Krebs on Security

MARCH 9, 2022

Those include remote code execution bugs CVE-2022-24512 , affecting.NET and Visual Studio , and CVE-2022-21990 , affecting Remote Desktop Client. CVE-2022-24459 is a vulnerability in the Windows Fax and Scan service. All three publicly disclosed vulnerabilities are rated “ Important ” by Microsoft.

Authentication 48

Authentication Ransomware Cyber threats Software 48

Krebs on Security

MAY 7, 2022

Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. “I worry about forgotten password recovery for cloud accounts.” Image: Blog.google.

Passwords 270

Passwords Authentication Accountability Mobile 270

Krebs on Security

JUNE 15, 2024

.” In a SIM-swapping attack, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls sent to the victim — including one-time passcodes for authentication, or password reset links sent via SMS. That leaderboard currently lists Sosa as #24 (out of 100), and Tylerb at #65.

Hacking 342

Hacking Cybercrime Phishing Passwords 342

Krebs on Security

NOVEMBER 21, 2024

The bot allowed the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website. One of Scattered Spider’s first big victims in its 2022 SMS phishing spree was Twilio , a company that provides services for making and receiving text messages and phone calls.

Identity Theft 265

Identity Theft Phishing Cryptocurrency Accountability 265

Krebs on Security

JANUARY 7, 2025

In the first step of the attack, they peppered the target’s Apple device with notifications from Apple by attempting to reset his password. The target told Michael that someone was trying to change his password, which Michael calmly explained they would investigate. “Password is changed,” the man said.

Phishing 336

Phishing Cryptocurrency Accountability Social Engineering 336

Security Affairs

MARCH 10, 2025

authorities seized $23M in crypto linked to a $150M Ripple wallet theft, experts believe the incident is linked to the 2022 LastPass breach. authorities seized $23M in crypto tied to a $150M Ripple hack, suspected to have been carried out by hackers from the 2022 LastPass breach. ” reads the complaint.

Password Management 90

Password Management Cryptocurrency Passwords Data breaches 90

Troy Hunt

AUGUST 30, 2023

Data accumulated by the malicious activity spanned from October 2022 until just last week.

Phishing 363

Phishing Password Management Passwords Banking 363

Krebs on Security

DECEMBER 19, 2024

A search in the threat intelligence platform Intel 471 shows a user by the name Araneida promoted the scanner on two cybercrime forums since 2022, including Breached and Nulled. In 2022, Araneida told fellow Breached members they could be reached on Discord at the username “ Ornie#9811.” 2023 on the forum Cracked.

Hacking 246

Hacking Cybercrime Advertising Data breaches 246

Daniel Miessler

DECEMBER 24, 2022

It started back in August of 2022 as a fairly common breach notification on a blog, but it, unfortunately, turned into more of a blog series. After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. Actually, some data was lost.

Password Management 364

Password Management Passwords Encryption Backups 364

Krebs on Security

SEPTEMBER 5, 2023

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Taylor Monahan is founder and CEO of MetaMask , a popular software cryptocurrency wallet used to interact with the Ethereum blockchain.

Cryptocurrency 361

Cryptocurrency Passwords Encryption Accountability 361

Tech Republic Security

JUNE 6, 2022

Passkeys use cryptographic techniques and biometrics and aim to replace passwords for good. The post Apple touts Passkey, its new privacy feature, at WWDC 2022 appeared first on TechRepublic.

Passwords 158

Passwords 158

Schneier on Security

DECEMBER 26, 2022

Last August, LastPass reported a security breach, saying that no customer information—or passwords—were compromised. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture.

Passwords 304

Passwords Encryption Backups Password Management 304

Krebs on Security

JANUARY 30, 2024

technology companies during the summer of 2022. stole at least $800,000 from at least five victims between August 2022 and March 2023. 2022 that an intrusion had exposed a “limited number” of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials.

