Security news weekly round-up - 12th June 2020
Tags: security
Published: 2020-06-12 13:53:46

---
title: Security news weekly round-up - 12th June 2020
published: true
description: A curated link about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/pyy42pwiihy23jhw2v7f.jpg
series: Security news weekly round-up
---

> __Cover photo by [Jazmin Quaynor](https://unsplash.com/@jazminantoinette) on [Unsplash](https://unsplash.com/).__

##__Introduction__

Welcome to the weekly round-up of security news from around the Web. I _hope your week was fine_.

This week it's all about _privacy issues_, _hacking_, _bugs_ and _vulnerabilities_.

<hr>

###__[Google's indexing of WhatsApp numbers raises privacy concerns](https://www.bleepingcomputer.com/news/security/googles-indexing-of-whatsapp-numbers-raises-privacy-concerns/)__

_WhatsApp_, at the time of writing is the most popular instant messaging application and _Google_, the biggest search engine.

Google spiders _crawl_ and _index_ Web pages publicly available, unless the Webmaster says otherwise.

Some information available via Google search results can sometimes be personal information like the title of the articles states.

Excerpt from the article:

> Google is indexing the phone numbers used on WhatsApp, and a researcher is concerned that it could cause privacy issues or be used for malicious purposes.

###__[FBI warns of increased hacking risk if using mobile banking apps](https://www.bleepingcomputer.com/news/security/fbi-warns-of-increased-hacking-risk-if-using-mobile-banking-apps/)__

The title says it all. 

Excerpt from the article:

> The U.S. Federal Bureau of Investigation (FBI) today warned mobile banking app users that they will be increasingly targeted by hackers trying to steal their credentials and take over their banking accounts.

###__[A Bug in Facebook Messenger for Windows Could've Helped Malware Gain Persistence](https://thehackernews.com/2020/06/facebook-malware-persistence.html)__

At the time of writing _Facebook_ has billions of users, therefore, this is not good news.

Excerpt from the article:

>  The vulnerability, which resides in Messenger version 460.16, could allow attackers to leverage the app to potentially execute malicious files already present on a compromised system in an attempt to help malware gain persistent/extended access.

###__[Intel CPUs Vulnerable to New 'SGAxe' and 'CrossTalk' Side-Channel Attacks](https://thehackernews.com/2020/06/intel-sgaxe-crosstalk-attacks.html)__

Have you heard of [_spectre_ and _meltdown_](https://meltdownattack.com/)? [Bruce Schneier wrote in 2018](https://www.schneier.com/blog/archives/2018/01/spectre_and_mel_1.html):

> Spectre and Meltdown are pretty catastrophic vulnerabilities, but they only affect the confidentiality of data. Now that they -- and the research into the Intel ME vulnerability -- have shown researchers where to look, more is coming -- and what they'll find will be worse than either Spectre or Meltdown.

That has turned out to be true.

Excerpt from the article:

>  "By using the extended attack against the Intel-provided and signed architectural SGX enclaves, we retrieve the secret attestation key used for cryptographically proving the genuinity of enclaves over the network, allowing us to pass fake enclaves as genuine," a group of academics from the University of Michigan said.

###__[SMBleed: A New Critical Vulnerability Affects Windows SMB Protocol](https://thehackernews.com/2020/06/SMBleed-smb-vulnerability.html)__

The title says it all.

Excerpt from the article:

>  Dubbed "SMBleed" ([CVE-2020-1206](https://blog.zecops.com/vulnerabilities/smbleed-writeup-cve-2020-1206-chaining-smbleed-with-smbghost-for-a-rce/)) by cybersecurity firm ZecOps, the flaw resides in SMB's decompression function — the same function as with [SMBGhost](https://thehackernews.com/2020/03/smbv3-wormable-vulnerability.html) or EternalDarkness bug ([CVE-2020-0796](https://nvd.nist.gov/vuln/detail/CVE-2020-0796)), which came to light three months ago, potentially opening vulnerable Windows systems to malware attacks that can propagate across networks.

###__[Honda Ransomware Confirms Findings of Industrial Honeypot Research](https://www.securityweek.com/honda-ransomware-confirms-findings-industrial-honeypot-research)__

An _incident_ that's confirms _research_ findings.

Excerpt from the article:

> The attack was captured by Cybereason's 2020 honeypot research. Similar to a 2018 study, the research used a honeypot designed to look like an electricity company with operations in North America and Europe. In 2018, the system was infiltrated with backdoors suggesting the attacker intended to sell access on the dark web.

###__[Billions of devices affected by UPnP vulnerability](https://nakedsecurity.sophos.com/2020/06/10/billions-of-devices-affected-by-upnp-vulnerability/)__

UPnP stands for _Universal Plug and Play_ and it allows _network_ devices to connect seamlessly.

Excerpt from the article:

> Name [CallStranger](https://callstranger.com/) by discoverer Yunus Çadırcı, the potential for trouble with this flaw looks significant for a whole menu of reasons, starting with the gotcha that it’s UPnP.

<hr>

That's it for this week, I'll see you next Friday.