Security Boulevard

MARCH 18, 2024

Last week, Microsoft said in an SEC filing that that information stolen in a hack of senior leaders’ email accounts is now being used to “gain or attempt to gain access” to company source code repositories and other internal systems. The post Protecting Against Attacks on NTLM Authentication appeared first on Security Boulevard.

Authentication 126

Authentication Phishing Accountability Hacking 126

Schneier on Security

DECEMBER 15, 2020

This is interesting : Toward the end of the second incident that Volexity worked involving Dark Halo, the actor was observed accessing the e-mail account of a user via OWA. Logs from the Exchange server showed that the attacker provided username and password authentication like normal but were not challenged for a second factor through Duo.

Authentication 339

Authentication Passwords Accountability Network Security 339

Bleeping Computer

MARCH 4, 2024

The hacking group known as TA577 has recently shifted tactics by using phishing emails to steal NT LAN Manager (NTLM) authentication hashes to perform account hijacks. [.]

Authentication 145

Authentication Phishing Accountability Hacking 145

Security Boulevard

APRIL 12, 2021

Earlier this month, our team wrote about the latest Facebook data breach and offered suggestions on how to improve your account security. Let's now walk through the steps you can take to enable two-factor authentication on your accounts.

Authentication 124

Authentication Accountability Data breaches Account Security 124

Security Affairs

MAY 30, 2023

PyPI is going to enforce two-factor authentication (2FA) for all project maintainers by the end of this year over security concerns. Due to security concerns, PyPI will be mandating the use of two-factor authentication (2FA) for all project maintainers by the end of this year. ” reads the announcement.

Authentication 93

Authentication Accountability Hacking Malware 93

Security Affairs

SEPTEMBER 15, 2021

Microsoft announced that users can access their consumer accounts without providing passwords and using more secure authentication methods. Microsoft says the feature will be rolled out over the coming weeks, it already provides passwordless methods to enterprise users since March 2021, and plans to roll out it for Azure AD accounts.

Authentication 107

Authentication Accountability Passwords Phishing 107

Security Affairs

APRIL 12, 2024

Roku announced that 576,000 accounts were compromised in a new wave of credential stuffing attacks. Roku announced that 576,000 accounts were hacked in new credential stuffing attacks, threat actors used credentials stolen from third-party platforms. Then, they enter those accounts to abuse permissions, siphoning out data, or both.

Accountability 118

Accountability Passwords Data breaches Authentication 118

The Hacker News

MAY 2, 2024

Google on Thursday announced that passkeys are being used by over 400 million Google accounts, authenticating users more than 1 billion times over the past two years.

Accountability 115

Accountability Engineering Phishing Authentication 115

Bleeping Computer

MARCH 25, 2024

Cybercriminals have been increasingly using a new phishing-as-a-service (PhaaS) platform named 'Tycoon 2FA' to target Microsoft 365 and Gmail accounts and bypass two-factor authentication (2FA) protection. [.]

Phishing 144

Phishing Accountability Authentication 144

Schneier on Security

DECEMBER 18, 2020

The NSA has published an advisory outlining how “malicious cyber actors” are “are manipulating trust in federated authentication environments to access protected data in the cloud.” From the summary : Malicious cyberactors are abusing trust in federated authentication environments to access protected data.

Authentication 360

Authentication Hacking Accountability Cybersecurity 360

The Last Watchdog

MAY 24, 2022

Perhaps not coincidently, it comes at a time when enterprises have begun adopting passwordless authentication systems in mission-critical parts of their internal operations. Fortifications, such as multi-factor authentication (MFA) and password managers, proved to be mere speed bumps. Our brains just won’t do it.”. Coming advances.

Authentication 342

Authentication Passwords Banking Digital transformation 342

Malwarebytes

JANUARY 11, 2024

Hackers have found a way to gain unauthorized access to Google accounts, bypassing any multi-factor authentication (MFA) the user may have set up. To do this they steal authentication cookies and then extend their lifespan. It doesn’t even help if the owner of the account changes their password. Go to your Google Account.

