Ubiquiti breach, and other IoT security problems

Networking equipment manufacturer Ubiquiti sent out an email to warn users about a possible data breach. The email stated there had been unauthorized access to its IT systems that are hosted with a third-party cloud provider. Ubiquiti Networks sells networking devices and IoT devices. It did not...

Cloning Google Titan 2FA keys

This is a clever side-channel attack: The cloning works by using a hot air gun and a scalpel to remove the plastic key casing and expose the NXP A700X chip, which acts as a secure element that stores the cryptographic secrets. Next, an attacker connects the chip to hardware and software that take...

[20210301] - Core - Insecure randomness within 2FA secret generation

Usage of the insecure rand function within the process of generating the 2FA secret.Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

Ubiquiti: Change Your Password, Enable 2FA

Ubiquiti, a major vendor of cloud-enabled Internet of Things IoT devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud...

Cloning Google’s Titan Key to bypass 2FA – Research

By Sudais Asif The attack requires the attacker to have physical access to the victim's Titan Key, hours of time, and side-channel setup equipment worth €10,000 $12,000 - £9,000. This is a post from HackRead.com Read the original post: Cloning Googles Titan Key to bypass 2FA - Research...

New Attack Could Let Hackers Clone Your Google Titan 2FA Security Keys

Hardware security keys—such as those from Google and Yubico—are considered the most secure means to protect accounts from phishing and takeover attacks. But a new research published on Thursday demonstrates how an adversary in possession of such a two-factor authentication 2FA device can clone it...

Police Vouch for Hacker Who Guessed Trump’s Twitter Password

When Dutch ethical hacker Victor Gevers tried to alert Secret Service that he was able to guess the password to President Donald Trump’s Twitter handle last October, there were plenty of skeptics, most notably at the White House. Now, Dutch prosecutors have determined Gevers did, in fact, guess t...

CVE-2020-27508

In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...

CVE-2020-27508

The CVE-2020-27508 entry reports a flaw in two-factor authentication where the system returns the 2FA secret key in the response, enabling potential breach of 2FA security. Connected sources confirm the issue but do not provide product/vendor/version details, root cause specifics beyond the secre...

CVE-2020-27508: Undefined Security Weakness

In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...

PT-2020-16695

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The system sends the 2fa secret key in response during two-factor authentication, allowing an intruder to breach the 2fa security. Recommendations At the moment, there is no informati...

Serious Vulnerabilities in Dualog Connection Suite

TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL injection User data leakage Easily brute forcible password hashes Introduction Duri...

Get a head start on defending against tax scams

It may not be tax season in your part of the world right now but you’ll no doubt be pleased to know a prolific tax scammer is on their way to jail for 20 years. If you’re annoyed by tax scam missives, or had the misfortune to hand money over, this is probably satisfying news. Between 2013 and 201...

Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing

By Sudais Asif The vulnerability CVE-2020-27641 allowed malicious actors to bypass two-factor authentication 2FA on the software using brute-force attacks. This is a post from HackRead.com Read the original post: Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

Design/Logic Flaw

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

CVE-2020-29136

CVE-2020-29136 affects cPanel versions prior to 90.0.17, where an authentication bypass allows 2FA to be defeated via brute-force (SEC-575). Root cause: improper enforcement of multi-factor authentication during brute-force attempts. Impact: unauthorized access by bypassing 2FA; exploitation stat...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

CVE-2020-29136: Improper Restriction of Excessive Authentication Attempts

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

PT-2020-17096

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 90.0.17 Description The issue allows 2FA to be bypassed via a brute-force approach. Recommendations For versions prior to 90.0.17, update to version 90.0.17 or later to resolve the issue...