/article/researchers-uncover-ring-of-github-accounts-promoting-300-backdoored-apps/) - GitHub ring consisting of 89 accounts promoted 73 repos containing over 300 backdoored Windows, Mac, and Linux apps.

[ Bithumb cryptocurrency exchange hacked a third time in two years](https://www.zdnet.com/article/bithumb-cryptocurrency-exchange-hacked-a-third-time-in-two-years/) - Hackers believed to have made off with nearly $20 million in EOS and Ripple cryptocurrencies. At this point, Bithumb appears that they're not even trying anymore.

[ Chrome zero-day under active attacks](https://www.zdnet.com/article/google-reveals-chrome-zero-day-under-active-attacks/) - CVE-2019-5786, a bug in Chrome's FileReader API, was exploited in the wild to read content from a user's computer. Google said the bug was

[used together with a Windows 7 zero-day](https://www.zdnet.com/article/google-chrome-zero-day-was-used-together-with-a-windows-7-zero-day/)by a nation-state attacker.

[ New Intel CPU bug](https://www.zdnet.com/article/researchers-discover-and-abuse-new-undocumented-feature-in-intel-chipsets/) - Researchers find new Intel VISA (Visualization of Internal Signals Architecture) debugging technology.

[ Hacks at French gas stations](https://www.zdnet.com/article/french-gas-stations-robbed-after-forgetting-to-change-gas-pump-pins/)- Criminal group steals 120,000 litres of fuel from Total gas stations around Paris after gas stations forgot to change gas station pump PINs.

[ Citrix data breach](https://www.zdnet.com/article/citrix-discloses-security-breach-of-internal-network/) - Citrix learned of the hack from the FBI. Hackers stole business documents. A lot of Citrix customers' are government agencies and Fortune 500 companies.

**Smartphone unlocking issues** - We've had a few this year, but the first case was reported in March when a user found that Samsung Galaxy S10 facial recognition can be fooled by [a video of the phone owner](https://www.zdnet.com/article/samsung-galaxy-s10-facial-recognition-fooled-by-a-video-of-the-phone-owner/). A month later, a user found that he could unlock a Nokia 9 smartphone's fingerprint scanner[ with a pack of gum](https://www.zdnet.com/article/nokia-9-buggy-update-lets-anyone-bypass-fingerprint-scanner-with-a-pack-of-gum/). Then in October, users found that you could unlock a Pixel 4's facial unlock technology [while you had your eyes closed](https://www.zdnet.com/article/google-pixel-4s-face-unlock-works-even-if-you-have-your-eyes-closed/), and a couple found that they could [unlock Samsung S10 devices using fingerprint protection](https://www.zdnet.com/article/samsung-to-patch-s10-fingerprint-sensor-bug-next-week/) with any user's finger if the device was protected by a silicon case. In fact, the issue with bypassing facial recognition is quite widespread. A study by a Dutch non-profit last year found that attackers could bypass face unlock-type features [on 42 out of the 110 smartphones](https://www.zdnet.com/article/facial-recognition-doesnt-work-as-intended-on-42-of-110-tested-smartphones/) they tested.

### April

[ United Airlines covers up seat cameras](https://www.zdnet.com/article/united-airlines-covers-up-infotainment-seat-camera-following-passenger-outrage/) - The airline insists that the cameras have not been in active use; however, customers were still very disturbed and annoyed by the cameras' presence in the first place.

[ Researcher prints 'PWNED!' on hundreds of GPS watches' maps due to unfixed API](https://www.zdnet.com/article/researcher-prints-pwned-on-hundreds-of-gps-watches-maps-due-to-unfixed-api/) - Over 20 GPS watch models allowed threat actors to track device owners, tinker with watch functions.

[ Tens of thousands of cars were left exposed to thieves due to a hardcoded password](https://www.zdnet.com/article/tens-of-thousands-of-cars-left-exposed-to-thieves-due-to-a-hardcoded-password/) - Security updates that remove the hardcoded credentials have been made available for both the MyCar

[Android](https://play.google.com/store/apps/details?id=app.com.automobility.mycar.control)and

[iOS](https://itunes.apple.com/us/app/mycar-controls/id1126511815)apps since mid-February.

