Penetration Testing

APRIL 22, 2021

COOK A customizable wordlist and password generator. releases: customizable wordlist and password generator appeared first on Penetration Testing. USAGE cook -start admin,root -sep _,- -end secret,critical start:sep:end cook admin,root:_,-:secret,critical Predefined Extentions Sets Use archive for .rar,7z,zip,tar,tgz,

Passwords 40

Passwords Penetration Testing 40

Schneier on Security

OCTOBER 12, 2023

This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? If you’re a true conspiracist, you’re certain nobody is going to find a string that generates any of these seeds.

Passwords 291

Passwords 291

Schneier on Security

NOVEMBER 16, 2021

It was financial in nature, which means it gets one of my most secure passwords. I used PasswordSafe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q~. Which was rejected by the site, because it didn’t meet their password security rules. The other day I was creating a new account on the web.

Passwords 339

Passwords Accountability 339

Troy Hunt

JANUARY 17, 2024

Website, username and password: That's just the first 20 rows out of 5 million in that particular file, but it gives you a good sense of the data. The question of how valid the accompanying passwords remain aside, time and time again the email addresses in the stealer logs checked out on the services they appeared alongside.

Passwords 354

Passwords Password Management Hacking Accountability 354

Krebs on Security

MARCH 26, 2024

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple’s password reset feature. “It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone.

Passwords 346

Passwords Accountability Engineering Phishing 346

Troy Hunt

FEBRUARY 4, 2024

That's not unprecedented, but this is: password: "$2y$10$B0EhY/bQsa5zUYXQ6J.NkunGvUfYeVOH8JM1nZwHyLPBagbVzpEM2", No way! Is that genuinely a bcrypt hash of my own password? Yep, that's exactly what it is : The Spoutible API enabled any user to retrieve the bcrypt hash of any other user's password.

Passwords 363

Passwords Accountability Backups Data breaches 363

Tech Republic Security

JUNE 27, 2023

The FIDO Alliance’s Andrew Shikiar explains how passkeys are quickly replacing passwords as the next-generation login, a low friction, high security protocol for any device. The post How FIDO2 Powers Up Passkeys Across Devices appeared first on TechRepublic.

Passwords 179

Passwords 179

Security Affairs

OCTOBER 18, 2023

A vulnerability in Synology DiskStation Manager ( DSM ) could be exploited to decipher an administrator’s password. Team82 discovered the use of a weak random number generator in Synology’s DiskStation Manager (DSM) Linux-based operating system running on the NAS products. ” reads the advisory published by the company. .”

Accountability 120

Accountability Passwords Hacking Internet 120

Krebs on Security

SEPTEMBER 22, 2023

The password manager service LastPass is now forcing some of its users to pick longer master passwords. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.

Passwords 272

Passwords Encryption Password Management Cryptocurrency 272

The Hacker News

OCTOBER 17, 2023

A medium-severity flaw has been discovered in Synology's DiskStation Manager (DSM) that could be exploited to decipher an administrator's password and remotely hijack the account.

Passwords 131

Passwords Accountability 131

Schneier on Security

AUGUST 18, 2022

Already, previous versions of the Rubber Ducky could carry out attacks like creating a fake Windows pop-up box to harvest a user’s login credentials or causing Chrome to send all saved passwords to an attacker’s webserver.

Passwords 348

Passwords Software Cybersecurity Hacking 348

CyberSecurity Insiders

MAY 9, 2023

In today’s digital age, managing passwords has become increasingly complex. With the average internet user having more than 100 passwords to remember, it’s no wonder that people often resort to using weak passwords that are easy to remember or reuse the same passwords across multiple accounts. Enter password managers.

Password Management 120

Password Management Passwords Authentication Accountability 120

Troy Hunt

MAY 21, 2024

For real, this it perhaps the most Nordic thing I've ever seen (Stefán being from Iceland and all), but unfortunately videos don't really lend themselves to hero images, so I went switch a stylised AI-generated rendition of the event.

