Police Vouch for Hacker Who Guessed Trump’s Twitter Password

When Dutch ethical hacker Victor Gevers tried to alert Secret Service that he was able to guess the password to President Donald Trump’s Twitter handle last October, there were plenty of skeptics, most notably at the White House. Now, Dutch prosecutors have determined Gevers did, in fact, guess t...

CVE-2020-27508

The CVE-2020-27508 entry reports a flaw in two-factor authentication where the system returns the 2FA secret key in the response, enabling potential breach of 2FA security. Connected sources confirm the issue but do not provide product/vendor/version details, root cause specifics beyond the secre...

Serious Vulnerabilities in Dualog Connection Suite

TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL injection User data leakage Easily brute forcible password hashes Introduction Duri...

Get a head start on defending against tax scams

It may not be tax season in your part of the world right now but you’ll no doubt be pleased to know a prolific tax scammer is on their way to jail for 20 years. If you’re annoyed by tax scam missives, or had the misfortune to hand money over, this is probably satisfying news. Between 2013 and 201...

Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing

By Sudais Asif The vulnerability CVE-2020-27641 allowed malicious actors to bypass two-factor authentication 2FA on the software using brute-force attacks. This is a post from HackRead.com Read the original post: Vulnerability allowed bypassing 2FA in WHM & cPanel by bruteforcing...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

Design/Logic Flaw

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

CVE-2020-29136

CVE-2020-29136 affects cPanel versions prior to 90.0.17, where an authentication bypass allows 2FA to be defeated via brute-force (SEC-575). Root cause: improper enforcement of multi-factor authentication during brute-force attempts. Impact: unauthorized access by bypassing 2FA; exploitation stat...

CVE-2020-29136

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...

2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software

cPanel, a provider of popular administrative tools to manage web hosting, has patched a security vulnerability that could have allowed remote attackers with access to valid credentials to bypass two-factor authentication 2FA protection on an account. The issue, tracked as "SEC-575" and discovered...

CVE-2020-8236

Nextcloud Server 19.0.1 contains an improper authentication issue where a misconfiguration causes a passwordless WebAuthn PIN to be treated as two-factor authentication, but the PIN is not actually verified. This vulnerability could lead to users believing they have 2FA protection when the system...

Showmax: WordPress admin is accessible without HTTP authentication

The wordpress instance stories.showmax.com is a complementary system of the Showmax platform. We enforce 2FA for all user accounts that have access to the administration and that's why we decided not to require Basic Auth and/or IP whitelisting for it...

'Copyright Violation' Notices Lead to Facebook 2FA Bypass

Scammers have hatched a new way to attempt to bypass two-factor authentication 2FA protections on Facebook. Cybercriminals are sending bogus copyright-violation notices with the threat of taking pages down unless the user attempts to appeal. The first step in the “appeal?” The victim is asked to...

Researcher: I Hacked Trump’s Twitter by Guessing Password

Dutch ethical hacker Victor Gevers claims it only took five attempts to guess the password to President Donald Trump’s Twitter account — “maga2020!”. That’s all he needed to hijack the @realdonaldtrump handle, according a report from Dutch newspaper de Volksrant, because it lacked even the most...

On Risk-Based Authentication

Interesting usability study: "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication": Abstract: Risk-based Authentication RBA is an adaptive security measure to strengthen password-based authentication. RBA monitors additional features during...

Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)

The remote host is running a version of FortiOS prior to 6.0.10, 6.2.x prior to 6.2.4, or 6.4.x prior to 6.4.1. It is, therefore, affected by an improper authentication vulnerability due to an issue with the 'username-case-sensitivity' CLI attribute for the SSL VPN. An unauthenticated, remote...

Rocket.Chat: Improper Access Control - Generic

Vulnerability description not provided...

Alien Android Banking Trojan Sidesteps 2FA

A newly uncovered banking trojan called Alien is invading Android devices worldwide, using an advanced ability to bypass two-factor authentication 2FA security measures to steal victim credentials. Once it has infected a device, the RAT aims to steal passwords from at least 226 mobile application...

Android Malware Bypasses 2FA And Targets Telegram, Gmail Passwords

Researchers have uncovered a threat group launching surveillance campaigns that target victims’ personal device data, browser credentials and Telegram messaging application files. One notable tool in the group’s arsenal is an Android malware that collects all two-factor authentication 2FA securit...

Researchers Uncover 6-Year Cyber Espionage Campaign Targeting Iranian Dissidents

Capping off a busy week of charges and sanctions against Iranian hackers, a new research offers insight into what's a six-year-long ongoing surveillance campaign targeting Iranian expats and dissidents with an intention to pilfer sensitive information. The threat actor, suspected to be of Iranian...