Krebs on Security

JULY 10, 2022

Twice in the past month KrebsOnSecurity has heard from readers who’ve had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts.

Accountability 312

Accountability Passwords Authentication Password Management 312

Security Affairs

APRIL 14, 2020

Quidd , the online marketplace for trading stickers, cards, toys, and other collectibles, discloses a data breach in has suffered in 2019, it is also recommending users to change their passwords. One threat actor responded to the post stating that he has already cracked, or decrypted, nearly a million password hashes.”

Accountability 140

Accountability Hacking Data breaches Passwords 140

Security Affairs

MAY 3, 2020

The company has over 4200 employees and accounts for over 90 million active users every month. The hacker has shared 15 million user records calling for action in cracking the passwords that are hashed using the SHA2-384 hashing algorithm. ZDNet confirmed the authenticity of the leaked data. Pierluigi Paganini.

Accountability 122

Accountability Hacking Passwords Data breaches 122

Security Affairs

DECEMBER 3, 2019

A vulnerability in the Microsoft OAuth implementation exposes Azure cloud accounts to takeover. The vulnerability affects the way Microsoft applications use OAuth for authentication, these applications trust certain third-party domains and sub-domains that are not registered by Microsoft. You can see more API calls documented here.”

Authentication 75

Authentication Accountability Social Engineering Advertising 75

Security Affairs

AUGUST 5, 2020

ZDNet reported in exclusive that a list of passwords for 900+ enterprise VPN servers has been shared on a Russian-speaking hacker forum. ZDNet has reported in exclusive that a list of plaintext usernames and passwords for 900 Pulse Secure VPN enterprise servers, along with IP addresses, has been shared on a Russian-speaking hacker forum.

VPN 139

VPN Passwords Banking Advertising 139

Security Affairs

MAY 6, 2020

Hackers have breached the online learning platform Unacademy and are selling the account information for close to 22 million users. Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users. Pierluigi Paganini.

Accountability 105

Accountability Hacking Data breaches Advertising 105

Malwarebytes

JULY 25, 2022

Word is spreading of a compromise claimed to have accessed around 69 million user accounts. Back in 2014, “tens of millions” of Neopets accounts were said to have been traded on underground forums. In 2020, there were claims of ways to potentially gain access to user accounts. Neopets also addressed this.

Data breaches 81

Data breaches Accountability Passwords Password Management 81

Security Affairs

JUNE 1, 2020

The expert Bhavuk Jain received an award of $100,000 for reporting a severe security issue in ‘Sign in with Apple’ authentication bypass bug that could allow the takeover of third-party user accounts. . The accounts are protected with two-factor authentication, and Apple does not track users’ activity in their app or website.

Authentication 98

Authentication Accountability Advertising Passwords 98

Security Affairs

JUNE 8, 2020

Any Indian DigiLocker Account Could’ve Been Accessed Without Password. The Indian Government fixed a flaw in the secure document wallet service Digilocker that could have potentially allowed anyone’s access without password. The service has over 38 million registered users.

Authentication 96

Authentication Mobile Accountability Passwords 96

Security Affairs

MARCH 17, 2019

Threat actors targeted Office 365 and G Suite cloud accounts using the IMAP protocol to bypass multi-factor authentication (MFA). Over the past months, threat actors have targeted Office 365 and G Suite cloud accounts using the IMAP protocol to bypass multi-factor authentication (MFA).

Accountability 112

Accountability Phishing Authentication Passwords 112

Security Affairs

DECEMBER 10, 2019

Microsoft revealed that 44 million Microsoft Azure AD and Microsoft Services accounts were vulnerable to account hijacking. Microsoft discovered that 44 million Microsoft Azure AD and Microsoft Services accounts were vulnerable to account hijacking because of using of compromised passwords. Pierluigi Paganini.

Accountability 90

Accountability Hacking Passwords Advertising 90

Security Affairs

APRIL 19, 2019

Other problems for Facebook that admitted to have stored m illions of Instagram users’ passwords in plaintext. Million email accounts without permission. The passwords were stored in plain text on internal data storage systems, this means that they were accessible only by employees. ” reads the updated s tatement.

Passwords 100

Passwords Advertising Accountability Authentication 100

Security Affairs

JANUARY 2, 2020

The Poloniex cryptocurrency exchange is forcing users to reset their passwords following a data leak. . Another bad news for the community of the virtual currencies communities, the Poloniex cryptocurrency exchange has forced its users to reset their passwords following a data leak. . This is a real email! Pierluigi Paganini.