Accountability 145

Accountability Authentication Passwords Malware 145

Bleeping Computer

DECEMBER 29, 2023

Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset. [.]

Accountability 144

Accountability Malware Authentication Passwords 144

Bleeping Computer

NOVEMBER 7, 2023

Microsoft has introduced a new protective feature in the Authenticator app to block notifications that appear suspicious based on specific checks performed during the account login stage. [.]

Authentication 141

Authentication Accountability 141

Heimadal Security

AUGUST 13, 2021

According to the cloud-based hosting service provider GitHub, as of August 13th, 2021, account passwords are no longer accepted for validating Git operations. The announcement is not new as in July 2020 GitHub declared that all authenticated Git operations will necessitate the use of a private access token, OAuth token, or SSH key.

Authentication 119

Authentication Passwords Accountability Cybersecurity 119

Bleeping Computer

AUGUST 12, 2021

GitHub has announced today that account passwords will no longer be accepted for authenticating Git operations starting tomorrow. [.].

Authentication 118

Authentication Passwords Accountability 118

The Last Watchdog

JULY 24, 2023

Not only are passwords vulnerable to brute force attacks, but they can also be easily forgotten and reused across multiple accounts. The next big thing is passwordless authentication. First and foremost, most solutions rely on connected devices like mobile phones to authenticate users. They are simply not good enough.

Authentication 245

Authentication Passwords Phishing Social Engineering 245

The Last Watchdog

FEBRUARY 3, 2022

I currently have over 450 accounts that use passwords combined with a variety of two-factor authentication methods. Related: How the Fido Alliance enables password-less authentication. Only a dozen or so of my accounts get authenticated via self-hosted services. the address book web app). Scale to come.

Authentication 236

Authentication Passwords Accountability Technology 236

Tech Republic Security

NOVEMBER 16, 2020

Follow these steps to better protect your Zoom account with a second layer of authentication.

Authentication 161

Authentication Accountability 161

The Last Watchdog

MAY 26, 2020

Doing authentication well is vital for any company in the throes of digital transformation. Related: Locking down ‘machine identities’ At the moment, companies are being confronted with a two-pronged friction challenge, when it comes to authentication. LW: Can you frame the separate issue of securing service accounts?

Authentication 281

Authentication Cloud Migration Accountability Digital transformation 281

Security Boulevard

OCTOBER 2, 2021

October is Cybersecurity Awareness Month so in this episode we discuss multi-factor authentication and the use of authenticator apps. Multi-factor authentication is one of the most important things that you can enable to secure your online accounts but its unfortunately overlooked by most people.

Authentication 121

Authentication Accountability Cybersecurity 121

Security Boulevard

AUGUST 21, 2022

The post Multi-Factor Authentication Fatigue Attack, Signal Account Twilio Hack, Facebook and Instagram In-App Browser appeared first on The Shared Security Show. The post Multi-Factor Authentication Fatigue Attack, Signal Account Twilio Hack, Facebook and Instagram In-App Browser appeared first on The Shared Security Show.

Authentication 98

Authentication Accountability Hacking Ransomware 98

Graham Cluley

MARCH 27, 2024

Hardware wallet manufacturer Trezor has explained how its Twitter account was compromised - despite it having sensible security precautions in place, such as strong passwords and multi-factor authentication. Read more in my article on the Hot for Security blog.

Accountability 111

Accountability Cryptocurrency Manufacturing Authentication 111

The Hacker News

FEBRUARY 15, 2024

Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee.

Government 124

Government Accountability VPN Authentication 124

Security Boulevard

OCTOBER 25, 2023

Security flaws in the implementation of the OAuth authentication standard left hundreds of millions of users to at least three popular online sites exposed to possible account takeover by bad actors, according to researchers at Salt Security.

