Twitter Upgrades Account Security Features

Twitter has made a couple of changes to the service’s login process to help prevent account takeovers and enable users to reset their passwords in a simpler way. A Twitter account is among the more valuable assets for an attacker who is targeting a specific person. Accounts typically are tied to ...

Twitter Enables Password Reset With SMS and Suspicious Login Notifications

The popular social media site Twitter is rolling out a couple of new features to its login process to help users prevent their account in a more secure way and restore access to their account if they forget their accounts’ password. For tighten up the security measures Twitter is launching two...

Target Accelerates Chip-and-Pin Roll Out, Hires New CIO

As Target continues to deal with the consequences of its massive data breach last year, the company is accelerating plans to move to a full chip-and-pin system for its branded credit and debit cards, and also plans to have terminals capable of accepting chip-and-pin cards in all of its nearly 2,0...

2014 Verizon Data Breach Investigations Report DBIR

Most of us—hopefully—awaken every day, shower and brush our teeth. If you own a home, you patch a leaky roof and paint the shutters so they don’t rot. You own a vehicle, you change the oil when you’re supposed to and make sure the brakes work the way they’re supposed to. It’s simple hygiene. Yet ...

iBanking Android Malware targeting Facebook Users with Web Injection techniques

iBanking is nothing but a mobile banking Trojan app which impersonates itself as a so-called 'Security App' for Android devices and distributed through HTML injection attacks on banking sites, in order to deceive its victims. Recently, its source code has been leaked online through an underground...

Coinbase: 2 factor authentication design flaw

Hello, I keep getting redirected where to report this bug. Hopefully this will finally get the job done. I have attached a screenshot of the original bug report which can be found at https://coinbase.desk.com/customer/en/portal/private/cases/294281 Here are a few excerpts from the report to...

Data Breaches Show Difficulty of Defenders' Task

When attackers broke into the network of the University of Maryland last month, the university’s wasn’t sure how to react. The organization had never had a major security incident before, and this one qualified as major: 310,000 Social Security numbers and other information was gone. And then thr...

Gameover ZeuS Trojan Targets Users of Monster.com Employment Portal

Zeus Trojan is one of the most popular families of Banking Trojan, which was also used in a targeted malware campaign against a Salesforce.com customer at the end of the last month and researchers found that the new variant of Zeus Trojan has web crawling capabilities that are used to grab...

Android iBanking Trojan Source Code Leaked Online

Smartphone is the need of everyone today and so the first target of most of the Cyber Criminals. Malware authors are getting to know their market and are changing their way of operations. Since last year we have seen a rise in the number of hackers moving from the Blackhat into the Greyhat. The...

DuoSecurity Finds Two-Factor Authentication Vulnerability

Hosted two-factor authentication firm Duo Security acknowledged late last week that it discovered a vulnerability in its WordPress plugin duowordpress plugin that could allow a user to bypass two-factor authentication 2FA on a multisite network. Jon Oberheide, one of Duo’s founders, stressed last...

Self-XSS due to unescaped HTML output in import.

PMASA-2014-1 Announcement-ID: PMASA-2014-1 Date: 2014-02-15 Summary Self-XSS due to unescaped HTML output in import. Description When importing a file with crafted filename, it is possible to trigger an XSS. Severity We consider this vulnerability to be non critical. Mitigation factor This...

DUO-PSA-2014-004: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-004 Original Publication Date: 2014-02-12 Revision Date: 2014-03-27 Status: Confirmed, Fixed Document Revision: 3 Overview Duo Security has identified an issue in which it is possible to bypass second factor authentication of multisite...

SOL14969 - BIG-IP Edge and FirePass client information leakage vulnerability CVE-2013-6024

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Yahoo Mail hacked; Change your account password immediately

A really bad year for the world's second-largest email service provider, Yahoo Mail! The company announced today, 'we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts', user names and passwords of its email customers have been stolen and are used to access multip...

SpyEye creator pleads guilty in U.S Federal Court

Aleksandr Andreevich Panin, one of the alleged masterminds behind the notorious SpyEye banking trojan, pleaded guilty in an Atlanta courtroom yesterday to conspiracy charges relating to the development and distribution of the the malware. Panin pleaded guilty to conspiring to commit wire and bank...

DUO-PSA-2014-003: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-003 Publication Date: 2014-01-27 Status: Confirmed, Fixed Document Revision: 2 Overview Duo Security has identified an issue in which it is possible to bypass second factor authentication of Remote Desktop Protocol RDP integrations which are...

Solaris 10 (x86) : 145342-06 (deprecated)

Oracle Solaris Cluster 3.3: HA-Tomcat Patch for Oracle Solaris 10. Date this patch was last updated by Sun : Apr/19/17 This plugin has been deprecated and either replaced with individual 145342 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security,...

World’s largest Bitcoin Poker website hacked, 42000 user passwords leaked

World’s largest Bitcoin poker website 'SealsWithClubs' has been compromised and around 42,000 users' credentials are at risk. Seals With Club has issued a Mandatory Password Reset warning to their users, according to a statement published on the website. The service admitted their database had be...

Microsoft Protects User Accounts with New Security Features

Microsoft announced yesterday that it will complement the two-factor authentication it enabled for account holders in April with additional security features designed to deny account hijacking and unauthorized access. Windows PC and mobile users, along with Outlook, SkyDrive, Xbox, Skype and othe...

LinkedIn iOS app HTML Message Parsing Vulnerability

LinkedIn's iOS application is prone to a vulnerability that may permit remote attackers to execute arbitrary code. Security Researcher Zouheir Abdallah has disclosed HTML parsing vulnerability in LinkedIn iOS an app, that can be used to phish for credentials or be escalated into a full blown...