Critical Bluetooth Flaw Opens Millions of Devices to Eavesdropping

A newly disclosed vulnerability, tracked as CVE-2019-9506, was found in the Bluetooth Core Specification. Attackers within radio range can exploit this flaw to intercept and manipulate Bluetooth communications between two vulnerable paired devices. The vulnerability affects a wide range of hardware, making patching at the firmware and OS level essential for any organisation managing a fleet of Bluetooth-enabled endpoints.

Nmap 7.80 Released: Mature Npcap Driver and 11 New NSE Scripts

Nmap 7.80 arrived with a production-ready Npcap Windows packet-capturing driver and eleven new Nmap Scripting Engine (NSE) scripts. Nmap remains the de facto open-source tool for network discovery and security auditing, widely used by systems and network administrators for tasks including:

• Network inventory and host discovery
• Service version detection and OS fingerprinting
• Managing service upgrade schedules
• Monitoring host and service uptime
• Vulnerability detection via NSE scripts

The matured Npcap driver is particularly significant for Windows-based security teams who previously encountered stability issues with raw packet capture on that platform.

Kubernetes Security Matures: Inside the Project’s First Audit

The Kubernetes Project, backed by resources from the Cloud Native Computing Foundation (CNCF), completed its first formal security audit — a significant milestone for one of the most widely deployed container orchestration platforms in the world. Key details of the effort:

• Auditors reviewed approximately 1.5 million lines of code.
• A dedicated Security Audit Working Group was formed to conduct the review in an open, transparent, and repeatable manner.
• Contributors came from Google, Red Hat, Salesforce, and security firm InGuardians, with input from the broader security community.
• The audit was designed to establish a framework for future Kubernetes security reviews and ongoing research.

For DevOps and platform engineering teams running Kubernetes in production, the audit’s published findings provide actionable guidance on hardening cluster configurations, RBAC policies, and network boundaries.

Lateral Phishing: Researchers Reveal the Latest Tactics

Researchers from Barracuda, UC Berkeley, and UC San Diego published findings from a study of 180 lateral phishing incidents. Unlike traditional phishing, lateral phishing uses a compromised internal account to send malicious emails to colleagues, partners, or other contacts — lending the attack instant credibility through a trusted sender identity.

Key patterns organisations should watch for include:

• Emails sent from a legitimate internal mailbox shortly after an account compromise
• Targeting of close colleagues or frequent email contacts of the victim account
• Use of generic lures (shared document links, password reset prompts) that bypass user suspicion
• Rapid lateral spread before the initial compromise is detected or remediated

Mitigations include anomalous email-sending behaviour detection, mandatory MFA, and user awareness training that specifically addresses internal sender threats.

August 2019 Patch Tuesday: Microsoft Patches Critical Wormable RDP Vulnerabilities

Microsoft’s August 2019 Patch Tuesday addressed critical wormable vulnerabilities in Remote Desktop Protocol (RDP). These flaws, reminiscent of the conditions that enabled the WannaCry outbreak via EternalBlue, could allow unauthenticated remote code execution without user interaction. Adobe and Intel also released fixes for security issues in their respective software on the same day. Patch management teams should have treated these as emergency deployments given the wormable nature of the RDP findings.

Container Escapes: A Compendium

In a podcast recorded at Black Hat USA 2019, Brandon Edwards, Chief Scientist at Capsule8, walked through a taxonomy of container escape techniques, with particular attention to the runC vulnerability. Container escapes remain a top concern for DevSecOps teams, as a successful escape can give an attacker access to the underlying host and every other workload running on it. Key categories of escape vectors include:

• Runtime vulnerabilities (e.g., runC CVE-2019-5736)
• Kernel exploits leveraging shared kernel namespaces
• Misconfigured privileged containers
• Exposed Docker socket mounts

40+ Insecure Windows Drivers Discovered by Eclypsium

Researchers at Eclypsium probed a broad range of Windows device drivers and uncovered more than 40 that contained security vulnerabilities. The research was motivated by previous real-world cases in which attackers abused device drivers to install kernel rootkits or malicious firmware implants. Because drivers operate at the kernel level, vulnerabilities in them can be extremely difficult to detect and remediate, underscoring the importance of driver signing policies and regular firmware audits in enterprise environments.