Passwords 64

Passwords Cryptocurrency Data breaches Advertising 64

Security Affairs

APRIL 28, 2019

Microsoft presented a series of security enhancements for its Windows 10, including the removal of the password-expiration policy. Microsoft announced the removal of the password-expiration policy from its operating system starting with the next Windows 10 feature update (Windows 10 version 1903, a.k.a., ” continues the post.

Passwords 85

Passwords Advertising Authentication Data breaches 85

Security Affairs

FEBRUARY 24, 2020

Slickwraps has disclosed a data breach that impacted over 850,000 user accounts, data were accidentally exposed due to security vulnerabilities. The company confirmed that records were accessed by an unauthorized party, but pointed out that exposed data information did not contain passwords or personal financial data.

Accountability 99

Accountability Data breaches Passwords Advertising 99

Krebs on Security

JUNE 1, 2023

Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. That same email address also is tied to two forum accounts for a user with the handle “ O.R.Z.” account on Carder[.]su

Malware 238

Malware Cybercrime Software Antivirus 238

Security Affairs

NOVEMBER 3, 2018

Cybercriminals offered for sale private messages from at least 81,000 Facebook accounts claiming of being in possession of data from 120 million accounts. Crooks are offering for sale Criminals are selling the private messages of 81,000 hacked Facebook accounts for 10 cents per account. ” states the BBC.

Accountability 105

Accountability Advertising Cybercrime Hacking 105

Security Affairs

APRIL 14, 2019

Bad news for users of the Microsoft Outlook email service, hackers have compromised the Microsoft Support Agent to access their email accounts. Earlier this year, hackers breached Microsoft’s customer support portal and gained access to some email accounts registered with the Microsoft’s Outlook service. Pierluigi Paganini.

Accountability 100

Accountability Hacking Data breaches Advertising 100

Security Affairs

AUGUST 17, 2019

Trend Micro addressed 2 DLL hijacking flaws in Trend Micro Password Manager that could allow malicious actors to escalate privileges and much more. The flaw, tracked as CVE-2019-14684, could allow an authenticated attacker to run with SYSTEM privileges an arbitrary, unsigned DLL file within a trusted process. . Another researcher, Tr?n

Password Management 85

Password Management Passwords Advertising Authentication 85

Security Affairs

NOVEMBER 17, 2018

Million of password resets and two-factor authentication codes exposed in unsecured Vovox DB. Anyone that accessed to the database while it was exposed online could have obtained two-factor codes sent by users to access their accounts potentially exposing them to account take over. Pierluigi Paganini.

Passwords 94

Passwords Accountability Data breaches Advertising 94

Security Affairs

FEBRUARY 11, 2019

620 million accounts stolen from 16 hacked websites (Dubsmash, Armor Games, 500px, Whitepages, ShareThis) available for sale on the dark web. The Register revealed in exclusive that some 617 million online account details stolen from 16 hacked websites are available for sale on the dark web. “I need the money. Pierluigi Paganini.

Accountability 101

Accountability Hacking Advertising Data breaches 101

Security Affairs

JANUARY 28, 2019

The popular video sharing website Dailymotion announced that some accounts were accessed by hackers as result of a massive credential stuffing attack. On Friday, the popular video sharing website Dailymotion announced that some accounts were hit by hackers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Passwords 69

Passwords Data breaches Accountability Advertising 69

Security Affairs

APRIL 26, 2020

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access.” ” “Passwords associated with external authentication systems such as AD or LDAP are unaffected.

Firewall 145

Firewall Passwords Accountability Advertising 145

Security Affairs

SEPTEMBER 21, 2020

Over 500,000 Activision accounts may have been hacked in a new data breach that the gaming firm suffered on September 20. More than 500,000 Activision accounts may have compromised as a result of a data breach suffered by the gaming firm on September 20, reported the eSports site Dexerto. ” reads the post published by Dexerto.

Hacking 116

Hacking Data breaches Accountability Passwords 116

Security Affairs

MARCH 31, 2020

name, mailing address, email address, and phone number) Loyalty Account Information (e.g., account number and points balance, but not passwords) Additional Personal Details (e.g., Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. linked airline loyalty programs and numbers) Preferences (e.g.,

Data breaches 121

Data breaches Passwords Advertising Accountability 121

Security Affairs

AUGUST 15, 2018

Hundreds of Instagram accounts were hijacked in what appears to be the result of a coordinated attack, all the accounts share common signs of compromise. Alleged attackers have hijacked Instagram accounts and modified personal information making impossible to restore the accounts. Russian domain. Russian domain.