[ The Weather Channel goes off the air for 90 minutes after ransomware infection](https://www.zdnet.com/article/the-weather-channel-goes-off-the-air-for-90-minutes-after-ransomware-infection/) - A similar attack on

[French TV station M6](https://www.zdnet.com/article/m6-one-of-frances-biggest-tv-channels-hit-by-ransomware/), in October, was unsuccesful.

[ Facebook admits to storing plaintext passwords for millions of Instagram users](https://www.zdnet.com/article/facebook-admits-to-storing-plaintext-passwords-for-millions-of-instagram-users/) - Incident comes after a month earlier, Facebook admitted to

[storing plaintext passwords for Facebook accounts too](https://www.zdnet.com/article/facebook-we-stored-hundreds-of-millions-of-passwords-in-plain-text/).

[ Source code of Iranian cyber-espionage tools leaked on Telegram](https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/) - Tools were made available for every-day malware developers, opening more users to attacks. A second and third leak of Iranian hacking tools occurred in

[May](https://www.zdnet.com/article/new-leaks-of-iranian-cyber-espionage-operations-hit-telegram-and-the-dark-web/)and

[June](https://www.zdnet.com/article/new-iranian-hacking-tool-leaked-on-telegram/).

[ Indian govt agency left details of millions of pregnant women exposed online](https://www.zdnet.com/article/indian-govt-agency-left-details-of-millions-of-pregnant-women-exposed-online/) - More than 12.5 million medical records for pregnant women were left exposed. Records removed from leaky server after more than three weeks.

[ Over 13K iSCSI storage clusters left exposed online without a password](https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-online-without-a-password/) - New attack vector opens backdoor inside enterprise disk storage arrays and people's NAS devices.

[ Gnosticplayers' hacks](https://www.zdnet.com/article/a-hacker-has-dumped-nearly-one-billion-user-records-over-the-past-two-months/) - A hacker known as Gnosticplayers has dumped over one billion user records online in the span of a few months.

[ Hacker group has been hijacking DNS traffic on D-Link routers for three months](https://www.zdnet.com/article/hacker-group-has-been-hijacking-dns-traffic-on-d-link-routers-for-three-months/) - Other router models have also been targeted, such as ARG, DSLink, Secutech, and TOTOLINK. The attacks are

[especially active cross Brazil](https://www.zdnet.com/article/brazil-is-at-the-forefront-of-a-new-type-of-router-attack/).

### May

[ A hacker wiped Git repositories and asked for a ransom](https://www.zdnet.com/article/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/) - Thousands of repos were impacted, but almost all projects were recovered.

[ New MDS attacks on modern CPUs](https://www.zdnet.com/article/intel-cpus-impacted-by-new-zombieload-side-channel-attack/) - Researchers, academics detail new Microarchitectural Data Sampling (MDS) attacks, such as Zombieload, Fallout, and RIDL.

[ Thrangrycat vulnerability](https://www.zdnet.com/article/thrangrycat-flaw-lets-attackers-plant-persistent-backdoors-on-cisco-gear/) - Thrangrycat flaw lets attackers plant persistent backdoors on Cisco gear. Most Cisco gear is believed to be impacted. No attacks detected in the wild.

**BlueKeep vulnerability** - In mid-May, Microsoft warned about a [new "wormable" RDP vulnerability](https://www.zdnet.com/article/microsoft-patches-windows-xp-server-2003-to-try-to-head-off-wormable-flaw/) that later became known as BlueKeep. Two new wormable BlueKeep-like vulnerabilities ([DejaBlue](https://www.zdnet.com/article/microsoft-warns-of-two-new-wormable-flaws-in-windows-remote-desktop-services/)) were later disclosed in August. After months of eagerly waiting attacks, a [proof-of-concept exploit](https://www.zdnet.com/article/metasploit-team-releases-bluekeep-exploit/) was publicly published in September.