Accountability 117

Accountability Authentication Mobile Cybersecurity 117

Malwarebytes

JANUARY 10, 2024

We have seen several high-profile accounts that were taken over on X (formerly Twitter) only to be used for cryptocurrency related promotional activities, like expressing the approval of exchange-traded funds (ETFs). The @SECGov X account was compromised, and an unauthorized post was posted. .” You’re all set.

Accountability 97

Accountability Scams Hacking Cryptocurrency 97

Tech Republic Security

MARCH 9, 2023

Over the next nine months, the largest internet hosting service for software development and collaboration will make all code contributors add another layer of electronic evidence to their accounts. The post GitHub rolling out two-factor authentication to millions of users appeared first on TechRepublic.

Authentication 147

Authentication Internet Internet Software 147

Bleeping Computer

APRIL 30, 2024

UnitedHealth confirms that Change Healthcare's network was breached by the BlackCat ransomware gang, who used stolen credentials to log into the company's Citrix remote access service, which did not have multi-factor authentication enabled. [.]

Healthcare 144

Healthcare Accountability Hacking Authentication 144

The Hacker News

JANUARY 18, 2022

Cybersecurity researchers have disclosed details of a now-patched bug in Box's multi-factor authentication (MFA) mechanism that could be abused to completely sidestep SMS-based login verification.

Authentication 99

Authentication Accountability Cybersecurity 99

Malwarebytes

FEBRUARY 29, 2024

A vulnerability in Facebook could have allowed an attacker to take over a Facebook account without the victim needing to click on anything at all. In his search for an account takeover vulnerability, the four times Meta Whitehat award receiver started by looking at the uninstall and reinstall process on Android. There was one caveat.

Accountability 126

Accountability Passwords Authentication Risk 126

Malwarebytes

NOVEMBER 7, 2023

After 1Password, BeyondTrust, and Cloudflare detected unauthorized log-in attempts to their in-house Okta administrator accounts, they reported the incidents to Okta who started an investigation. To gain access to that service account, the attacker compromised an Okta employee. Enable two-factor authentication (2FA).

Accountability 128

Accountability Passwords Data breaches Phishing 128

Security Boulevard

MARCH 29, 2023

Customer identity and access management (CIAM) is a major cybersecurity component of any company that maintains customer accounts. Online fraud and authentication attack attempts have grown significantly in the past several years, with attackers increasingly turning their attention to customers rather than companies.

Authentication 105

Authentication Accountability Cybersecurity 105

Troy Hunt

OCTOBER 2, 2020

The vulnerability allow an attacker to hijack any account. I asked for technical detail so I could validated the authenticity of his claim and the info duly arrived. On a surface of it, things looked bad: complete account takeover with a very trivial attack. Full account takeover.

Accountability 363

Accountability Hacking Passwords InfoSec 363

Bleeping Computer

JUNE 20, 2023

Microsoft has addressed an Azure Active Directory (Azure AD) authentication flaw that could allow threat actors to escalate privileges and potentially fully take over the target's account. [.]

Accountability 140

Accountability Authentication 140

Bleeping Computer

OCTOBER 5, 2023

Amazon will require all privileged AWS (Amazon Web Services) accounts to use multi-factor authentication (MFA) for stronger protection against account hijacks leading to data breaches, starting in mid-2024. [.]

Accountability 127

Accountability Data breaches Authentication Technology 127

Security Affairs

AUGUST 31, 2023

Cisco is aware of attacks conducted by Akira ransomware threat actors targeting Cisco ASA VPNs that are not configured for multi-factor authentication. “This highlights the importance of enabling multi-factor authentication (MFA) in VPN implementations. . ” reads a post published by Cisco PSIRT. 200 and 162.35.92[.]242

Authentication 121

Authentication Ransomware VPN Hacking 121

The Last Watchdog

DECEMBER 6, 2021

This traditional authentication method is challenging to get rid of, mostly because it’s so common. Every new account you sign up for, application you download, or device you purchase requires a password. And for businesses, transitioning to new authentication solutions can be expensive and time-consuming.

Authentication 252

Authentication Passwords Mobile Phishing 252