article thumbnail

Recycle Your Phone, Sure, But Maybe Not Your Number

Krebs on Security

The Princeton team further found 100 of those 259 numbers were linked to leaked login credentials on the web, which could enable account hijackings that defeat SMS-based multi-factor authentication. While you’re at it, consider removing your phone number as a primary or secondary authentication mechanism wherever possible.

Mobile 348
article thumbnail

How 1-Time Passcodes Became a Corporate Liability

Krebs on Security

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. That’s down from 53 percent that did so in 2018, Okta found.

Mobile 299
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

‘The Manipulaters’ Improve Phishing, Still Fail at Opsec

Krebs on Security

Apparently, the HeartSender web interface has several webpages that are accessible to unauthenticated users, exposing customer credentials along with support requests to HeartSender developers. “Ironically, the Manipulaters may create more short-term risk to their own customers than law enforcement,” DomainTools wrote.

Phishing 227
article thumbnail

Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider

Krebs on Security

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. A booking photo of Noah Michael Urban released by the Volusia County Sheriff.

article thumbnail

Identity Thieves Bypassed Experian Security to View Credit Reports

Krebs on Security

Clearly, Experian found it simpler to respond this way, rather than acknowledging the problem and addressing the root causes (lazy authentication and abhorrent account recovery practices). But there are some concrete steps that everyone can take which will dramatically lower the risk that identity thieves will ruin your financial future.

article thumbnail

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Krebs on Security

. “InfraGard connects critical infrastructure owners, operators, and stakeholders with the FBI to provide education, networking, and information-sharing on security threats and risks,” the FBI’s InfraGard fact sheet reads. “If it was only the phone I will be in [a] bad situation,” USDoD said.

Hacking 362
article thumbnail

Arrest, Raids Tied to ‘U-Admin’ Phishing Kit

Krebs on Security

Perhaps the biggest selling point for U-Admin is a module that helps phishers intercept multi-factor authentication codes. Qbot) — to harvest one-time codes needed for multi-factor authentication. There are multiple recent reports that U-Admin has been used in conjunction with malware — particularly Qakbot (a.k.a.

Phishing 279