TeenSafe Tracking App Exposes Thousands of Private Records

Thousands of accounts for TeenSafe, which is a mobile app that parents can use to monitor what their kids are doing online, have been exposed in the latest Amazon Web Services cloud misconfiguration. According to a report from ZDNet, which verified the data breach, there were at least two servers...

Are VPNs a thing of the past?

Attention world: In 2018, we officially surpassed 4 billion internet users1 - and there are no signs of adoption rate slowing down. Yet the Internet as we know it has only been around since the 1990s. Along with it, different iterations of virtual private networks VPNs have been created and...

Facebook, GDPR and the Right to Privacy: Three’s a Crowd?

Back in 2016 the European Union voted to pass the mother of all security laws, aimed at further extending the rights of its citizens to control how their data is used. The General Data Protection Regulation GDPR guards users against having their information shared without their explicit consent,...

This Week in Security News: Hackers and Cyber Attackers

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Chili’s parent company – Brinker International – announced that consumer credit and debit card information had been compromised at some...

NodAPS 4.0 Cross Site Request Forgery / SQL Injection

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

Malicious Package

Overview Version 0.4.8 of s3asy contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.4.8 of this module is found installed you...

Indian Cricket Board Exposes Personal Data of Thousands of Players

By Waqas The IT security researchers at Kromtech Security Center discovered a trove This is a post from HackRead.com Read the original post: Indian Cricket Board Exposes Personal Data of Thousands of Players...

Sensitive myPersonality App Data of Millions of Facebook Users Exposed

By Carolina According to a startling new report, the University of Cambridge has This is a post from HackRead.com Read the original post: Sensitive myPersonality App Data of Millions of Facebook Users Exposed...

Chili’s Doesn’t Leave Data Breach on the Back Burner

Southwestern/Texas-themed restaurant chain Chili’s has become the latest victim of a data breach involving the heist of point-of-sale information from payment cards — and the alacrity with which it has admitted the incident is notable. Hackers had unauthorized access to payment-card data between...

Vega Stealer malware steals passwords & card data from Chrome & Firefox

By Waqas The IT security researchers at Proofpoint have discovered a new This is a post from HackRead.com Read the original post: Vega Stealer malware steals passwords & card data from Chrome & Firefox...

This Week in Security News: Exposure and Susceptibility

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, a new report revealed that the Equifax breach had a larger impact than previously thought. In addition, The Senate Intelligence Committee...

“Equi-Facts”: Equifax Clarifies the Numbers for Its Massive Breach

As companies continue to install the vulnerable version of Apache Struts behind the breach, Equifax has filed a clarification statement. The number of impacted U.S. consumers from the infamous 2017 Equifax data breach now totals about 147.9 million, and the breach has touched almost every adult i...

HackerOne: Timing attack towards endpoints on the web without CSRF

Summary: When logged in user on HackerOne visits another web page, remote web page could get conclusion regarding this data: - logged in user - number of triaged reports in the last month - number of new reports at the moment - number of closed reports ... This conclusions are only from one...

FBI Releases IC3 2017 Internet Crime Report

FBI has released the Internet Crime Complaint Center IC3 2017 Internet Crime Report, which highlights scams trending online. The top three crime types reported by victims in 2017 were non-payment/non-delivery, personal data breach, and phishing. Hot topics for 2017 include ransomware, business...

Man hacked 200 firms & sold data of millions of users on dark web

By Waqas Grant West, a cunning hacker who goes by the online This is a post from HackRead.com Read the original post: Man hacked 200 firms & sold data of millions of users on dark web...

This Week in Security News: Zippy’s and Flynn

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Hawaii-based restaurant Zippy’s suffered a POS data breach. In addition, Uber executive John Flynn argued that user expectations on data...

Man Who Hacked Jail Systems to Release His Friend Early Gets 7-Years in Prison

Remember a young hacker who hacked jail systems in an attempt to release his prison inmate early? Well, that hacker will now be joining his inmate behind bars. Konrads Voits of Ypsilanti, Michigan, has been sentenced to seven years and three months in prison for attempting to hack the Washtenaw...

KRACK Vulnerability Puts Medical Devices At Risk

A slew of devices from medical technology company Becton, Dickinson and Company BD are vulnerable to the infamous KRACK key-reinstallation attack, potentially enabling hackers to change and exfiltrate patient records. The KRACK vulnerability, discovered last October, is an industry-wide glitch in...

Uber: Cleartext password exposure allows access to the desafio5estrelas.com admin panel

Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site...

Uber Tightens Bug Bounty Extortion Policies

Uber is tightening policies around its bug-bounty program after a 2016 data breach exposed deep flaws in its policies around handling extortion. The ride-sharing company has updated its program to include clarity around the boundaries between research versus blackmail. The changes come after a 20...