Security Affairs

JANUARY 13, 2024

GitLab addressed two critical flaws impacting both the Community and Enterprise Edition, including a critical zero-click account hijacking vulnerability GitLab has released security updates to address two critical vulnerabilities impacting both the Community and Enterprise Edition. CVE-2023-4812 : Bypass CODEOWNERS approval removal.

Accountability 115

Accountability Passwords Hacking Information Security 115

SecureList

MAY 6, 2024

With trillions of dollars of digital payments made every year, it is no wonder that attackers target electronic wallets, online shopping accounts and other financial assets, inventing new techniques and reusing good old ones. Online shopping brands were the most popular lure, accounting for 41.65% of financial phishing attempts.

Phishing 101

Phishing Banking Mobile Scams 101

Security Affairs

OCTOBER 18, 2023

A vulnerability in Synology DiskStation Manager ( DSM ) could be exploited to decipher an administrator’s password. Researchers from Claroty’s Team82 discovered a vulnerability, tracked as CVE-2023-2729 (CVSS score 5.9), in Synology DiskStation Manager (DSM). ” reads the advisory published by the company.

Accountability 121

Accountability Passwords Hacking Internet 121

SecureBlitz

MARCH 24, 2023

A secure password manager for internet users. Are you tired of trying to remember dozens of different passwords for all of your online accounts? Do you worry about the security of your personal information every time you create a new password? Here is the NordPass review.

Password Management 66

Password Management Passwords Internet Internet 66

Schneier on Security

JANUARY 29, 2024

The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. Microsoft is reporting that a Russian intelligence agency—the same one responsible for SolarWinds—accessed the email system of the company’s executives.

Hacking 268

Hacking Accountability Passwords Cybersecurity 268

Security Boulevard

MAY 15, 2024

This GitLab password exploit tracked as CVE-2023-7028, has been actively exploited in the wild, posing significant risks to organizations utilizing GitLab for their development workflows. […] The post CISA Alert: GitLab Password Exploit – Act Now For Protection appeared first on TuxCare.

Passwords 64

Passwords Cybersecurity Software Risk 64

SecureList

MARCH 12, 2024

Profile of participants and applications We collected the data from a sample of the application security assessment projects our team completed in 2021–2023. Mitigation: do not store files containing sensitive data, such as passwords or backups, in web application publish directories.

Passwords 108

Passwords Authentication Architecture Risk 108

Security Boulevard

JUNE 7, 2023

On May 25, 2023 streaming content provider Netflix began enforcing its policy prohibiting the sharing of Netflix accounts even among family members who are not members of the same “household”—meaning living together in the same house. The post Netflix: Is Password-Sharing a Crime? appeared first on Security Boulevard.

Passwords 104

Passwords Accountability Security Awareness Risk 104

Malwarebytes

JANUARY 16, 2024

The vulnerability allows a successful attacker to easily take over users’ accounts without any interaction. As we can see from the description in the database, the root of the problem is that it’s possible to direct password reset emails to unverified email addresses. Do not skip upgrade stops as this could create instability.

Accountability 103

Accountability Passwords Authentication Password Management 103

Security Affairs

JANUARY 1, 2024

These are the Top 2023 Security Affairs cybersecurity stories … enjoy it. RESEARCHER DISCOVERED A NEW LOCK SCREEN BYPASS BUG FOR ANDROID 14 AND 13 Researchers discovered a lock screen bypass bug in Android 14 and 13 that could expose sensitive data in users’ Google accounts. TWO SPYWARE SENDING DATA OF MORE THAN 1.5M

Cybersecurity 107

Cybersecurity Spyware Data breaches Passwords 107

Malwarebytes

NOVEMBER 7, 2023

After 1Password, BeyondTrust, and Cloudflare detected unauthorized log-in attempts to their in-house Okta administrator accounts, they reported the incidents to Okta who started an investigation. To gain access to that service account, the attacker compromised an Okta employee. Change your password. Watch out for fake vendors.

Accountability 120

Accountability Passwords Data breaches Phishing 120

Malwarebytes

SEPTEMBER 13, 2023

Although the " unauthorized party" that compromised LastPass users' data was able to steal password vaults, it's likely that they are having a hard time cracking them open. Brute force guessing techniques may be successful for some weak passwords, but it's an approach that quickly runs out of steam. For us, data security is paramount.

Phishing 137

Phishing Accountability Passwords Password Management 137

Security Affairs

JANUARY 29, 2024

A flaw in Microsoft Outlook can be exploited to access NTLM v2 hashed passwords by tricking users into opening a specially crafted file. The vulnerability CVE-2023-35636 impacting Microsoft Outlook is a Microsoft Outlook information disclosure issue that could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords.

