Introduction
Hello, welcome to this week's review. As usual, I am Habdul Hazeez.
A malware which can steal your money is not something you'll want to hear and neither is a software bug in your favorite device. Quite frankly, these among others is what this week's review is all about.
Grab a cup of coffee, and let's dissect the stories together.
Apple's New iCloud Private Relay Service Leaks Users' Real IP Addresses
This is somehow analogous to using a VPN which ends revealing your IP address to the visited website or application. You might not even know this until you use a website that reveals your IP address.
Excerpt from the article:
A new as-yet unpatched weakness in Apple's iCloud Private Relay feature could be circumvented to leak users' true IP addresses from iOS devices running the latest version of the operating system
Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows
A big Hat Tip to one of the smartest creatures on Earth — Humans.
We are always crafty, to say the least.
Excerpt from the article:
Cybersecurity researchers have disclosed a novel technique adopted by a threat actor to deliberately evade detection with the help of malformed digital signatures of its malware payloads
Frustrated Researcher Discloses Three Unpatched iOS Vulnerabilities
Take a deep breath, exhale, how do you feel? Calm? That's nice, and please be patient.
Excerpt from the article:
"When I confronted [Apple], they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time,” the researcher said
New BloodyStealer Trojan Steals Gamers' Epic Games and Steam Accounts
Due to the high-profile nature of the applications targeted by this malware, the name BloddyStealer is no exaggeration.
Excerpt from the article:
BloodyStealer is a Trojan-stealer capable of gathering and exfiltrating various types of data, for cookies, passwords, forms, banking cards from browsers, screenshots, log-in memory, and sessions from various applications
The information harvested from gaming apps, such as Bethesda, Epic Games, GOG, Origin, Steam, and VimeWorld, is exfiltrated to a remote server, from where it's likely to be monetized on darknet platforms
Beware! This Android Trojan Stole Millions of Dollars from Over 10 Million Users
Nothing is scarier than losing your hard-earned money to malicious code.
Excerpt from the article:
Zimperium zLabs dubbed the malicious trojan "GriftHorse." The money-making scheme is believed to have been under active development starting from November 2020, with victims reported across Australia, Brazil, Canada, China, France, Germany, India, Russia, Saudi Arabia, Spain, the U.K., and the U.S
Hackers could force locked iPhones to make contactless payments
When it's locked, that does not mean it's safe and secure.
Excerpt from the article:
The attack, classified as a Man-in-the-Middle (MitM) replay and relay attack, requires the iPhone to have a Visa Card set up for payment with the “Express Travel” mode turned on, and the victim to be in close vicinity to the attacker
Apple forgot to sanitize the Phone Number field for lost AirTags
At first, when I read this article's title, I thought of one thing only: XSS.
Then I read the article, and it turns out to be XSS because it's the major bug you can think of when you somehow fail to sanitize inputs from your users in an application.
Excerpt from the article:
This kind of attack doesn't need much technological know-how—the attacker simply types valid XSS into the AirTag's phone number field, then puts the AirTag in Lost mode and drops it somewhere the target is likely to find it
Support Me
Writing makes me thirsty. I'll appreciate a cup of coffee 😉.
Credits
Cover photo by Debby Hudson on Unsplash.
That's it for this week, I'll see you next Friday.
Top comments (0)