WeWork Exposure, Django Injection, Google Zero-Day Patch, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 05 July, 2022
Episode 258 - 05 July 2022
WeWork Exposure- https://techcrunch.com/2022/07/04/wework-exposed-visitors-data/
Django Injection -
https://www.bleepingcomputer.com/news/security/django-fixes-sql-injection-vulnerability-in-new-releases/
AstraLocker Expires -
https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-and-releases-decryptors/
Google to Delete Sensitive Tracking- https://www.infosecurity-magazine.com/news/british-army-social-media-accounts/
Google Zero-Day Patch -
https://threatpost.com/actively-exploited-chrome-bug/180118/
Hi, I’m Paul Torgersen. It’s Tuesday July 5th 2022, and this is a look at the information security news from overnight.
From TechCrunch.com
WeWork India had a security lapse that exposed the personal information and selfies of tens of thousands of people who used the WeWork coworking spaces in the country. The bug made it possible to access the check-in record of any visitor by manually typing in a check-in ID, with no safeguards against accessing the data in bulk. The company is fixing the issue.
From BleepingComputer.com:
Django, an open source Python-based web framework, has patched a high-severity SQL injection vulnerability. The flaw affects Django's main branch, and versions 4.1 (currently in beta), 4.0, and 3.2. Developers are urged to upgrade to Django versions 4.0.6 and 3.2.14 as soon as possible.
Also from BleepingComputer.com:
The threat actor behind the AstraLocker ransomware says they're shutting down the operation and plan to switch to cryptojacking. The ransomware's developer even submitted a ZIP archive with the AstraLocker decryptors to VirusTotal. The decryptors appear to be legit and worked on the one sample the team at BleepingComputer tried out. Details and a link to that zip file in the article.
From ZDNet.com
Google says it will automatically wipe user location history for visits to healthcare clinics, including abortion and fertility clinics, domestic abuse shelters, and other sensitive areas. The fear is that, in a post-Roe world, this location tracking data could be used in persecutions, excuse me, prosecutions. These changes will be rolling out in the coming weeks.
And last today, from ThreatPost.com
Google quietly rolled out a stable channel update for Chrome to patch an actively exploited zero-day vulnerability. This is the fourth such flaw the vendor has had to patch so far this year. The bug is a buffer overflow that was just reported on July 1. The company also tidied up a few other bugs while it was at it.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.