10 SIM Swappers Arrested for Stealing $100M in Crypto from Celebrities

Ten people belonging to a criminal network have been arrested in connection with a series of SIM-swapping attacks that resulted in the theft of more than $100 million by hijacking the mobile phone accounts of high-profile individuals in the U.S. The Europol-coordinated year-long investigation was...

CVE-2021-25759

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...

Design/Logic Flaw

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...

CVE-2021-25759

CVE-2021-25759 affects JetBrains Hub prior to 2020.1.12629, where an authenticated user can delete 2FA settings of any other user. This is documented across multiple sources (NVD/Red Hat/CNVD mirrors and the JetBrains Security Bulletin Q4 2020). The JetBrains bulletin states the issue was resolve...

CVE-2021-25759

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...

LIVE Webinar: Major Lessons to be Learned from Top Cyber Attacks in 2020

We likely all agree that 2020 was a year we won't soon forget - for many reasons. One area particularly impacted last year was and continues to be cybersecurity. While Internet access allowed many businesses to continue functioning during the COVID-19 stay at home requirements, the unprecedented...

SonicWall Breach Stems from ‘Probable’ Zero-Days

UPDATE SonicWall is investigating “probable” zero-day flaws in its remote access security products that have been targeted by “highly-sophisticated” attackers. The company says it is investigating the attack and will update customers within 24 hours. The security company said it is currently...

Discourse has an unspecified vulnerability (CNVD-2021-100598)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...

CS Money: Able to upload backgrounds before entering 2FA

Summary: Hi Team, I am able to see and use uploaded backgrounds and able to upload new ones without proper authentication of 2FA. I hope you remember this report 993786. Steps To Reproduce: 1. Login with a steam account and enable 2FA. 1. Now logout your account. Clear all the cookies. 1. Now aga...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

Authentication flaw

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...

CVE-2021-3138

CVE-2021-3138 affects Discourse 2.7.0 through beta1, where a rate-limit bypass enables bypassing the 2FA requirement for certain forms. The vulnerability stems from how 2FA relies on rate-limiting, enabling bypasses under certain conditions. Documented impact is the 2FA bypass; exploitation detai...

Ubiquiti breach, and other IoT security problems

Networking equipment manufacturer Ubiquiti sent out an email to warn users about a possible data breach. The email stated there had been unauthorized access to its IT systems that are hosted with a third-party cloud provider. Ubiquiti Networks sells networking devices and IoT devices. It did not...

Cloning Google Titan 2FA keys

This is a clever side-channel attack: The cloning works by using a hot air gun and a scalpel to remove the plastic key casing and expose the NXP A700X chip, which acts as a secure element that stores the cryptographic secrets. Next, an attacker connects the chip to hardware and software that take...

[20210301] - Core - Insecure randomness within 2FA secret generation

Usage of the insecure rand function within the process of generating the 2FA secret.Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

Ubiquiti: Change Your Password, Enable 2FA

Ubiquiti, a major vendor of cloud-enabled Internet of Things IoT devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud...

Cloning Google’s Titan Key to bypass 2FA – Research

By Sudais Asif The attack requires the attacker to have physical access to the victim's Titan Key, hours of time, and side-channel setup equipment worth €10,000 $12,000 - £9,000. This is a post from HackRead.com Read the original post: Cloning Googles Titan Key to bypass 2FA - Research...

New Attack Could Let Hackers Clone Your Google Titan 2FA Security Keys

Hardware security keys—such as those from Google and Yubico—are considered the most secure means to protect accounts from phishing and takeover attacks. But a new research published on Thursday demonstrates how an adversary in possession of such a two-factor authentication 2FA device can clone it...