Questions Mount Around Yahoo Breach

As Yahoo continues to investigate the biggest data breach in history, pressure is mounting on the company to admit when it knew about the attack, whether there was a delay in reporting it, and also about how it implements cryptography to secure data it’s responsible for. Security company Venafi...

Microix Timesheet Module SQL Injection

Exploit Title: Microix timesheet module SQL Injection Google Dork: "Copyright by Microix" inurl:"/microixcloud/" Date: 2016-09-06 Software Link: http://www.microix.net/workflow-modules/timesheet-module/ Exploit Author: Anthony Cole Contact: http://twitter.com/acole76 Website:...

Yahoo Confirms 500 Million Accounts Were Hacked by 'State Sponsored' Hackers

500 million accounts — that's half a Billion users! That's how many Yahoo accounts were compromised in a massive data breach dating back to 2014 by what was believed to be a "state sponsored" hacking group. Over a month ago, a hacker was found to be selling login information related to 200 millio...

500 Million Yahoo Accounts Stolen By State-Sponsored Hackers

Yahoo says it was the victim of state-sponsored hackers who stole information associated with 500 million accounts. Yahoo CISO Bob Lord said the attack happened on the company’s network in late 2014; he did not name the country responsible. “The account information may have included names, email...

FTC Releases Data Breach Recovery and Prevention Video

The Federal Trade Commission FTC has released a step-by-step video to users whose personal information may have been exposed in a data breach. This video provides instruction on how to report an incident and develop a personal recovery plan after a data breach has occurred. US-CERT encourages use...

FBI Encouraging Ransomware Victims To Report Infections

The Federal Bureau of Investigation this week urged victims of ransomware to report infections to federal law enforcement in hopes of better understanding the threat. The agency, in tandem with the Internet Crime Complaint Center IC3, issued a public service announcement on Thursday asking...

Massive Data Breach Exposes 6.6 Million Plaintext Passwords from Ad Company

Another Day, Another Data Breach! And this time, it's worse than any recent data breaches. Why? Because the data breach has exposed plaintext passwords, usernames, email addresses, and a large trove of other personal information of more than 6.6 Million ClixSense users. ClixSense, a website that...

324,000 Financial Records with CVV Numbers Stolen From A Payment Gateway

Around 324,000 users have likely had their payment records stolen either from payment processor BlueSnap or its customer Regpack; however, neither of the company has admitted a data breach. BlueSnap is a payment provider which allows websites to take payments from customers by offering merchant...

Russia's Largest Portal HACKED; Nearly 100 Million Plaintext Passwords Leaked

Another data breach from 2012, and this time, it's Russia's biggest internet portal and email provider Rambler.ru. Rambler.ru, also known as Russia's Yahoo, suffered a massive data breach in 2012 in which an unknown hacker or a group of hackers managed to steal nearly 100 Million user accounts,...

Hey, Music Lovers! Last.Fm Hack Leaks 43 Million Account Passwords

Another Day, Another Data Breach! If you love to listen to music online and have an account on Last.fm website, your account details may have compromised in a data breach that leaked more than 43 Million user personal data online. Last.fm was hacked in March of 2012 and three months after the...

Breaching a CA – Blind Cross-site Scripting (BXSS) in the GeoTrust SSL Operations Panel Using XSS Hunter

This is a continuation of a series of blog posts which will cover blind cross-site scripting XSS and its impact on the internal systems which suffer from it. Previously, we’ve shown that data entered into one part of a website, such as the account information panel, can lead to XSS on internal...

2012 Dropbox Hack Spilled Emails, Hashed Passwords on 68 Million

When hackers infiltrated Dropbox in 2012 they made off with credentials for roughly 68 million users. The fact that the online storage site was hacked four years ago was no secret. But details around the sheer size of the stolen database, which contains users’ email addresses plus hashed and salt...

Dropbox Hacked — More Than 68 Million Account Details Leaked Online

Hackers have obtained credentials for more than 68 Million accounts for online cloud storage platform Dropbox from a known 2012 data breach. Dropbox has confirmed the breach and already notified its customers of a potential forced password resets, though the initial announcement failed to specify...

FBI Warned State Election Board Systems of Hacks

The Federal Bureau of Investigation’s Cyber Division this month warned election officials nationwide to fortify voter registration data systems in the wake of two breaches it was able to detect earlier this summer. A “flash” warning sent by the agency about 10 days ago warned state boards of...

Legal Robot: User Information leak allows user to bypass email verification.

When a user is logged on, the following is sent: ██████ This contains some sensitive information, most notably the email token. A user can use this to bypass email verification and verify any email. In addition, the hashed password is leaked, which could present a vulnerability if a user's accoun...

GTA Fan Forum Hacked: Old vBulletin Software To Blame

Outdated vBulletin forum software is being blamed for the breach of a Grand Theft Auto fan forum called GTAGaming. It marks the second time in two days a gaming forum has been targeted by hackers and that a SQL injection vulnerability is believed to have been exploited. The fan website notified...

Epic Games Forum Hacked, Once Again — Over 800,000 Gamers' Data Stolen

If you are a fan of Unreal Tournament from Epic Games or ever have participated in discussions on the online forums run by Epic Games, you possibly need to change your forum password as soon as possible. It seems the Unreal Engine and its creators, Epic Games' forums have recently been compromise...

Leaked Exploits are Legit and Belong to NSA: Cisco, Fortinet and Snowden Docs Confirm

Last week, a group calling itself "The Shadow Brokers" published what it said was a set of NSA "cyber weapons," including some working exploits for the Internet's most crucial network infrastructure, apparently stolen from the agency's Equation Group in 2013. Well, talking about the authenticity ...

Westin, Marriott, Sheraton Hotels Hit By Payment Card Malware

Hotels from Vermont to California have been victimized in a data breach that may have leaked payment data from tens of thousands of point of sale purchases. Customers who frequented 20 hotels run by HEI Hotels and Resorts, a hospitality owner that counts hotel chains like Marriott, Sheraton, and...

Guccifer 2.0 Leaks Personal Info of Nearly 200 Congressional Democrats

The hacker, who recently claimed responsibility for the high-profile hack of Democratic National Committee DNC, has now taken credit for hacking into the Democratic Congressional Campaign Committee DCCC as well. To prove his claims, the hacker, going by the moniker Guccifer 2.0, dumped on Friday...