HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

FBI Warns Public Officials of Doxing Threat

The FBI has put law enforcement and high-profile public officials on notice that they could be targeted by hacktivists following the recent doxing of CIA director John Brennan by the hacktivism collective called Crackas With Attitude. Brennan’s AOL email account was taken over by a teen associate...

PageFair Hack Serves Up Fake Flash Update to 500 Sites

More than 500 users of a free analytics service may have had their websites compromised over the weekend after a hacker was able to execute malicious JavaScript through the service. On Halloween night, an attacker was able to hijack a “key email account” at PageFair, an ad blocking analytics...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

Netease mailbox leaked battle network PayPal, etc. accounts may be hacked-vulnerability warning-the black bar safety net

The black bar safety net announced the discovery of Netease mailbox new vulnerability, this vulnerability may lead to Netease mailbox over a million data leaks, involving Netease mailbox-war network account number, PayPal account number and other network accounts fear will be affected, recommende...

Personal Info Stolen? Seven Response Steps

Yesterday on Bloomberg West, host Emily Chang reported on a breach that affected her personally identifiable information PII. She asked what she should do now that she is a victim of data theft. This is my answer. First, I recommend changing passwords for any accounts associated with the breached...

Apple Addresses Dozens of Vulnerabilities, Embraces Two-Factor Authentication in iOS 9

Apple pushed out iOS 9 Wednesday, addressing a cornucopia of vulnerabilities, including bugs that could lead to arbitrary code execution, credential leakage, and interface spoofing among other issues. But conspicuously absent from the update however is a fix for the vulnerability in AirDrop that...

devise-two-factor 1.1.0 and earlier vulnerable to replay attacks

A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local attackers to shoulder-surf a user's TOTP verification code and use it to login after the user has authenticated. By not "burning" a previously used TOTP, devise-two-factor allows a narrow window of opportunity aka the...

Apple Boosts iOS 9 Security with improved Two-Factor Authentication

Apple iOS 9, codenamed Monarch, will be available to the world on September 16th. While most of the upgrades on iOS 9 focus on making devices: Faster Smarter Secure and more efficient. Today we are going to discuss the improved Two-Factor Authentication 2FA pumped within the new iOS operating...

Researchers Outline Bugs in Yahoo, PayPal, Magento

Researchers recently discovered a smattering of vulnerabilities in web applications and mobile applications belonging to companies like Yahoo, PayPal, Magento, and Shopify that could have led to account theft, session hijacking, and phishing, among other consequences. Hadji Samir, Ebrahim Hegazy,...

Best Practices to Protect You, Your Network, and Your Information

The National Cybersecurity and Communications Integration Center NCCIC and its partners responded to a series of data breaches in the public and private sector over the last year, helping organizations through incident response actions, conducting damage assessments, and implementing restoration...

Valve Patches Password Reset Vulnerability in Steam

Valve Software has reportedly patched a vulnerability in the popular online Steam gaming platform that enabled account hijacking through its password reset mechanism. Kotaku, a popular blog among gamers, said that a number of prominent Steam accounts and Twitch streamers were stolen or accessed...

KeyBox - A web-based SSH console that centrally manages administrative access to systems

KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys. Key management and administration is based on profiles assigned to defined users. Administrators can login...

Android new vulnerability: hackers control camera to take pictures to upload-vulnerability warning-the black bar safety net

According to foreign media reports, the former Google engineer Simon Isidore（Szymon Sidor found the Android system there is a new vulnerability, the vulnerability would allow malicious software to control Android device on the camera, and the user unknowingly take pictures, can even upload photos...

Malicious Gaming App Infects More than 1 Million Android Users

It's not at all surprising that the Google Play Store is surrounded by a number of malicious applications that may gain users' attention to fall victim for one, but this time it might be even worse than you thought. Threat researchers from security firm ESET have discovered a malicious...

OPM Hack Expands to Include Data of 21.5M People

UPDATE–The ever-expanding data breach at the Office of Personnel Management has now spread to include the Social Security numbers and other personal data of a total of 21.5 million people, and the toll also now includes the agency’s director, Katherine Archuleta, who resigned Friday morning...

Stolen U.S. Government Credentials Found Online

Credentials stolen in breaches and sundry hacks belonging to close to 100 unique U.S. government domains are scattered among a number of paste sites and are searchable in other locations online. Analysts at Recorded Future said on Wednesday that through open source intelligence gathering and...

OPM Breach Dates Back to December

The attack on the Office of Personnel Management that was disclosed earlier this month began as early as December 2014 and likely was the end result of a social engineering attack that enabled the hackers to gain valid user credentials and move around OPM’s network. During a hearing on Capitol Hi...

Snapchat Offers Users Optional Two-Factor Authentication

Snapchat’s popularity with teens doesn’t run in parallel with the opinion of security and privacy professionals wary of its practices in guarding users’ data. With the release of the latest version of the photo and video sharing app, Snapchat added an optional two-factor authentication feature th...

Coinbase: Two-factor authentication (via SMS)

Hello Coinbase Security Team I just found a problem in Two-factor authentication mechanism, here is the details and how to reproduce this issue: I have two accounts with two emails on coinbase.com i active 2FA on the both of two emails with this phone number +201066462288. From Chrome i will try ...