Attackers Can Track Kids' Locations via Connected Watches

Despite ongoing warnings about connected watches and toys endangering kids’ privacy and potentially their physical safety, makers of these Internet of Things gadgets continue to turn out products that do just that. The latest concern is a gamut of kids’ GPS-tracking watches, which were found to b...

Apple Blasts Facebook Over Data-Sucking 'Research' App

Apple has revoked Facebook’s enterprise iOS developer certificate on the heels of a “Facebook Research” VPN app that was being distributed to consumers; the app paid teens and Millennial users in exchange for being able to track their phone and web activity, and has been available since 2016. App...

How CB LiveOps Helps with Incident Response

Security and IT Operations teams often have no reliable way to assess the current state of endpoints across their enterprise, leading to increased risk of breach, inability to make informed remediation decisions, and unnecessary spending on infrastructure maintenance. A real-time endpoint query a...

GPS watch issues… AGAIN

Over the last year of looking at kids GPS tracking watches we have found some staggering issues. With these devices it almost seems that having multiple security issues is the new normal. While parents and guardians may get a feeling of security from using these devices, our testing and research...

Dailymotion Fights Ongoing Credential-Stuffing Attack

Dailymotion, the video-sharing platform, said Friday that it had fallen victim to a “large-scale” and ongoing credential-stuffing assault by attackers looking to harvest user data. The French YouTube competitor said in an alert that it has “successfully contained the attacks following the...

Threatpost News Wrap Podcast For Jan. 25

Threatpost editors Tom Spring, Tara Seals and Lindsey O’Donnell discuss the biggest news from this week. That includes a rare “emergency directive” issued by the Department of Homeland Security on Tuesday, which warned that multiple government domains have been targeted by DNS hijacking attacks...

U.S. Dept Of Defense: Information Disclosure (can access all ███s) within ███████ view █████████ Portal

Summary: Once ███████ authenticated I did not mess around to see if I could reproduce without authentication, any user can view any ██████████ simply by changing the offasgid HTTP GET parameter value in the ██████ view █████████ portal link. Description: I was looking through my previous ███████s...

Joomla! vBizz 1.0.7 Code Execution

Exploit Title: Joomla! Component vBizz 1.0.7 - Remote Code Execution Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link: https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/ Version: 1.0.7 Category: Webapps Tested on:...

Collection 1 data breach: what you need to know

Yesterday, news broke that the largest data dump in history had been discovered, with more than 770 million people's Personally Identifiable Information PII decrypted, catalogued, and up for grabs on the Internet. The files, which are being dubbed Collection 1, were originally found on cloud...

Threatpost News Wrap Podcast For Jan. 18

Exposed personal data seemed to be the big trend this week, which was overshadowed by Troy Hunt’s discovery of a database of breached emails totaling 773 million unique addresses in a popular cloud service. Millions of sensitive files on a storage server belonging to the Oklahoma Department of...

Twitter Android Glitch Exposed Private Tweets for Years

Twitter disclosed a security issue on Thursday that had exposed protected tweets on Android devices – for more than four years. According to the social media giant, if Twitter users on the Android operating system made specific changes to their account settings – like changing the email address...

773M Password ‘Megabreach’ is Years Old

My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessl...

Cyber-Jackpot: 773M Credentials Dumped on the Dark Web

UPDATE A database of breached emails totaling 773 million unique addresses has turned up on a popular underground hacking forum, giving cybercriminals one of the largest jackpots ever seen when it comes to account-compromise efforts. Troy Hunt was first alerted to the cache, which totals 87GB of...

773 million records with emails & plain text passwords leaked online

By Waqas It's a whopping 87GB data - Find out if you are affected by the massive data breach. Security researcher and founder of Have I Been Pwned, Troy Hunt, has revealed that around 773 million ‘unique’ email IDs and 22 million ‘unique’ passwords were available on MEGA cloud service. Later on,...

Unprotected Government Server Exposes Years of FBI Investigations

A massive government data belonging to the Oklahoma Department of Securities ODS was left unsecured on a storage server for at least a week, exposing a whopping 3 terabytes of data containing millions of sensitive files. The unsecured storage server, discovered by Greg Pollock, a researcher with...

An Astonishing 773 Million Records Exposed in Monster Breach

Collection 1 appears to be the biggest public breach yet, with millions of unique passwords sitting out in the open...

Millions of Oklahoma Gov Files Exposed by Wide-Open Server

Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades. Researchers at UpGuard who discovered the data leak said that the publicly accessible...

CVE-2019-2450

CVE-2019-2450 affects Oracle VM VirtualBox (Core) with affected versions prior to 5.2.24 and prior to 6.0.2. The issue is exploitable by a low-privilege user that can log on to the infrastructure where VirtualBox runs, potentially leading to unauthorized access to data or complete access to data ...

CVE-2019-2400

CVE-2019-2400 affects Oracle E-Business Suite, specifically the Oracle iStore User Registration subcomponent. Affected versions include 12.1.1–12.2.8. The vulnerability is exploitable by an unauthenticated attacker who can reach Oracle iStore over HTTP; however, user interaction is required for e...

CVE-2019-2446

CVE-2019-2446 affects Oracle VM VirtualBox (Core) with vulnerable OpenGL/guest-VM handling prior to 5.2.24 and prior to 6.0.2. Exploitation could allow a low-privileged user with logon to the host infrastructure to access or compromise data within VirtualBox. Public advisories from OpenSUSE/Magei...