How purple teams can embrace hacker culture to improve security

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Matthew Hickey, co-founder, CEO, and writ...

Adventures in Contacting the Russian FSB

KrebsOnSecurity recently had occasion to contact the Russian Federal Security Service FSB, the Russian equivalent of the U.S. Federal Bureau of Investigation FBI. In the process of doing so, I encountered a small snag: The FSBs website said in order to communicate with them securely, I needed to...

GHSA-5V95-V8C8-3RH6 Privilege escalation in rbac

Impact Using a carefully crafted request or malicious proxy, a user with UserWrite permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log. Patches The issue has been fix...

Sifchain: Clickjacking /framing on sensitive Subdomain

Vulnerability Name : Clickjacking /framing Vulnerability Description : Clickjacking is an interface-based attack in which user is tricked into clicking on actionable content on a hidden website by clicking on some other content in a decoy website . Vulnerable Url :...

Microsoft Will Soon Kill Flash on Windows 10 for Good

Plus: A Peloton data leak, Russian hacker details, and more of the week’s top security news...

The Wages of Password Re-use: Your Money or Your Life

When normal computer users fall into the nasty habit of recycling passwords, the result is most often some type of financial loss. When cybercriminals develop the same habit, it can eventually cost them their freedom. Our passwords can say a lot about us, and much of what they have to say is...

Hacker dumps sensitive household records of 250M Americans

By Waqas As seen by Hackread.com, the database was leaked on a prominent hacker forum and comprises 263 GB worth of records. This is a post from HackRead.com Read the original post: Hacker dumps sensitive household records of 250M Americans...

A hacker claims to be selling sensitive data from OTP generating firm

By Habiba Rashid A hacker appears to be selling sensitive data they claim to have stolen from an OTP-generating company. Here's what we know so far! This is a post from HackRead.com Read the original post: A hacker claims to be selling sensitive data from OTP generating firm...

Remote Code Execution

Apache Druid is vulnerable to remote code execution. Certain properties supported by the MySQL JDBC driver allows an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes...

Hacker claims stealing 8.2TB of MobiKwik data; leaks some online

By Waqas Fintech platform MobiKwik is being criticized for hiding a data breach that exposed nearly 8.2TB of data, including sensitive records. This is a post from HackRead.com Read the original post: Hacker claims stealing 8.2TB of MobiKwik data; leaks some online...

MobiKwik Suffers Major Breach — KYC Data of 3.5 Million Users Exposed

Popular Indian mobile payments service MobiKwik on Monday came under fire after 8.2 terabytes TB of data belonging to millions of its users began circulating on the dark web in the aftermath of a major data breach that came to light earlier this month. The leaked data includes sensitive personal...

Russian hacker pleads guilty to planting malware in Tesla Gigafactory

By Waqas The hacker Egor Igorevich Kriuchkov traveled from Russia to the US in an attempt to recruit Tesla employees to exfiltrate data and extort the company. This is a post from HackRead.com Read the original post: Russian hacker pleads guilty to planting malware in Tesla Gigafactory...

A Homecoming Queen Was Arrested for Alleged Vote Hacking

Plus: A mysterious zero-day spree, a high-profile hacker indictment, and more of the week’s top security news...

HackerOne: User's who are banned from program can still be invited to the new reports as collaborators

Summary: Hello team! We have found out that the banned user's who are banned from program can be invited to the new reports as collaborator users. This is pretty weird because the hacker should be banned and no new reports shouldn't be allowed. If program bans the hacker the program can't invite...

US charges Swiss hacker behind massive Verkada security camera hack

By Habiba Rashid The hacker Till Kottmann aka “deletescape” has been indicted for conspiracy, wire fraud, and aggravated identity theft by the US DOJ. This is a post from HackRead.com Read the original post: US charges Swiss hacker behind massive Verkada security camera hack...

Tesla Ransomware Hacker Pleads Guilty; Swiss Hacktivist Charged for Fraud

The U.S. Department of Justice yesterday announced updates on two separate cases involving cyberattacks—a Swiss hacktivist and a Russian hacker who planned to plant malware in the Tesla company. A Swiss hacker who was involved in the intrusion of cloud-based surveillance firm Verkada and exposed...

Hacker dumps Guns.com database with customers, admin data

By Waqas Among other sensitive data, the database includes Guns.com administrator, WordPress, and Cloud log in credentials in plain-text format. This is a post from HackRead.com Read the original post: Hacker dumps Guns.com database with customers, admin data...

Breach Exposes Verkada Security Camera Footage at Tesla, Cloudflare

Hackers claim to have breached Silicon Valley startup Verkada to gain unauthorized access to live feeds of 150,000 security cameras. They claim, the hack gave them widespread access to surveillance footage within companies such as Tesla and Cloudflare, as well as hospitals, companies,...

Microsoft Exchange Hackers Also Breached European Banking Authority

The European Banking Authority EBA on Sunday said it had been a victim of a cyberattack targeting its Microsoft Exchange Servers, forcing it to temporarily take its email systems offline as a precautionary measure. "As the vulnerability is related to the EBA's email servers, access to personal da...

Top Russian hacker forums Maza, Verified hacked; data leaked online

By Waqas It is unclear who hacked these forums but insider discussion believes government authorities were behind the attack as a "friendly warning" message. This is a post from HackRead.com Read the original post: Top Russian hacker forums Maza, Verified hacked; data leaked online...