Social Engineering 358

Social Engineering Mobile Passwords Cybercrime 358

Malwarebytes

OCTOBER 1, 2024

Ireland’s privacy watchdog Data Protection Commission (DPC) has fined Meta €91M ($101M) after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext. Most of these passwords belonged to Facebook Lite users, but it affected other Facebook and Instagram users as well.

Passwords 145

Passwords Data breaches Media Phishing 145

Troy Hunt

MARCH 9, 2023

that was out of a total of more than 166M requests in the same period: Yep, we just hit "five nines" of cache hit ratio on Pwned Passwords being 99.999%. It also means that the 48c per day cost is going to come way down 🙂 Every time the FBI feeds new passwords into the service , the impacted file is purged from cache.

Passwords 363

Passwords Accountability 363

Schneier on Security

JULY 26, 2024

The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text.

Firmware 347

Firmware Encryption Manufacturing Passwords 347

Troy Hunt

OCTOBER 7, 2022

pic.twitter.com/a2yQQvNRpa — Troy Hunt (@troyhunt) October 6, 2022 I love this for the way it throws traditional logic out the window, logic we all knew sucked and I suspect the massive engagement the tweet drove is due to precisely that: Microsoft giving us all a good reason to whinge about a sucky practice that still prevails so broadly.

Passwords 303

Passwords 303

Security Affairs

SEPTEMBER 16, 2023

Iran-linked Peach Sandstorm APT is behind password spray attacks against thousands of organizations globally between February and July 2023. Microsoft researchers observed a series of password spray attacks conducted by Iran nation-state actors as part of a campaign named Peach Sandstorm (aka Holmium , APT33 , Elfin , and Magic Hound ).

Passwords 140

Passwords Accountability Authentication Hacking 140

Krebs on Security

NOVEMBER 14, 2024

Izvestia reports that Peter Vrublevsky is currently living in Switzerland, where he reportedly fled in 2022 after being “arrested in absentia” in Russia on charges of running a violent group that could be hired via Telegram to conduct a range of physical attacks in real life, including firebombings and muggings.

Retail 270

Retail Advertising Cryptocurrency Cybercrime 270

SecureList

DECEMBER 19, 2022

The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. After CVE-2022-41040 and CVE-2022-41082 were revealed, Microsoft provided mitigation guidance followed by a few updates.

Malware 145

Malware Passwords Authentication Internet 145

Krebs on Security

FEBRUARY 26, 2023

million customers, including website administrator passwords, sFTP credentials, and private SSL keys; -December 2022: Hackers gained access to and installed malware on GoDaddy’s cPanel hosting servers that “intermittently redirected random customer websites to malicious sites.”

Hacking 330

Hacking Social Engineering Phishing Scams 330

Digital Shadows

MARCH 17, 2025

Key Findings Even years after their disclosure, VPN-related vulnerabilities like CVE-2018-13379 and CVE-2022-40684 remain essential tools for attackers, driving large-scale campaigns of credential theft and administrative control. Editors note: This report was authored by Gautham Ashok & Alexa Feminella. Rated CVSS 9.8,

VPN 133

VPN Authentication Ransomware Risk 133

Krebs on Security

FEBRUARY 4, 2025

According to the cyber intelligence firm Intel 471 , a user named Finndev registered on multiple cybercrime forums, including Raidforums [ seized by the FBI in 2022 ], Void[.]to .” NorthData reveals that Grimpe was the founder of a German entity called DreamDrive GmbH , which rented out high-end sports cars and motorcycles.

eCommerce 214

eCommerce Cybercrime Accountability Passwords 214

Malwarebytes

OCTOBER 25, 2024

Acting Director of the Office for Civil Rights at the US Department of Health & Human Services Melanie Fontes Rainer said about 140 million people were affected by large breaches in 2023, up from 51 million in 2022. Change your password. You can make a stolen password useless to thieves by changing it.