Passwords 113

Passwords Authentication Hacking Accountability 113

Thales Cloud Protection & Licensing

OCTOBER 2, 2023

Cybersecurity Awareness Month 2023 – What it is and why we should be aware madhav Tue, 10/03/2023 - 05:33 The inception of Cybersecurity Awareness Month in 2004 came at a critical juncture in our technological history. emphasized collective action and individual accountability. Protect IT."

Cybersecurity 149

Cybersecurity Cyber threats Authentication Phishing 149

CyberSecurity Insiders

FEBRUARY 2, 2023

From March 2023, that is within 30 days, Netflix, the world-renowned streaming service provider, is all set to enforce a ban on password sharing. Therefore, from early next month, Netflix is all set to roll out a new feature that legally allows the current subscribers to share their account passwords with their loved ones.

Passwords 106

Passwords Accountability VPN Cybersecurity 106

Security Affairs

DECEMBER 5, 2023

Microsoft warns that the Russia-linked APT28 group is actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts. In March 2023, Microsoft published guidance for investigating attacks exploiting the patched Outlook vulnerability tracked as CVE-2023-23397.

Accountability 104

Accountability Government Phishing Authentication 104

CyberSecurity Insiders

JUNE 30, 2023

World Password Day has come around again. Since its inception, it’s an awareness day designed to promote and reinforce the importance of better habits when it comes to password settings. Now, as passwords are often the first port of call for our online / digital identities – it’s of course important that good habits are encouraged.

Passwords 52

Passwords Password Management Data breaches Authentication 52

Krebs on Security

SEPTEMBER 13, 2023

11, 2023, USDoD resurfaced after a lengthy absence to leak sensitive employee data stolen from the aerospace giant Airbus , while promising to visit the same treatment on top U.S. USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus’ systems.

Cybercrime 287

Cybercrime Passwords Authentication Malware 287

SecureWorld News

JUNE 21, 2023

Cybersecurity firm Group-IB recently uncovered a significant security breach involving ChatGPT accounts. These compromised accounts pose a serious risk to businesses, especially in the Asia-Pacific region, which has experienced the highest concentration of ChatGPT credentials for sale.

Accountability 122

Accountability Data collection Cyber threats Cybersecurity 122

Duo's Security Blog

JANUARY 26, 2024

In today’s complex IT landscape, one of the biggest problems faced by a Chief Information Security Officer (CISO) and their IT security team are forgotten and stolen passwords. On average, employees lose 11 hours per year resetting passwords and an average company spends ~$5M per year on setting and resetting passwords.

Passwords 85

Passwords Authentication Mobile CISO 85

DoublePulsar

JANUARY 3, 2024

How 50% of telco Orange Spain’s traffic got hijacked — a weak password So here’s a funny story. The threat actor accessed Orange’s RIPE account. You may notice two step authentication is disabled — RIPE don’t require it, and it isn’t enabled by default for new accounts either. Source: Alon Gal of Hudson Rock Great password, btw.

Passwords 81

Passwords Accountability Internet Internet 81

Security Affairs

JANUARY 4, 2024

An internet outage impacted Orange Spain after a hacker gained access to the company’s RIPE account to misconfigure BGP routing. The hacker, who uses the moniker ‘Snow’, gained access to the RIPE account of Orange Spain and misconfigured the BGP routing causing an internet outage. I have fixed your RIPE admin account security.

Internet 109

Internet Internet Accountability Passwords 109

Malwarebytes

FEBRUARY 6, 2024

The report reveals that, awash with money, the number of known Big Game attacks surged by 68% in 2023, thanks to Ransomware-as-a-Service groups like LockBit and ALPHV. Big game attacks extort vast ransoms from organizations by holding their data hostage—either with encryption, the threat of damaging data leaks, or both.

Ransomware 99

Ransomware Cybercrime Malware Social Engineering 99

Google Security

MAY 2, 2024

Sriram Karra and Christiaan Brand, Google product managers Last year, Google launched passkey support for Google Accounts. Today, we announced that passkeys have been used to authenticate users more than 1 billion times across over 400 million Google Accounts. This post will seek to clarify these topics. Flexible portability.

Accountability 60

Accountability Passwords Authentication Password Management 60

Security Affairs

NOVEMBER 29, 2023

Cloud identity and access management solutions provider Okta revealed additional threat actor activity linked to the October 2023 breach. Okta provided additional details about the October 2023 breach and revealed additional threat actor malicious activities. On Thursday, October 19, Okta advised customers of a security incident.