Passwords 305

Passwords Hacking 305

Krebs on Security

SEPTEMBER 5, 2023

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.

Cryptocurrency 351

Cryptocurrency Passwords Encryption Accountability 351

Penetration Testing

DECEMBER 13, 2023

LDAPWordlistHarvester A tool to generate a wordlist from the information present in LDAP, in order to crack non-random passwords of domain accounts. ... The post LDAPWordlistHarvester: generate a wordlist from the information present in LDAP appeared first on Penetration Testing.

Penetration Testing 111

Penetration Testing Passwords Accountability 111

The Last Watchdog

JANUARY 31, 2022

We all rely on passwords. For better or worse, we will continue to use passwords to access our computing devices and digital services for years to come. Related : The coming of password-less access. Passwords were static to begin with. They have since been modified in two directions: biometrics and dynamic passwords.

Passwords 232

Passwords Computers and Electronics Password Management Artificial Intelligence 232

SecureWorld News

MAY 2, 2024

In our digitally connected world, passwords are the gateway to protecting our online lives—from email and social media accounts to banking and private data. Yet, many of us still use alarmingly weak passwords or reuse the same ones across multiple sites, putting our digital identities at severe risk.

Passwords 90

Passwords Password Management Identity Theft Authentication 90

Approachable Cyber Threats

SEPTEMBER 13, 2023

Back in November 2022 you may have heard that the password manager company LastPass disclosed a breach in which hackers had stolen password vaults containing data for more than 25 million users. And with the recent string of crypto wallet heists , it appears that some of these passwords may be starting to get cracked.

Passwords 106

Passwords Data breaches Encryption Password Management 106

Schneier on Security

MAY 7, 2021

Six-and-seven-year-olds will be taught how to use usernames and passwords, and the pitfalls of clicking on pop-up links to competitions. Norms around these things are changing so fast, and it’s not likely that we in the older generation will get to dictate what the younger generation does.

Cybersecurity 346

Cybersecurity Education Passwords 346

IT Security Guru

APRIL 5, 2024

Generative AI (GenAI) is a top player changing the internet’s landscape. Cybersecurity Threats from Generative AI Cybersecurity has long been one of the most important aspects to pay attention to. The risks might not be new, but they’re enhanced: Malware Attacks: Generative AI can create more sophisticated malware attacks.

Cybersecurity 124

Cybersecurity Scams Data breaches Marketing 124

The Last Watchdog

NOVEMBER 22, 2021

Until biometrics or a quantum solution change our everyday approach to encryption, passwords remain our first line of defense against data breaches, hackers, and thieves. Proper password hygiene doesn’t require a degree in rocket science. 1) Create sufficiently-complex passwords. But simpler passwords are much easier to hack.

Passwords 244

Passwords Password Management Accountability Data breaches 244

Schneier on Security

APRIL 21, 2023

Users who turn on the recovery key, a unique 28-digit code, must provide it when they want to reset their Apple ID password. And if you already have the recovery key enabled, they can easily generate a new one, which also locks you out. iPhone thieves with your passcode can flip on the recovery key and lock you out.

Passwords 244

Passwords Accountability Banking 244

Schneier on Security

AUGUST 24, 2020

This week Stuart Schechter, a computer scientist at the University of California, Berkeley, is launching DiceKeys, a simple kit for physically generating a single super-secure key that can serve as the basis for creating all the most important passwords in your life for years or even decades to come. Here's a short video demo.

Passwords 283

Passwords Cryptocurrency Password Management Authentication 283

Duo's Security Blog

FEBRUARY 26, 2024

These credentials can then be used to authenticate, without the need for a password. The security properties of tokens depend on the algorithm used to generate the passcodes. By contrast, the Time-Based One-Time Password (TOTP) algorithm produces passcodes that expire after a short time, which adds some extra security.

