Yahoo Persists in Scanning Emails for In-Depth Ad-Targeting

While the rest of the U.S. tech industry is taking steps to assuage consumer concerns over privacy and data-harvesting, Yahoo is selling off the ability to scan more than 200 million Yahoo Mail inboxes for rich user data that might be used for marketing purposes. Verizon’s Oath unit, which owns...

AWS Slurp Github Takeover

Slurp is a tool used by information security professionals to enumerate AWS S3 buckets. Slurp takes a domain name example.com or wordlist as input and cycles through likely S3 bucket names example.s3.amazonaws.com looking for any world-read/writeable buckets. S3 buckets are a great find for...

verizonconnect.com XSS vulnerability

Open Bug Bounty ID: OBB-669436 Description| Value ---|--- Affected Website:| verizonconnect.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M

Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses. According to a lawsuit filed...

Supreme Court: Police Need Warrant for Mobile Location Data

The U.S. Supreme Court today ruled that the government needs to obtain a court-ordered warrant to gather location data on mobile device users. The decision is a major development for privacy rights, but experts say it may have limited bearing on the selling of real-time customer location data by...

Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site

LocationSmart, a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site -- without the need for any password or other form of authentication or...

Ransomware Dominates Verizon DBIR

Ransomware has become the most prevalent malicious software as hackers cash in on locking up expensive business critical systems and demanding a ransom, researchers warn. Verizon’s 2018 Data Breach Investigations Report DBIR, released Tuesday, said that ransomware attacks have doubled over the pa...

Supporters of Net Neutrality Vow to Fight Rule Changes

The repeal of network neutrality rules inched closer to reality on Thursday when the Federal Communications Commission submitted into the Federal Registry its controversial replacement called the Restoring Internet Freedom order. Opponents say the new order will create powerful internet gatekeepe...

The seven most colossal data breaches of 2017

By Logan Strain If it seems like the words “leak,” “compromised data,” and “breach” are constantly in the news, it’s not just you. The frequency of major data breaches is increasing. According to the Identity Theft Resource Center, the number of breaches is expected to top 1,500 in 2017. That’s a...

verizonwireless.com XSS vulnerability

Vulnerable URL: https://www.verizonwireless.com/connected-devices/hum-by-verizon/?alert/OPENBUGBOUNTY/...

devices.verizonwireless.com XSS vulnerability

Open Bug Bounty ID: OBB-422603 Description| Value ---|--- Affected Website:| devices.verizonwireless.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

Bo Knows Security – Whiteboard Wednesday [Video]

October is National Cyber Security Awareness Month NCSAM and to address this week's theme of "Cybersecurity in the Workplace is Everyone’s Business" our Whiteboard Wednesday this month features Bo Kim, head of information security at Imperva. When it comes to building a security program, focusing...

2013 Yahoo Breach Affected All 3 Billion Accounts

A massive breach of Yahoo’s systems in 2013 impacted every account in existence at the time, the company said last night in a new filing with the Securities and Exchange Commission. Yahoo disclosed the breach last December when it revealed that it believed 1 billion accounts were compromised. Las...

Verizon Wireless Internal Credentials, Infrastructure Details Exposed in Amazon S3 Bucket

Organizations continue to leak data through publicly accessible Amazon S3 buckets, pointing a harsh finger at continued lax attitudes toward the custodianship of sensitive data. Verizon is the latest business affected by this epidemic, leaking in this case files marked confidential from an intern...

Thousands of Elasticsearch Servers Hijacked to Host PoS Malware

Thousands of insecure Elasticsearch servers are hosting point-of-sale malware, according to an analysis by Kromtech Security Center. In total, researchers found 15,000 insecure Elasticsearch servers with 27 percent 4,000 hosting the PoS malware strains Alina and JackPoS. “The absence of...

A week in security (July 10 – July 16)

Last week, we took a look at some of your malware infection stories, took a stroll through the basics of PowerShell, explored a piece of .NET malware, and shone the spotlight on the Petya ransomware family. Elsewhere, the following stories were taking place: Latest updates for Consumers...

On the Verizon breach, Oracle, and EternalBlue

Mike Mimoso and Chris Brook discuss the news of the week, including the Verizon breach, the Oracle session hijacking attack, a Telegram-based hacking tool, and a new, free EternalBlue scanner. Show notes: Vulnerabilities Expose Oracle OAM 10g to Remote Session Hijacking Telegram-Controlled Hackin...

Third Party Exposes 14 Million Verizon Customer Records

As many as 14 million U.S.-based Verizon customers have had their data exposed by a partner of the telecommunications giant, which misconfigured a repository storing the personal information it had access to. UpGuard director of cyber risk research Chris Vickery, who has made a living of finding...

Over 14 Million Verizon Customers' Data Exposed On Unprotected AWS Server

Verizon, the major telecommunications provider, has suffered a data security breach with over 14 million US customers' personal details exposed on the Internet after NICE Systems, a third-party vendor, mistakenly left the sensitive users’ details open on a server. Chris Vickery, researcher and...