Adam Shostack

JANUARY 2, 2025

Bruse Marshall has put together a useful comparison of password requirements from OWASP ASVS v3 and v4. Bruce Marshall has put together a comparison of OWASP ASVS v3 and v4 password requirements: OWASP ASVS 3.0 & 4.0 We should judge standards on their delivery of these important contextual documents. Comparison.

Passwords 130

Passwords 130

Schneier on Security

JANUARY 29, 2024

Microsoft is reporting that a Russian intelligence agency—the same one responsible for SolarWinds—accessed the email system of the company’s executives. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself.

Hacking 337

Hacking Accountability Passwords Cybersecurity 337

Security Affairs

NOVEMBER 8, 2024

Law enforcement warns that securely stored iPhones awaiting forensic examination are mysteriously rebooting, making them much harder to unlock, per a document obtained by 404 Media. 404 Media obtained the document from a mobile forensics source and verified it with another source. Below is the hypothesis reported in the document.

Media 120

Media Mobile Passwords Hacking 120

Security Affairs

NOVEMBER 12, 2024

Law enforcement warned that securely stored iPhones awaiting forensic examination are mysteriously rebooting, making them much harder to unlock, per a document obtained by 404 Media. 404 Media obtained the document from a mobile forensics source and verified it with another source. reported 404 Media. “The

Media 129

Media Wireless Mobile Encryption 129

Malwarebytes

OCTOBER 1, 2024

Ireland’s privacy watchdog Data Protection Commission (DPC) has fined Meta €91M ($101M) after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext. Most of these passwords belonged to Facebook Lite users, but it affected other Facebook and Instagram users as well.

Passwords 145

Passwords Data breaches Media Phishing 145

The Last Watchdog

JANUARY 27, 2025

Organizations can use this checklist to track progress and identify areas requiring attention before assessment. demands a structured approach to implementation and preparation. demands a structured approach to implementation and preparation. demands a structured approach to implementation and preparation.

Password Management 130

Password Management Architecture Threat Detection Cybersecurity 130

Malwarebytes

JANUARY 6, 2025

Nothing showed evidence that a HIPAA-compliant risk analysis had ever been conducted (lists of usernames and passwords in plain text on the compromised server). There were no password policies until at least January 2024 (the same username and password were used for all Westend Dental servers that contained protected health information).

Data breaches 145

Data breaches Ransomware Passwords Insurance 145

Malwarebytes

OCTOBER 19, 2023

The administrator password is "admin". Research has revealed that IT administrators are just as likely to do the tech equivalent of putting the key under the mat as end users, with both groups using similarly predictable passwords. For that reason, using default passwords is considered a serious security risk.

Passwords 135

Passwords Authentication Password Management Engineering 135

Hacker's King

DECEMBER 28, 2024

Your Gmail account stores valuable information such as emails, contacts, and documents. A compromised password can lead to identity theft and data breaches. To safeguard your Gmail password, you need to adopt a few best practices that will enhance your accounts security and keep cyber threats at bay.

Passwords 52

Passwords Identity Theft Accountability Data breaches 52

Krebs on Security

FEBRUARY 4, 2025

The breach tracking service Constella Intelligence says this email address used the same password (and slight variations of it) across many accounts online — including at hacker forums — and that the same password was used in connection with dozens of other email addresses, such as florianmarzahl@hotmail.de, and fmarzahl137@gmail.com.

eCommerce 214

eCommerce Cybercrime Accountability Passwords 214

Krebs on Security

APRIL 30, 2025

In a SIM-swapping attack, crooks transfer the targets phone number to a device they control and intercept any text messages or phone calls to the victim’s device including one-time passcodes for authentication and password reset links sent via SMS. Documents from the U.S. ” U.S.

Identity Theft 192

Identity Theft Phishing Cryptocurrency Cybercrime 192

Troy Hunt

JUNE 30, 2022

Four and a half years ago now, I rolled out version 2 of HIBP's Pwned Passwords that implemented a really cool k-anonymity model courtesy of the brains at Cloudflare. Actually, the multiple problems, the first of which is that it's just way too fast for storing user passwords in an online system.

