Cyberattacks Hit Thousands of Canadian Tax, Benefit Accounts

Canadian authorities said almost 15,000 online accounts for various government services have been targeted in three recent waves of credential-stuffing attacks. These accounts could give attackers access to Canadians’ tax-related and benefits information, coronavirus relief fund money and more...

Have I Been Pwned Set to Go Open-Source

Have I Been Pwned, the service that logs data breaches and lets individuals search to see if they’ve been affected by one, is about to go open-source. The result of that, according to its founder, will be additional transparency and security-enhancing features. HIBP, which was kicked off in 2013,...

Kasa camera flaw allows enumerating usernames for credential stuffing

By Sudais Asif The hacker who happens to be a hobbyist farmer and Kasa camera... This is a post from HackRead.com Read the original post: Kasa camera flaw allows enumerating usernames for credential stuffing...

Popular TP-Link Family of Kasa Security Cams Vulnerable to Attack

A popular consumer-grade security camera made by TP-Link and sold under the Kasa brand has bevy of bugs that open the hardware to remote attacks, such as giving hackers access to private video feeds and the ability to change device settings. The researcher Jason Kent, with Cequence Security,...

Mitigating Credential Stuffing Attacks in the Financial Sector

If You Think Multi-Factor Authentication Prevents Credential Stuffing, Think Again! Financial services firms around the world are experiencing credential stuffing attacks at an alarming rate. Cybercriminals are using readily available automation tools, botnets, and compromised account credentials...

Minneapolis Police Department Hack Likely Fake, Says Researcher

As protests continue to proliferate across the globe in the wake of George Floyd’s death, the Minneapolis Police Department is making news for something else: A supposed hack, perpetrated at the hands of the Anonymous hacktivist group. According to Troy Hunt at Have I Been Pwned HIBP, the group o...

Millions of Brute-Force Attacks Hit Remote Desktop Accounts

A rash of brute-forcing attempts aimed at users of Microsoft’s proprietary Remote Desktop Protocol RDP has come to light, striking millions per week. The attacks are a likely offshoot of cybercriminals looking to take advantage of the unprecedented numbers of employees working from home amid the...

Dark Nexus: A New Emerging IoT Botnet Malware Spotted in the Wild

Cybersecurity researchers have discovered a new emerging IoT botnet threat that leverages compromised smart devices to stage 'distributed denial-of-service' attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. The botnet, named "darknexus" by Bitdefender...

Dark Nexus: A New Emerging IoT Botnet Malware Spotted in the Wild

Cybersecurity researchers have discovered a new emerging IoT botnet threat that leverages compromised smart devices to stage 'distributed denial-of-service' attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. The botnet, named "darknexus" by Bitdefender...

Akamai Talks Massive Uptick in Credential-Stuffing Attacks Against Bank APIs

Cybercriminals continue to firehose financial services companies with new and innovative cyberattacks. Research from Akamai recently found that up to 75 percent of all credential abuse attacks against the financial services industry in 2019 targeted APIs directly rather than user-facing login...

Akamai Talks Massive Uptick in Credential-Stuffing Attacks Against Bank APIs

Cybercriminals continue to firehose financial services companies with new and innovative cyberattacks. Research from Akamai recently found that up to 75 percent of all credential abuse attacks against the financial services industry in 2019 targeted APIs directly rather than user-facing login...

Spread of Coronavirus-Themed Cyberattacks Persists with New Attacks

As the coronavirus blows up into a worldwide pandemic, threat actors continue to exploit the disease to spread malware. Just this week, cybersecurity professionals identified a bevy of new threats ranging from coronavirus-themed malware attacks, booby-trapped URLs and credential stuffing scams. O...

Spread of Coronavirus-Themed Cyberattacks Persists with New Attacks

As the coronavirus blows up into a worldwide pandemic, threat actors continue to exploit the disease to spread malware. Just this week, cybersecurity professionals identified a bevy of new threats ranging from coronavirus-themed malware attacks, booby-trapped URLs and credential stuffing scams. O...

Fill your Boots with credential stuffing protections

Yet again another company suffers a ‘hack’ that turns out to be nothing more than a credential stuffing attack. This time Boots have stopped customers using advantage card points to pay for products. This is after 600,000 Tesco accounts were compromised in the same way. No systems at Boots were...

Zynga Faces Lawsuit Over Massive Words with Friends Breach

Mobile game developer Zynga could face a class-action lawsuit stemming from a massive data breach last September, which impacted 218 million users of the Words with Friends mobile app. The news comes as other big names face security incidents: T-Mobile and Carnival Cruise Lines have admitted this...

Loyalty Cards Targeted in Tesco Clubcard Attack

U.K. supermarket giant Tesco is warning on a credential-stuffing attack that potentially affects 600,000 members of its Clubcard loyalty program. It said that it detected cybercriminals trying out different name and password combos, gleaned from a database of stolen usernames and passwords for...

Nord Security: Sensitive Information Disclosure on https://nordvpn.com/

The researcher provided us with a URL where there was a list of NordVPN accounts posted. We want to assure that our service, our users' data is still secure – as far as our website and service are concerned. This is a global issue in cyberspace where hackers know that most users don't bother to s...

FC Barcelona Suffers Likely Credential-Stuffing Attack on Twitter

Just ahead of its Champion’s League Round of 16 appearance next week, FC Barcelona’s official Twitter account was hacked in an apparent credential-stuffing attack. The strike resulted in account takeover and bogus tweets being sent out. The hacking collective known as OurMine, which made headline...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...

Online Holiday Shopping followed the Hot Topics of 2019: Mobile & Security

Here's what I learned this past holiday season: I'm not alone shopping on my mobile device on Christmas Day and Boxing Day. And while Hollywood actors may take the holidays off, threat actors certainly do not. Let's have a look at some of the numbers. Akamai has a lot of data, but let's look at...