Security Boulevard

MAY 19, 2021

Modern web applications often base their authentication on cookies, which the browser automatically includes when sending requests to the same server. In this technique, you share data with a cross-origin page by sending text-based messages using the “Window.postMessage()” method. Good cookies, bad cookies. JSON with Padding.

Internet 52

Internet Internet Banking Authentication 52

ForAllSecure

MARCH 29, 2023

In the following sections, we will discuss: API Basics Common API Security Vulnerabilities Best Practices for API Security How to do API Security Automatically By the end of this blog post, you will have a good understanding of API security and the steps you can take to easily secure your APIs. API Basics: What Is an API and How Do APIs Work?

Authentication 40

Authentication Passwords Encryption Software 40

CyberSecurity Insiders

FEBRUARY 25, 2022

This blog was jointly written with Santiago Cortes. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February. Blog BotenaGo. Make sure two-factor authentication is enabled in all services. Detection methods. Executive summary.

Ransomware 119

Ransomware Encryption Malware Backups 119

Security Boulevard

FEBRUARY 17, 2022

Authentication bypass. But the SOP does not limit javascript code, and the HTML <script> tag is allowed to load Javascript code from any origin. Read about how to implement allowlists and which Javascript methods you should avoid to prevent RCE here. Authentication Bypass. Log injection. Mail injection.

Authentication 104

Authentication Encryption Engineering Firewall 104

NopSec

JANUARY 31, 2024

This exploit will certainly be chained with other vulnerabilities and post exploitation methods that require SYSTEM privileges. One of the more interesting aspects of this vulnerability is that the vulnerable XAML component leverages undocumented API methods within the CoreMessaging.dll for interprocess communication.

VPN 59

VPN Government Risk Hacking 59

Duo's Security Blog

FEBRUARY 16, 2024

Duo’s latest annual Trusted Access Report , aptly titled "Navigating Complexity," peels back the layers on the ever-evolving world of access management and analyzes real-world data from 16 billion authentications across millions of devices and users. of measured authentications.

Authentication 100

Authentication Accountability Risk Mobile 100

CyberSecurity Insiders

JUNE 24, 2021

As part of our series on Digital Identity , this blog will look back on the personal identification techniques of previous eras to show how methods of identification have developed over the course of human history. Another historical identification method was the use of tattoos. 100,000 years ago – Jewellery. 1046 BC – Tattoos.

Computers and Electronics 115

Computers and Electronics Passwords Technology Government 115

Troy Hunt

AUGUST 21, 2023

Which is why they turned their attention to the non-authenticated, non-documented unified search API. Instead, Turnstile offers the ability to issue a "non-interactive challenge" which implements the sorts of clever techniques mentioned above and as it relates to this blog post, that can be an invisible non-interactive challenge.

Firewall 201

Firewall Authentication Internet Internet 201

CyberSecurity Insiders

OCTOBER 13, 2021

This blog was written by an independent guest blogger. That ’ s nearly double its price tag of $381,920 back in 2015. When paired with other security measures such as multi-factor authentication (MFA), SSO can help to reduce the security risks posed by passwords. credential compromises every year.

Passwords 141

Passwords Accountability Data breaches Authentication 141

Cisco Security

AUGUST 28, 2023

Clear Text authentication still exists in 2023 Although not directly related to malware infection, we did discover a few other interesting findings during our threat hunt, including numerous examples of clear text traffic disclosing email credentials or authentication session cookies for variety of applications.

Wireless 60

Wireless DNS Mobile Technology 60

SecureList

NOVEMBER 14, 2022

Last June, Google’s TAG team released a blog post documenting attacks on Italian and Kazakh users that they attribute to RCS Lab, an Italian offensive software vendor. In line with our predictions, we released two blog posts in 2022 introducing sophisticated low-level bootkits.

Firmware 106

Firmware Surveillance Mobile Telecommunications 106