[ Unsecured server exposes data for 85% of all Panama citizens](https://www.zdnet.com/article/unsecured-server-exposes-data-for-85-percent-of-all-panama-citizens/) - The server contained patient data, but no medical records were exposed -- only personally identifiable information (PII).

[ Software update crashes police ankle monitors in the Netherlands](https://www.zdnet.com/article/software-update-crashes-police-ankle-monitors-in-the-netherlands/) - Borked update prevents ankle monitors from sending data back to police control rooms. Some suspects needed to be collected and sent back to jail as a result.

[ In a first, Israel responds to Hamas hackers with an air strike](https://www.zdnet.com/article/in-a-first-israel-responds-to-hamas-hackers-with-an-air-strike/) - Israel military said it bombed building housing Hamas cyber forces.

[ Google replaces faulty Titan security keys](https://www.zdnet.com/article/google-to-replace-faulty-titan-security-keys/) - Vulnerability in Bluetooth pairing protocol forces Google to replace Titan keys sold in the US. Microsoft was later forced to

[issue a special fix](https://www.zdnet.com/article/microsoft-blocks-ble-security-keys-with-known-pairing-vulnerability/)to address the issue.

[ Canva hack](https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/) - One of Gnosticplayers' victims. Company was hacked for 139 million user records.

[ StackOverflow hack](https://www.zdnet.com/article/stack-overflow-says-hackers-breached-production-systems/)- Stack Overflow said hackers breached production systems, and the hackers went undetected

[for more than a week](https://www.zdnet.com/article/stack-overflow-hacker-went-undetected-for-a-week/).

[ Flipboard hack](https://www.zdnet.com/article/flipboard-says-hackers-stole-user-details/) - Extent of the hack is unknown, but Flipboard said hackers had access to its systems for almost nine months.

[ London Underground to begin tracking passengers through Wi-Fi hotspots](https://www.zdnet.com/article/london-underground-to-begin-tracking-passengers-through-wi-fi-hotspots/) - Transport for London (TfL) said it was planning to roll out a system to track commuters making use of public Wi-Fi hotspots across the London Underground in coming months.

[ Major Safe Browsing bug](https://www.zdnet.com/article/mobile-chrome-safari-and-firefox-failed-to-show-phishing-warnings-for-more-than-a-year/) - Mobile Chrome, Safari, and Firefox failed to show phishing warnings for more than a year.

### June


[ Hackers breached 10 telecom providers](https://www.zdnet.com/article/these-hackers-broke-into-10-telecoms-companies-to-steal-customers-phone-records/) - Researchers at Cybereason said a nation-state-backed intelligence operation has compromised at least 10 global telco companies - to such an extent the attackers run a "de facto shadow IT department".

[ New Silex malware bricked thousands of IoT devices](https://www.zdnet.com/article/new-silex-malware-is-bricking-iot-devices-has-scary-plans/) - Attack lasted for days, but the hacker eventually stopped and retired the Silex malware code.

[ NASA hacked because of unauthorized Raspberry Pi connected to its network](https://www.zdnet.com/article/nasa-hacked-because-of-unauthorized-raspberry-pi-connected-to-its-network/) - NASA described the hackers as an "advanced persistent threat," a term generally used for nation-state hacking groups, but didn't provide other details.

[ Popular Facebook grief support page hacked](https://www.zdnet.com/article/popular-grief-support-page-hacked-ignored-by-facebook-for-weeks/) - Facebok ignored the hack for weeks.

[ Google Nest cams could have allowed former owners to spy on the new owners](https://www.zdnet.com/article/google-pushes-nest-cam-update-to-prevent-former-owners-spying-on-new-buyers/) - Google eventually pushed out an update.

**Two Firefox zero-days** - Mozilla fixed two Firefox zero-days [[1](https://www.zdnet.com/article/mozilla-fixes-second-firefox-zero-day-exploited-in-the-wild/), [2](https://www.zdnet.com/article/mozilla-fixes-second-firefox-zero-day-exploited-in-the-wild/)] that were used to attack Coinbase employees.

[ AMCA data breach](https://www.zdnet.com/article/amca-data-breach-has-now-gone-over-the-20-million-mark/) - Healthcare billing vendor got hacked last year and hackers put patient data for sale online. The breach impacted multiple healthcare providers, and eventually went over the 20 million mark.