Passwords 356

Passwords Identity Theft Consumer Services Password Management 356

Malwarebytes

APRIL 28, 2025

This is not just bad news for those remote workers, it could be even worse for the WorkComposer customers that can see internal communications, confidential business documents, and log in pages exposed to anyone that stumbled over the unprotected bucket. Change the passwords that may have been seen. Watch out for phishing attacks.

Passwords 94

Passwords Phishing Spyware Password Management 94

Security Affairs

MAY 1, 2025

. “The emails had the subject Documents from 04/29/2025 and were sent from an address disguised as corporate correspondence.” ” The phishing emails employed in the campaign spotted by F6 experts has the subject Documents from 04/29/2025 and were sent from addresses mimicking corporate senders.

Malware 86

Malware Phishing Telecommunications Retail 86

IT Security Guru

JANUARY 22, 2024

Password managers have become integral tools for individuals and businesses alike. However, these digital guardians can offer more than just a secure vault for passwords. In fact, a good password manager can play a crucial role in enhancing both the personal and professional aspects of a user’s digital life.

Password Management 133

Password Management Passwords Banking Accountability 133

Adam Shostack

JANUARY 2, 2025

The bank unexpectedly sent me a temporary password to sign up, and when I did, the temporary password had expired. But then, after I went to reset the password, the bank emailed me a one time code. Which is a fine practice, and brings me to the question: Why expire the first passwords at all? Why make it harder?

Banking 130

Banking Passwords Password Management Authentication 130

Hacker's King

FEBRUARY 9, 2025

It quickly spots common security flaws like misconfigurations, outdated sof, such as, and weak passwords, helping you test systems efficiently and thoroughly. To make it user-friendly for both beginners and experts, clear commands and comprehensive documentation are incorporated in this tool.

Penetration Testing 52

Penetration Testing Architecture Cybercrime Security Defenses 52

Hacker's King

FEBRUARY 9, 2025

It quickly spots common security flaws like misconfigurations, outdated sof, such as, and weak passwords, helping you test systems efficiently and thoroughly. To make it user-friendly for both beginners and experts, clear commands and comprehensive documentation are incorporated in this tool.

Penetration Testing 52

Penetration Testing Architecture Cybercrime Security Defenses 52

Security Affairs

OCTOBER 25, 2024

Cisco warned customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services configured on Cisco Secure Firewall devices. The company published a document containing recommendations against password spray attacks aimed at Remote Access VPN (RAVPN) services.

VPN 114

VPN Firewall Technology Passwords 114

Security Affairs

MARCH 29, 2024

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services of Cisco Secure Firewall devices. Cisco is warning customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services configured on Cisco Secure Firewall devices. ” reads the report.

Firewall 132

Firewall Passwords VPN Authentication 132

Security Affairs

NOVEMBER 21, 2024

Stolen files allegedly include contracts, insurance, and financial documents. “In that case, officials at the president’s press office later said the information appeared to have been downloaded using the password of a former employee.” ” reported the Associated Press.

Government 144

Government Hacking Ransomware Insurance 144

Krebs on Security

MARCH 17, 2019

Illegal SIM swaps allow fraudsters to hijack a target’s phone’s number and use it to steal financial data, passwords, cryptocurrencies and other items of value from victims. “But from that site’s side, when they see a password reset come in via that phone number, they have no way to know if that’s me. .

Accountability 279

Accountability Passwords Mobile Banking 279

Krebs on Security

NOVEMBER 14, 2024

Hydra trafficked in illegal drugs and financial services, including cryptocurrency tumbling for money laundering, exchange services between cryptocurrency and Russian rubles, and the sale of falsified documents and hacking services. Incredibly, the day after our initial interview via Telegram, Shefel proposed going into business together.

Retail 270

Retail Advertising Cryptocurrency Cybercrime 270

Krebs on Security

SEPTEMBER 5, 2023

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.

