One thing led to another, we did not publish any weekly round-up for the past three weeks. My sincere apologies.

Introduction

Welcome to the weekly round-up of security news from around the Web. I hope your week was fine.

This week is about the following:

• Cybersecurity
• Malware
• Software flaws

SMB Cybersecurity Catching Up to Enterprise… But the Human Element Still a Major Concern

No matter the level of security that a system has, there is always that weak link, most of the time — it's the human factor. This is also the case for Small and Medium Business enhancing their security protocols.

Excerpt from the article:

The reality is this: Humans make mistakes. A Tessian study found that 88 percent of data breaches can be linked to human error. That doesn't necessarily mean that humans are the "weak link" in your organization's security, but it is important to understand how and why they make these all-too-human errors

Japan, France, New Zealand Warn of Sudden Uptick in Emotet Trojan Attacks

Emotet is a popular malware strain that went silent for a while. Recently, it's back.

Excerpt from the article:

Cybersecurity agencies across Asia and Europe have issued multiple security alerts regarding the resurgence of email-based Emotet malware attacks targeting businesses in France, Japan, and New Zealand.

"These links and attachments may look like genuine invoices, financial documents, shipping information, resumes, scanned documents, or information on COVID-19, but they are fake."

Cybercriminals Are Using Legit Cloud Monitoring Tools As Backdoor

Every tool created for humans with good intentions can be abused from social networks to the likes. In this case it's the use of a legitimate tool.

Excerpt from the article:

Using software called Weave Scope, which is used as a visualization and monitoring tool for Docker and Kubernetes services, the TeamTNT threat actor not only mapped the cloud environment of their victims but also executed system commands without having to deploy malicious code on the target server explicitly.

New Raccoon Attack Could Let Attackers Break SSL/TLS Encryption

Transport Layer Security is what keeps information sent over the Web from prying eyes but like all software systems it's subjected to attacks.

Excerpt from the article:

Dubbed "Raccoon Attack," the server-side attack exploits a side-channel in the cryptographic protocol (versions 1.2 and lower) to extract the shared secret key used for secure communications between two parties.

New Unpatched Bluetooth Flaw Lets Hackers Easily Target Nearby Devices

Most modern devices are equipped with the Bluetooth technology, therefore this is serious.

Excerpt from the article:

Discovered independently by two separate teams of academic researchers, the flaw resides in the Cross-Transport Key Derivation (CTKD) of devices supporting both — Basic Rate/Enhanced Data Rate (BR/EDR) and Bluetooth Low Energy (BLE) standard.

Serious Security: Hacking Windows passwords via your wallpaper

Humans are arguably the smartest creatures walking on this planet and we seem to always find ways to break something in this case it's hacking the Windows Operating System via the wallpaper.

Excerpt from the article:

Admittedly, just loading untrusted image files, such as the Wallpaper file specified above, can theoretically be dangerous.

That’s assuming there’s an unpatched vulnerability in one of your apps, or in Windows itself, that can be reliably exploited to trick your computer into running a fragment of executable code when a deliberately crafted image file is opened.

Chrome Sandbox Escape Vulnerability Earns Researchers $20,000

It's 2020, Chrome needs no introduction.

Excerpt from the article:

Google said this week that it patched the vulnerability with the release of a Chrome 85 update for Windows, Mac and Linux. However, the researchers who discovered the issue, Leecraso and Guang Gong of the 360 Alpha Lab at Chinese cybersecurity company Qihoo 360, told SecurityWeek that while the vulnerability affects Chrome on all platforms, they have only managed to trigger it on Android.

That's it for this week, I'll see you next week Friday.

Cover photo by Jazmin Quaynor on Unsplash.