Legal Robot: Enhancement: email confirmation for 2FA recovery

While searching for other issues, a security researcher proposed an enhancement to our 2FA account recovery: require email verification for 2FA recovery use. We implemented this change and thank @goodhackonly for an excellent suggestion that makes Legal Robot even more secure...

Legal Robot: 2FA Error Handling on Google Authenticator

While searching for bugs in a recently launched 2FA feature, a security researcher discovered that client-side error handling for 2FA was incomplete and could cause confusing results for users. When 2FA failed, there was no error message returned to the client and the login progress spinner...

Legal Robot: 2FA user enumeration via login

While going live with additional 2FA options, a security researcher discovered that during login, users that had enabled 2FA were prompted for a second factor, even with an incorrect password i.e. LR correctly rejected the login attempt without a second factor, but rejected all attempts for that...

Legal Robot: 2FA user enumeration via password reset

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...

Legal Robot: Missing link to 2FA recovery code

While going live with additional 2FA options, a security researcher discovered that while we provide a TOTP fallback and Recovery code fallback for users that have enabled U2F, we neglected to do this for TOTP-only users. All users that have enabled TOTP or U2F 2FA should have been able to access...

Legal Robot: Non-functional 2FA recovery codes

While going live with additional 2FA options, a security researcher discovered that users that had enabled 2FA were not able to recover their accounts in case of a missing phone or authentication device. The issue was caused by improper error handling on the client during account recovery...

Nextcloud: bypass of 2FA

Improper protection of the 2FA login made a bypass of the 2FA possible. The bug required to know user credentials but effectively rendered the 2FA ineffective. The issue has been fixed by the Nextcloud team and has been validated by the reporter...

Coinbase: Information disclosure same issue #176002

HI, Reference :- 176002 People use 2fa to protect his / her account from unwanted access and for getting secure from information leak. you were displaying the last 4 digits of a user's phone number after login e.g. "we've send a code to xxx-1234". Industry standard is to show 2 digits instead of ...

Hdfc Life 2FA - Corrupted files, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Hdfc Life 2FA published at the 'play' market has multiple vulnerabilities...

Nextcloud: Password of failed (2FA) login attempt is stored in log

If I try to log in on Webdav with my usual Nextcloud password, it doesn't work due to 2FA. I need an application password. The password of a failed login attempt by any user is stored plain text in the log: ...OCA\\DAV\\Connector\\Sabre\\Auth-validateUserPass'matthes', 'THEPASSWORD'... Even...

Reducing Infrastructure Cost with new Enterprise Application Access Architecture

In an earlier blog, "Remote Access no longer needs to be Complex and Cumbersome", I wrote about the new game-changing remote access solution available from Akamai called Enterprise Application Access EAA. My thesis was that in our cloud-first, mobile-dominated world, providing access to...

Authy 2-Factor Authentication - Customized SSL, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Authy 2-Factor Authentication published at the 'play' market has multiple vulnerabilities...

Cross-origin brute-forcing of Github SAML and 2FA recovery codes

Yesterday while reading my Twitter stream I found this interesting article about downloading GitHub SSO bypass codes. Same as Yasin Soliman I was invited to a Github pre-release of the organisation SAML single sign-on SSO private program. And same as him I found an issue in the same endpoint. So ...

Real-World SS7 Attack — Hackers Are Stealing Money From Bank Accounts

Security researchers have been warning for years about critical security holes in the Signaling System 7 SS7 that could allow hackers to listen in private phone calls and read text messages on a potentially vast scale, despite the most advanced encryption used by cellular networks. Cellular...

GitLab: Access to GitLab's Slack by abusing issue creation from e-mail

Hi there, I found a way to become a verified GitLab team member on Slack. By doing so, I gained access to dozens of channels possibly containing sensitive information. Note that I deleted my account intidchackerone immediately afterwards and did not join, read or engage with any of those channels...

Trello: Phone verification code fails to expire and can be used multiple times also in different accounts to verify same cellphone number on Trello.com

Hi there Trello Security Team , I have noticed a certain behaviour at https://trello.com . What I belief to be a bug . Firstly , I would like to mention it is possible to use same cellphone number on multiple accounts without any problem , which I considere to be a security issue . I chose to...

QIWI: [wallet.rapida.ru] Mass SMS flood

... или сказ о том, как я опрометчиво заказал себе рассылку из 300 смс. Шаги для воспроизведения: 1 Логинимся в wallet.rapida.ru 2 Идём в шаблоны и создаём себе шаблон для оплаты мобилы 3 Если вы до этого нигде не вводили 2FA код - то сейчас самая фишка - нас просят его ввести. 4 Ловим запрос и...

Outlook Web Access Two-Factor Authentication Bypass Exists

Enterprises running Exchange Server have been operating under a false sense of security with regard to two-factor authentication implementations on Outlook Web Access OWA adding an extra layer of protection. A design weakness has been exposed that can allow an attacker to easily bypass 2FA and...

VK.com: Новый 2FA Bypass

Частичный обход проверки сессии. Косяк в функции смены пароля...

Joomla Update Fixes Two Critical Issues, 2FA Error

Web developers who run the content management system Joomla! are strongly encouraged to update their sites immediately. The company on Tuesday pushed out the most recent version of the CMS, 3.6.4, fixing two critical issues that can lead to account creation and elevated privileges, according to a...