Authentication 124

Authentication Mobile Passwords Software 124

Security Affairs

JANUARY 1, 2024

CloudSEK researchers analyzed a zero-day exploit that can allow the generation of persistent Google cookies through token manipulation. In October 2023, a developer known as PRISMA first uncovered an exploit that allows the generation of persistent Google cookies through token manipulation. ” continues the report. .

Malware 128

Malware Penetration Testing Passwords Encryption 128

The Hacker News

JANUARY 3, 2024

Information stealing malware are actively taking advantage of an undocumented Google OAuth endpoint named MultiLogin to hijack user sessions and allow continuous access to Google services even after a password reset.

Passwords 104

Passwords Malware 104

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. An ad for the OTP interception service/bot “SMSRanger.”

Passwords 324

Passwords Mobile Authentication Banking 324

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another.

Passwords 358

Passwords Password Management Phishing Scams 358

Troy Hunt

AUGUST 3, 2022

So, earlier this year I created Password Purgatory with the singular goal of putting spammers through the hellscape that is attempting to satisfy really nasty password complexity criteria. I opened-sourced it, took a bunch of PRs, built out the API to present increasingly inane password complexity criteria then left it at that.

Passwords 363

Passwords Accountability 363

CyberSecurity Insiders

AUGUST 9, 2021

Britain’s National Cyber Security Centre(NCSC) has passed advice to online users to think of 3-4 randomly used words as passwords rather than using a complex one and storing it in a file or a password manager as it is hard to remember. NCSC has framed some examples of 3 word passwords which are as below-. modernmanheart.

Passwords 139

Passwords Password Management Data breaches Hacking 139

IT Security Guru

MAY 2, 2024

On this World Password Day , we should all pause and think about how we can adopt passkeys. Passkeys represent a significant industry shift in identity security, moving away from traditional credentials of usernames and passwords to a more secure “no knowledge” approach to authentication that is a vastly better user experience.

Passwords 70

Passwords Password Management Authentication Accountability 70

Security Boulevard

JULY 11, 2021

The post Kaseya Ransomware Attack, PrintNightmare Zero-day, Kaspersky Password Manager Vulnerability appeared first on The Shared Security Show. The post Kaseya Ransomware Attack, PrintNightmare Zero-day, Kaspersky Password Manager Vulnerability appeared first on The Shared Security Show.

Password Management 98

Password Management Passwords Ransomware Technology 98

Schneier on Security

JULY 1, 2019

that reduced the randomness of the cryptographic keys it generates. The security keys are used by thousands of federal employees on a daily basis, letting them securely log-on to their devices by issuing one-time passwords. The problem in question occurs after the security key powers up. Boing Boing post.

Firmware 243

Firmware Passwords Government Encryption 243

Malwarebytes

MARCH 29, 2024

MFA normally requires a user to enter a six-digit code sent by SMS, or generated by an app, or to respond to a push notification, when they enter a username and password. They do this by using stolen credentials to try logging in, or by trying to reset a user’s password over and over again.

Passwords 126

Passwords Accountability Mobile Authentication 126

Malwarebytes

SEPTEMBER 20, 2023

Change your password If your password has been caught up in a breach, you should immediately change it. If you've used the same password on another site or service then you also need to change that. Follow any specific advice they offer first, and keep an eye out for any further communications.

Data breaches 128

Data breaches Passwords Authentication Phishing 128

Tech Republic Security

JANUARY 22, 2021

The new Edge 88 browser includes tough new security features, including a password generator and a tool for monitoring whether your login details have been exposed to the dark web.

Passwords 163

Passwords 163

Troy Hunt

SEPTEMBER 3, 2020

The organisation involved may have contacted you and advised your password was exposed but fortunately, they encrypted it. Ah, yes, but it wasn't encrypted it was hashed and therein lies a key difference: Saying that passwords are “encrypted” over and over again doesn’t make it so. But you should change it anyway.

Passwords 363

Passwords Encryption Data breaches Risk 363