[ CBP says hackers stole license plate and travelers' photos](https://www.zdnet.com/article/cbp-says-hackers-stole-license-plate-and-travelers-photos/) - CBP said subcontractor stored photos on its internal servers without authorization, and then got hacked.

[ Major HSM vulnerabilities impact banks, cloud providers, governments](https://www.zdnet.com/article/major-hsm-vulnerabilities-impact-banks-cloud-providers-governments/) - Two security researchers revealed vulnerabilities that can be exploited remotely to retrieve sensitive data stored inside special computer components known as HSMs (Hardware Security Modules).

[ Wave of SIM swapping attacks hit US cryptocurrency users](https://www.zdnet.com/article/wave-of-sim-swapping-attacks-hit-us-cryptocurrency-users/) - For a week in June, tens of US-based cryptocurrency users saw themselves victims of SIM swapping attacks.

### July

[ Kazakhstan government intercepted all local HTTPS traffic](https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/) - HTTPS interception efforts

[targeted Facebook, Google, Twitter](https://www.zdnet.com/article/kazakhstans-https-interception-efforts-target-facebook-google-twitter-others/), and others sites.

[Apple, Google, and Mozilla](https://www.zdnet.com/article/apple-google-and-mozilla-block-kazakhstans-https-intercepting-certificate/)eventually intervened and banned the certificate used for HTTPS MitM attacks.

[ Hacker steals data of millions of Bulgarians](https://www.zdnet.com/article/hacker-steals-data-of-millions-of-bulgarians-emails-it-to-local-media/) - A hacker stole the personal details of millions of Bulgarians and emailed download links to the stolen data to local news publications. The date, stolen from the country's National Revenue Agency,

[eventually leaked online](https://www.zdnet.com/article/bulgarias-hacked-database-is-now-available-on-hacking-forums/).

[ Hackers breach FSB contractor](https://www.zdnet.com/article/hackers-breach-fsb-contractor-expose-tor-deanonymization-project/) - Hackers have breached SyTech, a contractor for FSB, Russia's national intelligence service, from where they stole information about internal projects the company was working on behalf of the agency -- including one for deanonymizing Tor traffic.

[ iMessages could have bricked your iPhone](https://www.zdnet.com/article/google-project-zero-reveals-bad-imessages-could-have-bricked-your-iphone/) - Bug patched before being exploited in the wild.

[ Urgent/11 security flaws](https://www.zdnet.com/article/urgent11-security-flaws-impact-routers-printers-scada-and-many-iot-devices/)- Major bugs in TCP library impacted routers, printers, SCADA, medical devices, and many IoT devices.

[ Apple's AWDL protocol plagued by security flaws](https://www.zdnet.com/article/apples-awdl-protocol-plagued-by-flaws-that-enable-tracking-and-mitm-attacks/) - Apple patched a bug in May, but academics say the rest of the flaws require a redesign of some Apple services. Bugs would enable tracking and MitM attacks.

[ DHS warns about CAN bus vulnerabilities in small aircraft](https://www.zdnet.com/article/dhs-warns-about-can-bus-vulnerabilities-in-small-aircraft/) - DHS cyber-security agency CISA recommends that aircraft owners restrict access to planes "to the best of their abilities" to protect against vulnerabilities that could be used to sabotage airplanes.

[ Vulnerabilities found in GE anesthesia machines](https://www.zdnet.com/article/vulnerabilities-found-in-ge-anesthesia-machines/) - GE recommended that device owners not connect vulnerable anesthesia machines to a hospital's main networks. The company also denied the bugs could lead to patient harm, but later recanted and admitted that the issues could be dangerous to human life.

[ Los Angeles police caught up in data breach](https://www.zdnet.com/article/thousands-of-los-angeles-police-caught-up-in-data-breach-personal-records-stolen/) - Personal record of 2,500+ of LA cops stolen in the hack. The hacker emailed the department directly and included a sample of the allegedly stolen information to back up their claims.

