MyHeritage Says Over 92 Million User Accounts Have Been Compromised

MyHeritage, the Israel-based DNA testing service designed to investigate family history, has disclosed that the company website was breached last year by unknown attackers, who stole login credentials of its more than 92 million customers. The company learned about the breach on June 4, 2018, aft...

Two major Canadian banks blackmailed after alleged data breach

While the US was celebrating Memorial Day on Monday, Canada was dealing with an unusual data breach affecting two popular financial institutions: Simplii Financial and Bank of Montreal BMO. The CBC broke the story and updated it throughout the day to mention that some 90,000 customers were possib...

Researcher shows how hackers can bypass Two-factor authentication

By Uzair Amir A majority of users and companies are moving to Two-factor This is a post from HackRead.com Read the original post: Researcher shows how hackers can bypass Two-factor authentication...

Ubiquiti Inc.: Two Factor Authentication Bypass

The researcher found a method to brute-force the 2FA code request in the www.ubnt.com login page. This method still requires the username/password from the account...

Bitso: Injecting html codes

Hi, I observed that I could inject some html codes in this page https://bitso.com/authenticate?redirect=/merchantinfo. To reproduced: Login to your account that has two factor authentication set up After you login you will be redirected to a page which you will enter the authentication code Open ...

JVN#27137002: IIJ SmartKey App for Android vulnerable to authentication bypass

IIJ SmartKey App for Android provided by Internet Initiative Japan Inc. is an application that enables two-step authentication two-factor authentication for a website from an Android device. IIJ SmartKey App for Android contains an authentication bypass vulnerability CWE-287. Impact An attacker m...

Real-Time Two-Factor Phishing Tool: ReelPhish

2FA adds an extra layer of authentication on top of the typical username and password. Two common 2FA implementations are one-time passwords and push notifications. One-time passwords are generated by a secondary device, such as a hard token, and tied to a specific user. These passwords typically...

Twitter security snafu: change your passwords

If you're logging into Twitter after having been AWOL for a day or two, you'll likely be seeing one of these pop-ups talking about account security: Click to enlarge Don't panic, it's nothing that can't be fixed. The message reads as follows: Keeping your account secure When you set a password fo...

Change Your Twitter Password Immediately, Bug Exposes Passwords in Plaintext

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system. The social media network disclosed the issue in an official blog post and a series of...

Twitter to All Users: Change Your Password Now!

Twitter just asked all 300+ million users to reset their passwords, citing the exposure of user passwords via a bug that stored passwords in plain text -- without protecting them with any sort of encryption technology that would mask a Twitter user's true password. The social media giant says it...

Boutique Shops Offering Rewards Points Pop Up on the Dark Web

Cybercriminal interest in stolen data is not solely limited to financial or personally identifiable information. The exploitation of rewards-points programs, especially those associated with travel, is also on the radar screen for the bad guys. To cater to this interest, a series of boutique stor...

Google Redesigns Gmail – Here's a List of Amazing New Features

Google has finally been rolling out its new massively redesigned Gmail for desktop and mobile to 1.4 billion of users worldwide, which might be the most significant single upgrade in Gmail's history. This huge revamped version of the email service now offers plenty of new features such as...

HackerOne: Team object in GraphQL disclosed total number of whitelisted hackers

Summary: Hi team. Whitelistedhackers i think your setup - Two-factor authentication and IP whitelisting are available to further restrict access to accounts. Description: Again, because of the link error, I can see the number, but I can't see these links. Analogue 310946 Steps To Reproduce 1...

Securing financial data of the future: behavioral biometrics explained

Some of us would be pretty excited about a brave, new passwordless world. Gone would be the days of having to write down 27 passwords and post them beside monitor screens. Or having to yell them out loud to a colleague on the other side of the room. For banks and other financial institutions, a...

Two-Factor Authentication: What is it and why do I need it to stay safe online?

Today, Americans are living more and more of their lives on the internet. We shop, bank, socialize, work and play online. But as our digital lives become increasingly important, they are also exposed to greater risks. Hackers are lurking around every corner ready to steal our identities, drain ou...

How to Fight Mobile Number Port-out Scams

T-Mobile, AT&T and other mobile carriers are reminding customers to take advantage of free services that can block identity thieves from easily "porting" your mobile number out to another provider, which allows crooks to intercept your calls and messages while your phone goes dark. Tips for...

Nextcloud: twofactor_auth bypassable if provider fails to load

Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...

ReelPhish: A Real-Time Two-Factor Phishing Tool

Social Engineering and Two-Factor Authentication Social engineering campaigns are a constant threat to businesses because they target the weakest chain in security: people. A typical attack would capture a victim’s username and password and store it for an attacker to reuse later. Two-Factor...

CVE-2018-6389 WordPress Parameter Resource Consumption Remote DoS

Yesterday Monday, February 5, 2018, a zero-day vulnerability in WordPress core was disclosed, which allows an attacker to perform a denial of service DoS attack against a vulnerable application. The vulnerability exists in the modules used to load JS and CSS files. These modules were designed to...

A week in security (January 22 – January 28)

Last week on Labs, we analyzed a rogue app outbreak on Twitter, took a look at how Singapore's government is faring with network defense, and rolled out our 2017 State of Malware report. We also became visionaries in Gartner's Magic Quadrant report and explored a VR data mishap. Other news Man...