Coinbase: Authentication Issue

Hello there, I noticed while creating Recurring payment while 2FA is enabled it asks a user to enter verification code. So when someone confirm the Reccuring payment a request is sent to : POST /recurringpayments/58087a3d6861ee015644fc48/confirm HTTP/1.1 Host: beta.coinbase.com User-Agent:...

VK.com: Второй способ обхода 2FA

Недостаточная проверка пользователя при смене IP-адреса. Лазейка с релогином при смене IP у пользователя...

Slack: Rate-limit bypass

Hello Slack, This vulnerability is about a 2FA Bypass, On Slack Web Application there is rate limit implemented. After performing 4-6 failed 2FA Attempt, Rate limit logic will ge Triaged and ask user to wait for next attemptpreventing automated 2FA Attempts I tested the same using iOS AppiOS 9.3....

PayPal Inc BB #127 - 2FA Bypass Vulnerability

Document Title: =============== PayPal Inc BB 127 - 2FA Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1903 Release Date: ============= 2016-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 1903 Common...

Trello: Verification Code Reused For activating 2FA

There is Authentication Problem with the Verification Code for Activating 2FA ! Description: Verification Code is getting reused for multiple times aven on every activation 2FA action there you recieve saperate an new Verification Code for Activating 2FA ! Proof Video thanks...

That's A Clever Hack! How anyone could make Money from Google and Microsoft

Smart hackers could exploit a loophole that could allow them to steal a significant amount of cash from Google, Microsoft and Instagram using a Premium rate phone number. Security researcher Arne Swinnen from Belgium has discovered an ingenious way to steal money from big tech companies like...

GitLab: Insecure 2FA/authentication implementation creates a brute force vulnerability

Hi All, I believe I've found a vulnerability with regards to your user authentication and 2FA implementation but wasn't sure you'd be interested given the reference to "rate limiting" being out of scope so please bare with me. I also took a quick look at...

Carbonite Triggers Password Reset for 1.5M Customers After Reuse Attack

Online backup firm Carbonite is forcing all of its 1.5 million users to change their passwords after reporting that accounts was targeted in a password reuse attack. According to a statement issued by Carbonite on Tuesday hackers were attempting to break into user accounts using stolen credential...

Phabricator: No authentication required to add an email address.

Hi Team, I hope this mongoose I'm sending will help make phabricator safer. Description: ========== The issue in question, is that whenever you add a new email address to your account, no additional authentication is required. Furthermore, when the account has 2FA enabled, it's not necessary to...

GitLab: Bypassing password authentication of users that have 2FA enabled

Proof of Concept When a user has 2FA enabled, it's possible to sign in as that user without the need to know its password. To reproduce this attack, you need two users that both have 2FA enabled. For the sake of this PoC, lets call them Jane and John. Jane is the attacker and wants to get access ...

PayPal #123 - Security Key Pin Approval & Expire Bypass

Document Title: =============== PayPal 123 - Security Key Pin Approval & Expire Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1697 Video: https://www.youtube.com/watch?v=5O0b88KhJU Release Date: ============= 2016-02-01 Vulnerability Laboratory ID VL-ID:...

HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

LastPass Vault Decryptor

This module extracts and decrypts LastPass master login accounts and passwords, encryption keys, 2FA tokens and all the vault passwords This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' require 'sqlite...

PageFair Hack Serves Up Fake Flash Update to 500 Sites

More than 500 users of a free analytics service may have had their websites compromised over the weekend after a hacker was able to execute malicious JavaScript through the service. On Halloween night, an attacker was able to hijack a “key email account” at PageFair, an ad blocking analytics...

VK.com: CSRF в получении резервных токенов+framing , приводящие к компроментации 2fa

Отсутствие hash на вывод списка резервных кодов...

PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability

Document Title: =============== PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1486 Video: http://www.vulnerability-lab.com/getcontent.php?id=1485 Watch Video:...

PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability

Document Title: =============== PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1486 Video: http://www.vulnerability-lab.com/getcontent.php?id=1485 Watch Video:...

Apple Moving to 2FA, Six-Digit Passcodes in iOS 9

With each new release of iOS, Apple has been improving the security of the mobile operating system, adding new features, inserting exploit mitigations, and taking away avenues for attack. In the forthcoming iOS 9.0 release, the company is continuing this movement with the addition of two-factor...

itBit Exchange: confirmation bypass of 2FA devices while they are deleting

hey guys i just found an logical bug where i could bypass the confirmation of the 2FA devices , while deleting an 2FA security device , this is the request made POST /api/user/devices/checkcode HTTP/1.1 Host: beta.itbit.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:36.0 Gecko/20100101...

Apple Extends Two-Factor Authentication to iMessage, FaceTime

Apple extended two-factor authentication 2FA yesterday to its iMessage and FaceTime services, adding an extra layer of security to the popular iOS apps. The move, which Apple has taken to calling “two-step verification,” follows the company’s enabling of 2FA on its iCloud storage service back in...