Cryptocurrency 361

Cryptocurrency Passwords Encryption Accountability 361

Krebs on Security

MAY 22, 2019

Our {legal team | legal council | legal departement} has prepared a document explaining the {litigation | legal dispute | legal contset}. Please download and read the attached encrypted document carefully. Note: The password for the document is 123456. Yes, the spelling/grammar is poor and awkward (e.g.,

Phishing 280

Phishing Antivirus Scams Malware 280

Krebs on Security

FEBRUARY 19, 2020

The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords. How would your organization hold up to a password spraying attack? As the Citrix hack shows, if you don’t know you should probably check, and then act on the results accordingly.

VPN 363

VPN Passwords Software Telecommunications 363

Krebs on Security

APRIL 6, 2021

. — rely on that number for password resets. From there, the bad guys can reset the password of any account to which that mobile number is tied, and of course intercept any one-time tokens sent to that number for the purposes of multi-factor authentication. It’s time we stopped letting everyone treat them that way.

Mobile 357

Mobile Accountability Passwords Authentication 357

Webroot

MARCH 3, 2025

Common attacks to consumer protection Identity theft and fraud Some common types of identity theft and fraud include account takeover fraud , when criminals use stolen personal information such as account numbers, usernames, or passwords to hijack bank accounts, credit cards, and even email and social media accounts.

Consumer Protection 99

Consumer Protection Identity Theft Scams Social Engineering 99

Krebs on Security

MARCH 26, 2024

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple’s password reset feature. “It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone.

Passwords 358

Passwords Accountability Engineering Cryptocurrency 358

Krebs on Security

MAY 5, 2021

After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others.

Accountability 348

Accountability Advertising Passwords Phishing 348

Security Affairs

MARCH 20, 2025

The malspam messages had the topic Free primary legal aid use a password-protected attachment Algorithm of actions of members of the family of a missing serviceman LegalAid.rar.

Computers and Electronics 108

Computers and Electronics Telecommunications Malware Surveillance 108

Krebs on Security

FEBRUARY 26, 2025

At the end of 2023, malicious hackers learned that many companies had uploaded sensitive customer records to accounts at the cloud data storage service Snowflake that were protected with little more than a username and password (no multi-factor authentication needed).

Hacking 255

Hacking Government Identity Theft Accountability 255

Krebs on Security

OCTOBER 1, 2021

From there, the attackers can reset the password for almost any online account tied to that mobile number, because most online services still allow people to reset their passwords simply by clicking a link sent via SMS to the phone number on file.

Wireless 350

Wireless Mobile Passwords Authentication 350

Krebs on Security

JUNE 1, 2023

.” Constella Intelligence , a company that tracks exposed databases, finds that 774748@gmail.com was used in connection with just a handful of passwords, but most frequently the password “ featar24 “ Pivoting off of that password reveals a handful of email addresses, including akafitis@gmail.com. ru in 2008.

Malware 311

Malware Cybercrime Software Accountability 311

Troy Hunt

JULY 31, 2024

The sender then attached a text file with 197 lines of email addresses and passwords belonging to users of Scott's pride and joy. Exposure of sensitive user data including names, emails, addresses, and documents. Most with the same password too, because a normal person obviously owns this email address.

Scams 362

Scams Passwords Malware Accountability 362

Security Affairs

OCTOBER 21, 2024

The breach may have exposed personal identification documents uploaded by users for Wayback Machine page removal requests, depending on the attacker’s Zendesk API access. HIBP confirmed that the stolen archive had 31M records, including email address, screen name, bcrypt password hash, and timestamps for password changes.

Internet 129

Internet Internet Data breaches Authentication 129

Krebs on Security

JULY 15, 2024

“And since there’s no password on the account, it just shoots them to the ‘create password for your new account’ flow. What’s more, Monahan said, Squarespace did not require email verification for new accounts created with a password.

Accountability 336

Accountability Cryptocurrency Passwords DNS 336