Security Affairs

MAY 30, 2022

pwned , containing a message that attributes itself to Keksec. It uses a list of hardcoded username/password combinations to login into devices in the attempt to access systems using weak or default credentials. RCE CVE-2020-5902 F5 BigIP RCE No CVE (vulnerability published on 2019) ThinkPHP 5.X LFI CVE-2018-16763 Fuel CMS 1.4.1

Malware 140

Malware DDOS IoT Cybercrime 140

Security Boulevard

MAY 3, 2021

You can check if your phone number or email address is part of this Facebook data leak and other data breaches on the Have I Been Pwned website. How Strong is Your Password? A favourite sports team accounted for 6% of passwords, while a favourite TV show accounted for 5%. The Ransomware Scourge. Stay safe and secure.

Ransomware 124

Ransomware Passwords Scams Government 124

Troy Hunt

JUNE 30, 2022

Four and a half years ago now, I rolled out version 2 of HIBP's Pwned Passwords that implemented a really cool k-anonymity model courtesy of the brains at Cloudflare. Actually, the multiple problems, the first of which is that it's just way too fast for storing user passwords in an online system.

Passwords 307

Passwords Identity Theft Consumer Services Password Management 307

Troy Hunt

MAY 19, 2022

Just before Christmas, the promise to launch a fully open source Pwned Passwords fed with a firehose of fresh data from the FBI and NCA finally came true. The idea of taking 16^5 hash ranges, bundling them all up into a single monolithic archive then making it all downloadable seemed a non-trivial task.

Passwords 294

Passwords 294

Troy Hunt

FEBRUARY 21, 2018

Last August, I launched a little feature within Have I Been Pwned (HIBP) I called Pwned Passwords. This was a list of 320 million passwords from a range of different data breaches which organisations could use to better protect their own systems. Here's what it's all about: There's Now 501,636,842 Pwned Passwords.

Passwords 279

Passwords Data breaches Mobile Risk 279

Troy Hunt

JUNE 25, 2018

Often, it's after someone has searched Have I Been Pwned (HIBP) and found themselves pwned somewhere or other. My relationship with 1Password stretches all the way back to 2011 when I came to the realisation that the only secure password is the one you can't remember.

Passwords 273

Passwords Data breaches Password Management Accountability 273

Troy Hunt

JANUARY 3, 2019

I guess it's maintained its traction due it being referenced in the HIBP description and there being a huge number of people finding themselves pwned. Loco Moco Sec in Hawaii: @troyhunt had a great talk, he even used [link] like a boss @LocoMocoSec pic.twitter.com/coOYwMY1ga — Troy (@troyoholous) April 5, 2018.

Passwords 204

Passwords Technology Government InfoSec 204

Troy Hunt

NOVEMBER 25, 2020

I can't blame this on the teddy bears themselves, rather the fact that the MongoDB holding all the collected data was left publicly facing without a password. I started with the Philips Hue app which was both auto-updating and at the latest firmware version: Ok, that's good, not something I need to think about then.

IoT 357

IoT Firmware Risk Manufacturing 357

Troy Hunt

DECEMBER 17, 2017

This isn't to try and fit things into a nicely boxed calendar week of drip-fed content, but rather that there are genuinely 5 logical areas I want to focus on and they're each discrete solutions I want to be able to link to specifically for years to come. The second one will lead to your database being pwned to the worst possible extent.

Data breaches 188

Data breaches Education Passwords Penetration Testing 188

Troy Hunt

JULY 18, 2019

The very first feature I added to Have I Been Pwned after I launched it back in December 2013 was the public API. I hope the explanation above helps people understand that, and also the fact the API has run the last 5 and a half years without any auth whatsoever clearly demonstrates that financial gain has never been the intention.

Authentication 228

Authentication Firewall Data breaches Mobile 228

Troy Hunt

JULY 19, 2018

If you have an efficient function that executes quickly it can be extremely cost effective as I recently demonstrated with the Pwned Passwords figures : So here's the hard facts - I'm dipping into my pocket every week to the tune of. for you guys to do 54M searches against a repository of half a billion passwords ??

DNS 129

DNS Passwords Firewall Authentication 129

Troy Hunt

JANUARY 10, 2018

agarwal_mohit) January 5, 2018. For example, here's what happens if you attempt to load my own service Have I Been Pwned (HIBP) insecurely: I'm going to call out 4 things this time: An attempt is made to request the site insecurely. They don't know how to use version control, which leads to other assumptions about their ability.

Hacking 279

Hacking Government Risk Encryption 279