Security news weekly round-up - 10th September 2021
Tags: security
Published: 2021-09-10 21:00:20

---
title: Security news weekly round-up - 10th September 2021
published: true
description: Curated links about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/0jupjut8w3h9mjwm8m57.jpg
series: Security news weekly round-up
---

## __Introduction__

Welcome to this week's edition of Security news weekly round-up. As usual, I am your host [Habdul Hazeez](https://dev.to/ziizium).

This week's review is about privacy and malware.

Let's begin.

## __[Breach Exposed Dallas Student, Parent, Teacher Personal Data](https://www.securityweek.com/breach-exposed-dallas-student-parent-teacher-personal-data)__

Data breaches could happen to anyone or any company. It's how you handle the response that matters.

Excerpt from the article:

> According to the website statements, an unauthorized third party downloaded the data and stored it temporarily on an encrypted cloud storage site. Social Security numbers, birth dates, contact information and grades were among the data exposed

## __[Traffic Exchange Networks Distributing Malware Disguised as Cracked Software](https://thehackernews.com/2021/09/traffic-exchange-networks-distributing.html)__

Beware of cracked software.

Excerpt from the article:

> The attacks work by taking advantage of a number of bait pages hosted on WordPress that contain "download" links to software packages, which, when clicked, redirect the victims to a different website that delivers potentially unwanted browser plug-ins and malware that masquerade as antivirus solutions

## __[ProtonMail Logs Activist's IP Address With Authorities After Swiss Court Order](https://thehackernews.com/2021/09/protonmail-shares-activists-ip-address.html)__

You ain't anonymous if the "Law" wants you.

Excerpt from the article:

> Despite its no IP logs claims, the company acknowledged that while it's illegal for the company to abide by requests from non-Swiss law enforcement authorities, it will be required to do so if Swiss agencies agree to assist foreign services such as Europol in their investigations

## __[ProtonMail removed “we do not keep any IP logs” from its privacy policy](https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/)__

Still on ProtonMail with some twist.

Excerpt from the article:

> After providing the activist's metadata to Swiss authorities, ProtonMail removed the section that had promised no IP logs, replacing it with one saying, "ProtonMail is email that respects privacy and puts people (not advertisers) first"

## __[New 0-Day Attack Targeting Windows Users With Microsoft Office Documents](https://thehackernews.com/2021/09/new-0-day-attack-targeting-windows.html)__

It's a Remote Code Execution flaw and it's pretty scary.

Excerpt from the article:

> Tracked as CVE-2021-40444 (CVSS score: 8.8), the remote code execution flaw is rooted in MSHTML (aka Trident), a proprietary browser engine for the now-discontinued Internet Explorer and which is used in Office to render web content inside Word, Excel, and PowerPoint documents

## __[WhatsApp “end-to-end encrypted” messages aren’t that private after all](https://arstechnica.com/gadgets/2021/09/whatsapp-end-to-end-encrypted-messages-arent-that-private-after-all/)__

I know what you are thinking: You got to be kidding me 😅.

Excerpt from the article:

> The loophole in WhatsApp's end-to-end encryption is simple: The recipient of any WhatsApp message can flag it. Once flagged, the message is copied on the recipient's device and sent as a separate message to Facebook for review

## __[SOVA: New Android Banking Trojan Emerges With Growing Capabilities](https://thehackernews.com/2021/09/sova-new-android-banking-trojan-emerges.html)__

Keep on the lookout.

Excerpt from the article:

> Dubbed S.O.V.A. (referring to the Russian word for owl), the current version of the banking malware comes with myriad features to steal credentials and session cookies through web overlay attacks, log keystrokes, hide notifications, and manipulate the clipboard to insert modified cryptocurrency wallet addresses


## __Support me__

Writing makes me thirsty. I'll appreciate a cup of coffee 😉.

<a href="https://www.buymeacoffee.com/ziizium" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>

## __Credits__

Cover photo by [Debby Hudson on Unsplash](https://unsplash.com/@hudsoncrafted).

<hr>

That's it for this week, I'll see you next Friday.