Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. An ad for the OTP interception service/bot “SMSRanger.”

Passwords 319

Passwords Mobile Authentication Banking 319

Krebs on Security

MAY 19, 2021

Many online services allow users to reset their passwords by clicking a link sent via SMS, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. While you’re at it, consider removing your phone number as a primary or secondary authentication mechanism wherever possible.

Mobile 346

Mobile Wireless Authentication Accountability 346

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication.

Mobile 288

Mobile Phishing Authentication Accountability 288

Krebs on Security

NOVEMBER 23, 2018

This might involve making sure that new or old PC has up-to-date security software and the requisite software patches, or locking down their wireless router by enabling security features and disabling risky ones. Postal Service , or their wireless phone provider and/or Internet Service Provider (ISP).

Scams 272

Scams Wireless Phishing Banking 272

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another.

Passwords 355

Passwords Password Management Phishing Scams 355

Krebs on Security

FEBRUARY 28, 2023

Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. But in a written statement, T-Mobile said this type of activity affects the entire wireless industry. T-Mobile declined to answer questions about what it may be doing to beef up employee authentication.

Mobile 310

Mobile Phishing Authentication Advertising 310