[ Louisiana governor declares state emergency after local ransomware outbreak](https://www.zdnet.com/article/louisiana-governor-declares-state-emergency-after-local-ransomware-outbreak/) - Yep. Ransomware got so bad.

[It then hit Texas](https://www.zdnet.com/article/at-least-20-texas-local-governments-hit-in-coordinated-ransomware-attack/),

[dentist offices](https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/), and

[managed services providers](https://www.zdnet.com/article/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems/).

[ Bluetooth exploit can track and identify iOS, Microsoft mobile device users](https://www.zdnet.com/article/bluetooth-vulnerability-can-be-exploited-to-track-and-id-iphone-smartwatch-microsoft-tablet-users/) - The vulnerability can be used to spy on users despite native OS protections that are in place and impacts Bluetooth devices on Windows 10, iOS, and macOS machines. This includes iPhones, iPads, Apple Watch models, MacBooks, and Microsoft tablets & laptops.

[ 7-Eleven Japanese customers lose $500,000 due to mobile app flaw](https://www.zdnet.com/article/7-eleven-japanese-customers-lose-500000-due-to-mobile-app-flaw/) - 7-Eleven eventually shut down the app.

### August

[ SWAPGSAttack CPU flaw](https://www.zdnet.com/article/new-windows-hack-warning-patch-intel-systems-now-to-block-swapgsattack-exploits/) - Researchers detail hardware vulnerability that bypasses mitigations against Spectre and Meltdown CPU vulnerabilities on Windows systems - and impacts all systems using Intel processors manufactured since 2012.

[ New Dragonblood vulnerabilities](https://www.zdnet.com/article/new-dragonblood-vulnerabilities-found-in-wifi-wpa3-standard/) - Earlier this year in April, two security researchers disclosed details about five vulnerabilities (

[collectively known as Dragonblood](https://www.zdnet.com/article/dragonblood-vulnerabilities-disclosed-in-wifi-wpa3-standard/)) in the WiFi Alliance's recently launched WPA3 WiFi security and authentication standard.

[ 14 iOS zero-days](https://www.zdnet.com/article/google-finds-malicious-sites-pushing-ios-exploits-for-years/) - Google finds exploits for 14 iOS vulnerabilities, grouped in five exploit chains, deployed in the wild since September 2016. Attacks aimed at Chinese Uyghur users.

[ The VPN security flaws](https://www.zdnet.com/article/hackers-mount-attacks-on-webmin-servers-pulse-secure-and-fortinet-vpns/) - Hackers mount attacks on Pulse Secure and Fortinet VPNs --

[including nation-state actors](https://www.zdnet.com/article/a-chinese-apt-is-now-going-after-pulse-secure-and-fortinet-vpn-servers/).

[ Windows CTF flaw](https://www.zdnet.com/article/vulnerability-in-microsoft-ctf-protocol-goes-back-to-windows-xp/) - Vulnerability in Microsoft CTF protocol goes back to Windows XP. Bug allows hackers to hijack any Windows app, escape sandboxes, get admin rights.

[ WS-Discovery protocol abused for DDoS attacks](https://www.zdnet.com/article/protocol-used-by-630000-devices-can-be-abused-for-devastating-ddos-attacks/) - Protocol adopted by DDoS-for-hire services, used in real-world attacks already.

[ Capitol One hack](https://www.zdnet.com/article/100-million-americans-and-6-million-canadians-caught-up-in-capital-one-breach/) - A hacker breached Capitol One, from where she stole the records of 100 million users. She also

[hacked 30 other companies](https://www.zdnet.com/article/capital-one-hacker-took-data-from-more-than-30-companies-new-court-docs-reveal/).

[ Hy-Vee card breach](https://www.zdnet.com/article/hy-vee-issues-warning-to-customers-after-discovering-point-of-sale-breach/) - Supermarket chain Hy-Vee admitted to a security breach on some of its point-of-sale (PoS) systems. The data was eventually put up for sale on hacking forums.

