Security news weekly round-up - 27th August 2021
Tags: security
Published: 2021-08-27 14:34:18

---
title: Security news weekly round-up - 27th August 2021
published: true
description: Curated links about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/0jupjut8w3h9mjwm8m57.jpg
series: Security news weekly round-up
---

> **With the publication of this week's review, we've matched our previous record of 14 weeks of constant publishing.**

> **In addition, you'll find a Buy Me a Coffee link at the end of this article where you can support my work.**

## __Introduction__

Welcome to Edition 51 of this series of articles. I am your host, [Habdul Hazeez](https://dev.to/ziizium).

This week's review is packed with stories about vulnerabilities, malware, exploit, and cyber-attack.

Let's dive in.

<hr />

## __[Cloudflare mitigated one of the largest DDoS attack involving 17.2 million rps](https://thehackernews.com/2021/08/cloudflare-mitigated-one-of-largest.html)__

Remember [Mirai](https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/) or [Anna Senpai](https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/)? Well, they are back in the news for not-so-good reasons because the Mirai botnet was used to carry out the attack detailed in this story.

Excerpt from the article:

> Within seconds, the botnet bombarded the Cloudflare edge with over 330 million attack requests," the company noted, at one point reaching a record high of 17.2 million requests-per-second (rps), making it three times bigger than previously reported HTTP DDoS attacks

## __[Modified Version of WhatsApp for Android Spotted Installing Triada Trojan](https://thehackernews.com/2021/08/modified-version-of-whatsapp-for.html)__

It's best to stick with the original version of WhatsApp downloaded from official app stores. It's safe, unless, WhatsApp suffers a massive [supply chain attack](https://www.wired.com/story/hacker-lexicon-what-is-a-supply-chain-attack/), in that case, billions of devices will be compromised.

Excerpt from the article:

> The tampered variant of the app detected by Kaspersky comes equipped with capabilities to gather unique device identifiers, which are sent to a remote server that responds back with a link to a payload that's subsequently downloaded, decrypted, and launched by the Triada trojan

## __[Bahraini Activists Targeted Using a New iPhone Zero-Day Exploit From NSO Group](https://thehackernews.com/2021/08/bahraini-activists-targeted-using-new.html)__

Any system termed or deemed as "secure" comes under constant attack, just so attackers can confirm if it's truly secure. An example of such a system is Apple's iPhone.

Excerpt from the article:

> Citizen Lab called the new exploit chain "FORCEDENTRY." It's also a zero-click exploit, meaning that it can be used to trigger an infection simply by sending a malicious message to the target, even without having to click a link or view the message in question

## __[38 Million Records Exposed from Microsoft Power Apps of Dozens of Organisations](https://thehackernews.com/2021/08/38-million-records-exposed-from.html)__

No system is safe.

Excerpt from the article:

> The types of data varied between portals, including personal information used for COVID-19 contact tracing, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses

## __[OpenSSL Vulnerability Can Be Exploited to Change Application Data](https://www.securityweek.com/openssl-vulnerability-can-be-exploited-change-application-data)__

When I read that title, I only taught of one thing; Not good.

Excerpt from the article:

> Think of any kind of data that an application might hold in memory (e.g. financials, credentials, etc), and then think what might happen if an attacker could change it

## __["Sophisticated" Cyber-Attack Compromises Patient Data at Private Health Clinic](https://www.infosecurity-magazine.com/news/cyber-attack-compromises-patient/)__

The title says it all.

Excerpt from the article:

> In a press release, Eye & Retina Surgeons revealed the attack took place on 6 August, compromising sensitive data including patients' names, addresses, ID card numbers, contact details and clinical information. However, no credit card or bank account details were accessed or compromised in the incident

## __[Vulnerabilities Allow Hackers to Tamper With Doses Delivered by Medical Infusion Pumps](https://www.securityweek.com/vulnerabilities-allow-hackers-tamper-doses-delivered-medical-infusion-pumps)__

This is scary.

Excerpt from the article:

> These critical vulnerabilities could allow an attacker to conduct remote network attacks and modify the amount of medication a patient will receive through infusion. This modification could appear as a device malfunction and be noticed only after a substantial amount of drug has been dispensed to a patient

## __Support me__

Now, you can support what I do by buying me a coffee. It'll mean a lot to me.

<a href="https://www.buymeacoffee.com/ziizium" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>

## __Credits__

Cover photo by [Debby Hudson on Unsplash](https://unsplash.com/@hudsoncrafted).

<hr>

That's it for this week, I'll see you next Friday.