Healthcare 124

Healthcare Data breaches Passwords Identity Theft 124

SecureList

MAY 16, 2023

Download the full version of the report (PDF) Kaspersky Incident Response in various regions and industries In 2022, 45.9% Key trends in 2022: initial attack vectors and impact In 2022, attackers most often penetrated organizations’ infrastructure by exploiting various vulnerabilities in public-facing applications (42.9%).

Ransomware 140

Ransomware Encryption Security Awareness Passwords 140

Troy Hunt

MAY 14, 2022

Detect suspicious behavior and strengthen your Salesforce security posture.

Passwords 285

Passwords 285

Security Affairs

FEBRUARY 13, 2025

In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred , CaddyWiper , HermeticWiper , Industroyer2 , IsaacWiper , WhisperGate , Prestige , RansomBoggs , and ZeroWipe. On September 2022, the Sandworm group was observed impersonating telecommunication providers to target Ukrainian entities with malware.

Telecommunications 111

Telecommunications DNS Passwords Hacking 111

Troy Hunt

DECEMBER 30, 2022

That's 2022 done and dusted, and what a year it was, both professionally and personally. We made it! It feels great to get to the end of the year with all the proverbial ducks lined up, some massive achievements now behind us (not least of which was the wedding), and a clean slate coming into 2023 to do amazing things.

Password Management 309

Password Management Passwords 309

Malwarebytes

MAY 1, 2025

These messages frequently warn recipients about a problem with their accounts, like a password that needs to be updated, a policy change that requires a login, or a delayed package that has to be approved. In reality, those usernames and passwords are delivered directly to cybercriminals on the other side of the website.

Small Business 94

Small Business Cybersecurity Passwords Scams 94

Krebs on Security

SEPTEMBER 13, 2023

In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle “ USDoD ” had infiltrated the FBI ‘s vetted information sharing network InfraGard , and was selling the contact information for all 80,000 members.

Cybercrime 342

Cybercrime Passwords Authentication Malware 342

Krebs on Security

OCTOBER 31, 2022

A 26-year-old Ukrainian man is awaiting extradition from The Netherlands to the United States on charges that he acted as a core developer for Raccoon , a popular “malware-as-a-service” offering that helped paying customers steal passwords and financial data from millions of cybercrime victims. stolen with the help of Raccoon.

Malware 340

Malware Identity Theft Cybercrime Accountability 340

Troy Hunt

APRIL 14, 2022

No passwords, so I'm guessing they're hashed. — pḧÿzömë (@phyzome) April 4, 2022 On a hunch that this wasn't going to be an easy process, I started recording and kicked off my usual disclosure process.

Data breaches 359

Data breaches Scams Passwords Accountability 359

Krebs on Security

NOVEMBER 11, 2023

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. 9, 2022 and Dec. ’ and granting full access,” @PeteMayo wrote.

Accountability 338

Accountability Authentication Passwords Identity Theft 338

Krebs on Security

MARCH 26, 2024

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple’s password reset feature. “It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone.

Passwords 358

Passwords Accountability Engineering Cryptocurrency 358

Krebs on Security

JULY 12, 2024

AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed). Earlier this year, AT&T reset passwords for millions of customers after the company finally acknowledged a data breach from 2018 involving approximately 7.6

Data breaches 346

Data breaches Passwords Authentication Accountability 346

Troy Hunt

JUNE 17, 2022

my first time back at an NDC since London in early 2020, and the inaugural event for Melbourne) The DivX SubTitles breach was 783k records worth of plain text passwords (it's a 12-year-old incident, but still.) but very heavy listening I need to break into smaller sessions) It's NDC Melbourne nest week!

Passwords 305

Passwords 305

Troy Hunt

DECEMBER 11, 2022

This is now my favourite photo ever ❤️ pic.twitter.com/lspKwVVSly — Troy Hunt (@troyhunt) December 9, 2022 References Will Australia become the world's most cyber-secure country by 2030? (Is Is it feasible? Measurable? Does it even matter?)

Passwords 294

Passwords Hacking 294