Social Engineering 105

Social Engineering Authentication Engineering Accountability 105

SecureList

MARCH 13, 2024

The State of Stalkerware in 2023 (PDF) The annual Kaspersky State of Stalkerware report aims to contribute to awareness and a better understanding of how people around the world are impacted by digital stalking. The data highlights of 2023 In 2023, a total of 31,031 unique users were affected by stalkerware, an increase on 2022 (29,312).

Mobile 85

Mobile Passwords Surveillance Technology 85

eSecurity Planet

OCTOBER 30, 2023

See the Top Patch and Vulnerability Management tools October 23, 2023 Citrix NetScaler Vulnerability Under Active Attack Type of attack: Active exploitation of the high-risk Sensitive Information Disclosure vulnerability ( CVE-2023-4966 ) disclosed on October 10, 2023 and now known as Citrix Bleed.

Authentication 104

Authentication Mobile Accountability Software 104

Security Affairs

JULY 3, 2023

Collective Anonymous Sudan has been active since January 2023, it claims to target any country that is against Sudan. Beginning in early June 2023, Microsoft identified surges in traffic against some services that temporarily impacted availability. reads the report published by the company.

Accountability 87

Accountability DDOS Data breaches Hacking 87

Security Affairs

MARCH 29, 2024

The company was the victim of credential stuffing attacks against its website and mobile application on November 18-19 and November 25, 2023. The attackers detected suspicious login activity to certain Hot Topic Rewards accounts. Threat actors obtained valid account credentials obtained from an unknown third-party source.

Accountability 108

Accountability Mobile Passwords Authentication 108

Duo's Security Blog

SEPTEMBER 6, 2023

But conventional protection solutions, like password security, fall short when it comes to efficacy. We have a lot of thoughts on passkeys – some of which we’ve shared in other posts in this passkey blog series – and today we’re going to explore how passkeys stack up against passwords from the perspective of cloud platforms.

Passwords 79

Passwords Password Management Authentication Threat Detection 79

Security Affairs

APRIL 12, 2023

SAP April 2023 security updates include a total of 24 notes, 19 of which are new vulnerabilities. CVE-2023-28765 : An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) – versions 420, 430, can exploit the issue to access to lcmbiar file and further decrypt the file.

Education 83

Education Media Authentication Passwords 83

Security Through Education

JULY 18, 2023

billion by 2023. Use strong passwords and PINs Never use your birthdate, phone number, or physical address, as your passwords or pin codes. A good judge of whether your password is secure or not: If your friend or relative can guess your pins, a criminal can too. This resulted in a loss of $52 billion.

Identity Theft 80

Identity Theft Scams Social Engineering Passwords 80

SecureWorld News

JANUARY 9, 2023

Popular fast food restaurant chain Chik-fil-A recently said it was investigating reports of "suspicious activity" on customer accounts. January 6, 2023. The breach that he mentions apparently involves customer accounts and loyalty points. January 4, 2023. Itching for some chicken? Apparently a few hackers were too.

Accountability 78

Accountability InfoSec Media Passwords 78

BH Consulting

SEPTEMBER 14, 2023

Longer is stronger: why password length matters How long is your password? That’s one of the many fascinating insights from Hive Systems’ 2023 Password Table. For example, NIST recommends eight-character passwords but an attacker using RTX 4090 hardware could guess it in under an hour.) billion last year.

Scams 59

Scams Passwords Social Engineering Cybersecurity 59

Security Through Education

JANUARY 18, 2023

What are some personal cybersecurity concerns for 2023? Business email compromise (BEC) attacks have been predicted to soar in 2023 according to Forbes Advisor. This is how the scammers “fatten the pig” until the right time to “butcher it,” when they take all the money out of the account. The Internet of Things. What You Can Do.

Cybersecurity 98

Cybersecurity Social Engineering Scams IoT 98

CyberSecurity Insiders

DECEMBER 27, 2022

Google, the much-used search engine across the world, has disclosed some security steps to its Gmail users to stay cyber safe in the year 2023. Always keep your google account safe by going through the Security Checkup and Privacy Checkup pages once or twice in 3 months.

Accountability 109

Accountability Mobile Engineering Authentication 109

eSecurity Planet

AUGUST 28, 2023

August 21, 2023 Ivanti finds another vulnerability For the third time in a month, Ivanti’s has reported a vulnerability in a mobile device management platform. The latest — CVE-2023-38035 — affects the Sentry secure mobile gateway, part of Ivanti’s UEM platform and is being exploited as a zero-day.

VPN 98

VPN Authentication Mobile Firewall 98