[ Employees connect nuclear plant to the internet so they can mine cryptocurrency](https://www.zdnet.com/article/employees-connect-nuclear-plant-to-the-internet-so-they-can-mine-cryptocurrency/) - Employees at a Ukrainian nuclear plant take unncessary security risks just to mine Bitcoin. They were eventually arrested.

[ Moscow's blockchain voting system cracked a month before election](https://www.zdnet.com/article/moscows-blockchain-voting-system-cracked-a-month-before-election/) - French researcher nets $15,000 prize for finding bugs in Moscow's Ethereum-based voting system.

[ US military purchased $32.8m worth of electronics with known security risks](https://www.zdnet.com/article/us-military-purchased-32-8m-worth-of-electronics-with-known-security-risks/) - List of vulnerable products purchased by the DoD includes Lexmark printers, GoPro cameras, and Lenovo computers.

[ AT&T employees took bribes to plant malware on the company's network](https://www.zdnet.com/article/at-t-employees-took-bribes-to-plant-malware-on-the-companys-network/) - DOJ charges Pakistani man with bribing AT&T employees more than $1 million to install malware on the company's network, unlock more than 2 million devices.

[ Windows malware strain records users on adult sites](https://www.zdnet.com/article/windows-malware-strain-records-users-on-adult-sites/) - New Varenyky trojan records videos of users navigating adult sites. Currently targeting only French users.

[ TrickBot trojan gets capability to aid SIM swapping attacks](https://www.zdnet.com/article/trickbot-todays-top-trojan-adds-feature-to-aid-sim-swapping-attacks/) - TrickBot trojan seen collecting credentials and PIN codes for Sprint, T-Mobile, and Verizon Wireless accounts.

[ Warshipping technique](https://www.zdnet.com/article/new-warshipping-technique-gives-hackers-access-to-enterprise-offices/) - Hackers could use packet delivery services to ship hacking devices right to your company's doorstep.

[ Instagram boots ad partner Hyp3r](https://www.zdnet.com/article/instagram-boots-ad-partner-hyp3r-for-mass-collection-of-user-data/) - Instagram catches ad partner collecting data on its users.

### September


[ Simjacker attack](https://www.zdnet.com/article/new-simjacker-attack-exploited-in-the-wild-to-track-users-for-at-least-two-years/) - Security researchers detailed an SMS-based attack that can allow malicious actors to track users' devices by abusing little-known apps that are running on SIM cards.

[SIM cards in 29 countries](https://www.zdnet.com/article/these-are-the-29-countries-vulnerable-to-simjacker-attacks/)were found to be impacted. A second attack named

[WIBAttack](https://www.zdnet.com/article/new-sim-card-attack-disclosed-similar-to-simjacker/)was also discovered.

[ Smart TV spying](https://www.zdnet.com/article/smart-tvs-send-user-data-to-tech-heavyweights-including-facebook-google-netflix/) - Two academic papers found that smart TVs were collecting data on users' TV-viewing habits.

[ Checkm8 iOS jailbreak](https://www.zdnet.com/article/new-checkm8-jailbreak-released-for-all-ios-devices-running-a5-to-a11-chips/) - New Checkm8 jailbreak released for all iOS devices running A5 to A11 chips, on iPhones 4S up to iPhone 8 and X. The first jailbreak exploit to work on the hardware level in the past nine years.

[ Database leaks data on most of Ecuador's citizens](https://www.zdnet.com/article/database-leaks-data-on-most-of-ecuadors-citizens-including-6-7-million-children/) - Elasticsearch server leaks personal data on Ecuador's citizens, their family trees, and children, but also some users' financial records and car registration information.

[An arrest followed](https://www.zdnet.com/article/arrest-made-in-ecuadors-massive-data-breach/).

[ Limin PDF breach](https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/) - The details of over 24.3 million Lumin PDF users were shared on a hacking forum in mid-September. The company acknowledged the breach a day later.

[ Heyyo dating app leak](https://www.zdnet.com/article/heyyo-dating-app-leaked-users-personal-data-photos-location-data-more/) - They leaked almost everything except private messages.

