How to Hack Facebook Account Just by Knowing Phone Number

Hacking Facebook account is one of the major queries on the Internet today. It's hard to find — how to hack Facebook account or facebook messenger, but researchers found a way that can allow someone to hack Facebook account passwords with only the target's phone number and some resources. Yes, yo...

Twitter Forces Password Reset on Some Exposed Accounts

Twitter has forced a password reset on an unnamed number of accounts exposed this week in a dump of 32.8 million account names and credentials. A Russian hacker known as Tessa88 has been involved in a number of recent password disclosures with Twitter being the most recent. He shared the cache of...

Has Your TeamViewer Account Been Hacked? Here's What to Do Immediately

Do you have remote login software TeamViewer installed on your desktop? If Yes, then it could be possible that your system can be accessed by attackers to steal your personal details, including your bank and PayPal accounts, as several reports on Reddit and Twitter suggests. According to recent...

TeamViewer Denies Hack, Blames Password Reuse for Compromises

Remote support software company TeamViewer continues to contest claims this week it was hacked and instead claims that password reuse and careless user actions may have led to some of its customers’ machines being compromised. The German company has been vigilant with its stance since posting a...

Google Trust API plans to replace your Passwords with Trust Score

The importance of increasing online security around personal information has risen due to the increase in cyber attacks and data breaches over recent years. I find it hilarious people are still choosing terrible passwords to protect their online accounts. The massive LinkedIn hack is the latest i...

Tumblr Requires Password Reset

Yahoo has forced a password reset on Tumblr account holders after it discovered that someone had accessed email addresses, and salted and hashed passwords from early 2013. A Tumblr spokesperson would not disclose who had accessed the data, where it was found, nor how many email addresses were...

WordPress Google Authenticator Plugin <= 0.47 - Authentication Bypass

This plugin is prone to a two factor authentication Bypass vulnerability. Attackers with a valid password can bypass the two-factor OTP by using an email address. Solution Upgrade this plugin...

Google Authenticator <= 0.47 - Two Factor Authentication Bypass

WordPress 4.5 introduced the ability to login with an email address instead of a username. Google Authenticator v0.47 wasn't aware of the new feature, and didn't properly handle the case where an email address was used instead of a username. Using an email address would allow an attacker with a...

Sony PlayStation Network to Get Two-Factor Authentication

In Brief: Sony is finally bolstering the security of the PlayStation Network by adding Two-Factor Authentication to the servers — almost five years after a massive hack that exposed data of over 77 Million users. Sony confirmed to Polygon today that it is planning to introduce two-factor...

Algolia: No rate-limit in Two factor Authentication leads to bypass using bruteforce attack

Hi, There is no rate limit set for Two factor authentication, which demand for code sent to mobile. This code can be bruteforced easily to bypass this. POST /users/testqr HTTP/1.1 Host: www.algolia.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept:...

npm Token Leak

Overview Affected versions of the npm package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. An attacker could create an HTTP server to collect tokens, and by various means including but not...

5 Things Google has Done for Gmail Privacy and Security

Over the past few years, Google has increasingly improved the online security and protections of its Gmail users. Besides two-factor authentication and HTTPS, Google has added new tools and features to Gmail that ensures users security and privacy, preventing cyber criminals and intelligence...

99 Problems but Two-Factor Ain’t One

Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...

The Best Way to Send and Receive End-to-End Encrypted Emails

How many of you know the fact that your daily e-mails are passaged through a deep espionage filter? This was unknown until the whistleblower Edward Snowden broke all the surveillance secrets, which made privacy and security important for all Internet users than ever before. I often get asked "How...

Steam Stealer Malware "Booming Business" for Attackers Targeting Gaming Service

Malware that targets Steam accounts has proliferated the gaming platform and become what researchers are calling a “booming business” for cybercriminals over the last few months. The popular platform, owned by Valve, boasts 140 million users and is so ripe for attacks that according to the compan...

Two factor Authentication

As a company IT administrator of our company I want that all users authenticate to bamboo in two steps username password & app or sms. So that I'm always sure that a employee of our company logs in bamboo instead of a hacker. This makes even my infrastructure more secure...

Slack: Bypass two-factor authentication

If a user set 2FA, a user has to enter verification code when a user tries to reset password. Under the "Password Reset" page, a user can enter wrong two-factor authentication code many times. I said "many times" because your bug bounty policy stated... Exclusions Issues found through automated...

Microsoft ASP.NET Cross-Site Request Forgery Vulnerability

Microsoft ASP.NET, part of .NET FrameWork, is a Microsoft technology that is a server-side scripting technology that enables scripts embedded in Web pages to be executed by Internet servers. Microsoft ASP.NET suffers from a cross-site request forgery vulnerability that could allow a remote attack...

Microsoft Visual Studio Cross-Site Request Forgery Vulnerability

Microsoft Visual Studio is a family of development toolkits from Microsoft Corporation, USA. A cross-site request forgery vulnerability exists in Microsoft Visual Studio that allows remote attackers to construct malicious URIs, trick users into parsing them, which can be targeted to perform...

LastPass Mitigates LostPass Phishing Attack

LastPass has taken measures to mitigate a phishing attack described this weekend at ShmooCon that put at risk users’ credentials and information stored by the password manager. Researcher Sean Cassidy, chief technology officer of cloud security company Praesidio, demonstrated an attack where he w...