Massive Biometric Database Exposed: Fingerprints and Facial Recognition Data Leaked

Researchers Noam Rotem and Ran Locar from vpnMentor discovered a publicly accessible database during a web-mapping project that contained:

• Fingerprint records for over 1 million users
• Facial recognition data
• Unencrypted personal information

The exposure highlights the unique risk posed by biometric data: unlike passwords, biometric identifiers cannot be changed once compromised. Organisations collecting and storing biometric data must apply encryption at rest, strict access controls, and regular exposure scanning as table-stakes controls.

DDoS Attacks Shift Toward Degraded Performance Rather Than Total Takedown

Research from Neustar’s Security Operations Centre highlighted a trend toward smaller, more sustained DDoS attacks designed to degrade service performance without triggering volumetric DDoS defences. This approach is more operationally damaging in some respects — slow or intermittent service disruptions erode user trust and are harder to attribute definitively to an attack. Security teams should review their DDoS detection thresholds and ensure they capture application-layer and low-volume floods, not just large volumetric events.

Privileged Identity Theft: A Common Thread in Major Breaches

Analysis of major data breaches across the 21st century points to a recurring pattern: attackers obtain the credentials of privileged accounts — administrative, service, or operational accounts — and use that access to exfiltrate data at scale. Defences against privileged identity abuse include:

• Privileged Access Management (PAM) solutions with session recording
• Just-in-time and just-enough-access privilege models
• Multi-factor authentication on all privileged accounts
• Continuous behavioural monitoring for anomalous privileged activity

API Security: A Growing and Often Overlooked Attack Surface

APIs have quietly become the primary interface between modern application components, third-party integrations, and mobile front-ends. This growing centrality makes them a high-value target. Organisations should ensure they have a comprehensive API inventory, apply authentication and rate limiting consistently, and monitor API traffic for anomalous access patterns — not just perimeter-level threats.

Third- and Fourth-Party Risk Management

While vendor risk management programmes have matured, most organisations focus exclusively on direct third-party relationships. Fourth-party risk — the risk posed by your vendors’ vendors — remains a significant blind spot. Supply chain attacks demonstrate that compromise can propagate through layers of trust relationships that no single organisation fully controls. Effective risk programmes need contractual flow-down requirements, periodic fourth-party assessments, and continuous monitoring of critical supply chain components.

Optimising Patch Management: Black Hat 2019 Insights

In a podcast recorded at Black Hat USA 2019, Jimmy Graham, Senior Director of Product Management at Qualys, discussed why a one-size-fits-all patch management process fails most organisations. Effective patch management requires risk-based prioritisation — accounting for asset criticality, exploitability, and exposure — rather than simply chasing a 100% patch rate across all systems simultaneously.

MANRS Observatory: A New Tool for Internet Routing Security

The Mutually Agreed Norms for Routing Security (MANRS) initiative launched the MANRS Observatory, an online tool that measures network compliance with MANRS standards. Routing security — particularly BGP hijacking and route leak prevention — is an infrastructure-level concern relevant to any organisation that peers directly with the internet or relies on transit providers. The observatory provides visibility into the routing security posture of networks globally.

Closing the Cyber Skills Gap

The cybersecurity industry faces a well-documented global shortage of qualified practitioners. Closing the gap requires coordinated action across organisations, government, academia, and professional associations to develop sustainable training pipelines and career pathways — not simply reactive hiring. Skills development programmes that combine formal certification paths with hands-on lab environments and mentorship have shown the most promise for producing job-ready practitioners.

AI in Cybersecurity: Offensive and Defensive Applications

Machine learning and AI are increasingly deployed on both sides of the cybersecurity equation. Defenders use AI for anomaly detection, threat hunting, and automated response. Attackers are beginning to use AI to craft more convincing phishing lures, identify vulnerabilities at scale, and evade signature-based detection. The asymmetry of this arms race — where offensive AI tools can be developed and deployed faster than defensive ones can be trained and validated — remains an active area of research and concern.

(ISC)² Updates CCSP Certification Exam

(ISC)² announced the first update to the Certified Cloud Security Professional (CCSP) exam since its launch in 2015, reflecting the rapid evolution of cloud security practices, shared responsibility models, and regulatory requirements over the intervening four years. Candidates preparing for the exam should ensure they are studying from updated materials aligned to the revised exam outline.

Source: Help Net Security. Original roundup published August 19, 2019.