[ vBulletin zero-day and subsequent hacks](https://www.zdnet.com/article/anonymous-researcher-drops-vbulletin-zero-day-impacting-tens-of-thousands-of-sites/) - An anonymous security researcher released a zero-day in the vBulletin forum software. The vulnerability was immediately used to hack a bunch of forums.

[ Massive wave of account hijacks hits YouTube creators](https://www.zdnet.com/article/massive-wave-of-account-hijacks-hits-youtube-creators/) - YouTube creators from the auto and car community were hit with spear-phishing attacks that could bypass 2FA, allowing hackers to take over Google and YouTube accounts.

[ Lilocked (Lilu) ransomware](https://www.zdnet.com/article/thousands-of-servers-infected-with-new-lilocked-lilu-ransomware/) - Thousands of Linux servers were infected with the new Lilocked (Lilu) ransomware.

[ Over 47,000 Supermicro servers are exposing BMC ports on the internet](https://www.zdnet.com/article/over-47000-supermicro-servers-are-exposing-bmc-ports-on-the-internet/) - Researchers discovered a new remote attack vector on Supermicro servers that were found to be exposing their BMC port over the internet.

[ Ransomware incident to cost company a whopping $95 million](https://www.zdnet.com/article/ransomware-incident-to-cost-danish-company-a-whopping-95-million/) - A ransomware incident at Demant, a Danish company that makes hearing aids, has created losses of nearly $95 million, one of the most expensive incidents to date.

[ Exim vulnerability (CVE-2019-15846)](https://www.zdnet.com/article/millions-of-exim-servers-vulnerable-to-root-granting-exploit/) - Millions of Exim servers are vulnerable to a security bug that when exploited can grant attackers the ability to run malicious code with root privileges.

### October

[ Avast hack](https://www.zdnet.com/article/avast-says-hackers-breached-internal-network-through-compromised-vpn-profile/) - Czech antivirus maker discloses second attack aimed at compromising CCleaner releases, after the one suffered in 2017. Company said hacker compromised the company via a compromised VPN profile.

[ Android zero-day exploited in the wild](https://www.zdnet.com/article/google-finds-android-zero-day-impacting-pixel-samsung-huawei-xiaomi-devices/) - Google Project Zero researchers find Android zero-day exploited in the wild, impacting Pixel, Samsung, Huawei, Xiaomi devices.

[ Alexa and Google Home devices leveraged to phish and eavesdrop on users, again](https://www.zdnet.com/article/alexa-and-google-home-devices-leveraged-to-phish-and-eavesdrop-on-users-again/) - Amazon, Google fail to address security loopholes in Alexa and Home devices more than a year after first reports.

[ Czech authorities dismantle alleged Russian cyber-espionage network](https://www.zdnet.com/article/czech-authorities-dismantle-alleged-russian-cyber-espionage-network/) - Czech officials said Russian operatives used local companies to launch cyber-attacks against foreign targets. Officials said operates had support from the FSB and financial help from the local embassy.

[ Johannesburg held for ransom by hacker gang](https://www.zdnet.com/article/city-of-johannesburg-held-for-ransom-by-hacker-gang/) - A group named "Shadow Kill Hackers" is asking local officials for 4 bitcoins or they'll release city data online. Second major attack against Johannesburg after they've been hit by ransomware in July, when some locals were

[left without electricity](https://www.zdnet.com/article/ransomware-incident-leaves-some-johannesburg-residents-without-electricity/).

[ CPDoS attack](https://www.zdnet.com/article/cpdos-attack-can-poison-cdns-to-deliver-error-pages-instead-of-legitimate-sites/) - CloudFront, Cloudflare, Fastly, Akamai, and others impacted by new CPDoS web cache poisoning attack.

[ PHP7 RCE exploited in the wild](https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild/) - New PHP7 bug CVE-2019-11043 can allow even non-technical attackers to take over Nginx servers running the PHP-FPM module.

[ macOS systems abused in DDoS attacks](https://www.zdnet.com/article/macos-systems-abused-in-ddos-attacks/) - Up to 40,000 macOS systems expose a particular port online that can be abused for pretty big DDoS attacks.

[Editorial standards](/editorial-guidelines/)