Accountability 56

Accountability Hacking Authentication Passwords 56

Security Affairs

MARCH 10, 2020

which is a Shopify-like platform that has been hosting hundreds of online shops used for the sale of hacked accounts and stolen user data. international financial and corporate data, Personally Identifiable Information (PII), and compromised user accounts from many U.S. platform, offered data were authentic according to the feds.

Accountability 119

Accountability Advertising Passwords Hacking 119

Security Affairs

DECEMBER 1, 2019

Over 90 percent of the users identified by Google were targeted via “credential phishing emails” that attempt to trick victims into providing their password or other account credentials to hijack their Google account. It doesn’t mean that hackers successfully compromised their Google accounts. Pierluigi Paganini.

Phishing 137

Phishing Accountability Advertising Cyber Attacks 137

The Last Watchdog

AUGUST 18, 2021

Norton got ‘ demergered ’ from Symantec in 2014 and then acquired LifeLock for $2.3 There are simple steps consumers can take today, for free, to lower their overall risk of a cyber attack, including using multi-factor authentication for their accounts and using strong passwords. billion in 2016, for instance.

Antivirus 223

Antivirus Marketing Identity Theft Social Engineering 223

Security Affairs

AUGUST 4, 2020

UberEats is an American online food ordering and delivery platform launched by Uber in 2014. Exposed records include information such as login credentials, full name, contact number, trip details, bank card details, account creation date. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Banking 145

Banking Data breaches Mobile Advertising 145

Security Affairs

OCTOBER 4, 2020

“These vulnerabilities may allow locally managed accounts within Device Manager to be susceptible to dictionary attacks due to weak cipher implementation (CVE-2020-6925) and allow a malicious actor to remotely gain unauthorized access to resources (CVE-2020-6926), and/or allow a malicious actor to gain SYSTEM privileges (CVE-2020-6927).”

Hacking 136

Hacking Accountability Passwords InfoSec 136

Security Affairs

MAY 21, 2020

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access.” Passwords associated with external authentication systems such as AD or LDAP are unaffected. Pierluigi Paganini.

Firewall 140

Firewall Ransomware Passwords VPN 140

Security Affairs

JULY 19, 2018

Thousands of account credentials associated with the popular file storage service Mega have been published online, The former NSA hacker Patrick Wardle, co-founder at Digita Security , discovered in June a text file containing over 15,500 usernames, passwords, and files names. ” read the post published by ZDNet.

Accountability 54

Accountability Data breaches Passwords Advertising 54

SecureWorld News

MAY 26, 2022

Federal Trade Commission (FTC) and the Department of Justice (DOJ) charged Twitter with a $150 million penalty for " deceptively using account security data for targeted advertising.". Twitter, like many other social media websites, asks users to provide their phone number and email address to better protect their account.

Advertising 94

Advertising Media Accountability Account Security 94

Security Affairs

MAY 9, 2019

Since December 2015, Alpine Linux Docker images have been shipped with hardcoded credentials, a NULL password for the root user. 3) contain a NULL password for the root user. the /etc/shadow file contains a blank field in place of the encrypted password (sp_pwdp in the context of the spwd struct returned by getspent.”

Passwords 83

Passwords Advertising Authentication Accountability 83

Security Affairs

JULY 22, 2019

Last week, hackers published a list of Discord credentials (email addresses/passwords) that were allegedly phished from the users of the gaming chat platform. Last week, a group of hackers published a list of Discord login credentials (email addresses and passwords) that were allegedly phished from the users of the gaming chat platform.

Phishing 83

Phishing Data breaches Passwords Advertising 83

Krebs on Security

JANUARY 8, 2024

As detailed in my 2014 book, Spam Nation , Spamdot was home to crooks controlling some of the world’s nastiest botnets, global malware contagions that went by exotic names like Rustock , Cutwail , Mega-D , Festi , Waledac , and Grum. bank accounts. This post is an attempt to remedy that omission. The domain wmpay.ru

Cybercrime 206

Cybercrime Banking Computers and Electronics DDOS 206