Security news weekly round-up - 1st October 2021
Tags: security
Published: 2021-10-01 11:51:59

---
title: Security news weekly round-up - 1st October 2021
published: true
description: Curated links about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/0jupjut8w3h9mjwm8m57.jpg
series: Security news weekly round-up
---

## __Introduction__

Hello, welcome to this week's review. As usual, I am [Habdul Hazeez](https://dev.to/ziizium).

A _malware_ which can steal your money is not something you'll want to hear and neither is a software bug in your favorite device. Quite frankly, these among others is what this week's review is all about.

Grab a cup of coffee, and let's dissect the stories together.

<hr />

## __[Apple's New iCloud Private Relay Service Leaks Users' Real IP Addresses](https://thehackernews.com/2021/09/apples-new-icloud-private-relay-service.html)__

This is somehow analogous to using a VPN which ends revealing your IP address to the visited website or application. You might not even know this until you use a website that reveals your IP address.

Excerpt from the article:

> A new as-yet unpatched weakness in Apple's iCloud Private Relay feature could be circumvented to leak users' true IP addresses from iOS devices running the latest version of the operating system

## __[Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows](https://thehackernews.com/2021/09/google-warns-of-new-way-hackers-can.html)__

A big Hat Tip to one of the smartest creatures on Earth &mdash; Humans.

We are always crafty, to say the least.

Excerpt from the article:

> Cybersecurity researchers have disclosed a novel technique adopted by a threat actor to deliberately evade detection with the help of malformed digital signatures of its malware payloads

## __[Frustrated Researcher Discloses Three Unpatched iOS Vulnerabilities](https://www.securityweek.com/frustrated-researcher-discloses-three-unpatched-ios-vulnerabilities)__

Take a deep breath, exhale, how do you feel? Calm? That's nice, and please be patient.

Excerpt from the article:

> "When I confronted [Apple], they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time,” the researcher said

## __[New BloodyStealer Trojan Steals Gamers' Epic Games and Steam Accounts](https://thehackernews.com/2021/09/new-bloodystealer-trojan-steals-gamers.html)__

Due to the high-profile nature of the applications targeted by this malware, the name _BloddyStealer_ is no exaggeration.

Excerpt from the article:

> BloodyStealer is a Trojan-stealer capable of gathering and exfiltrating various types of data, for cookies, passwords, forms, banking cards from browsers, screenshots, log-in memory, and sessions from various applications

> The information harvested from gaming apps, such as **Bethesda**, **Epic Games**, **GOG**, **Origin**, **Steam**, and **VimeWorld**, is exfiltrated to a remote server, from where it's likely to be monetized on darknet platforms

## __[Beware! This Android Trojan Stole Millions of Dollars from Over 10 Million Users](https://thehackernews.com/2021/09/beware-this-android-trojan-stole.html)__

Nothing is scarier than losing your hard-earned money to malicious code.

Excerpt from the article:

> Zimperium zLabs dubbed the malicious trojan "GriftHorse." The money-making scheme is believed to have been under active development starting from November 2020, with victims reported across Australia, Brazil, Canada, China, France, Germany, India, Russia, Saudi Arabia, Spain, the U.K., and the U.S

## __[Hackers could force locked iPhones to make contactless payments](https://www.welivesecurity.com/2021/09/30/hackers-could-force-locked-iphones-contactless-payments/)__

When it's locked, that does not mean it's safe and secure.

Excerpt from the article:

> The attack, classified as a Man-in-the-Middle (MitM) replay and relay attack, requires the iPhone to have a Visa Card set up for payment with the “Express Travel” mode turned on, and the victim to be in close vicinity to the attacker

## __[Apple forgot to sanitize the Phone Number field for lost AirTags](https://arstechnica.com/information-technology/2021/09/apple-airtags-can-be-abused-to-direct-finders-to-malicious-websites/)__

At first, when I read this article's title, I thought of one thing only: XSS.

Then I read the article, and it turns out to be XSS because it's the major bug you can think of when you somehow fail to sanitize inputs from your users in an application.

Excerpt from the article:

> This kind of attack doesn't need much technological know-how—the attacker simply types valid XSS into the AirTag's phone number field, then puts the AirTag in Lost mode and drops it somewhere the target is likely to find it

## __Support Me__

Writing makes me thirsty. I'll appreciate a cup of coffee 😉.

<a href="https://www.buymeacoffee.com/ziizium" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>

## __Credits__

Cover photo by [Debby Hudson on Unsplash](https://unsplash.com/@hudsoncrafted).

<hr>

That's it for this week, I'll see you next Friday.