CVE-2015-7225

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...

CVE-2015-7225

Concretely, CVE-2015-7225 affects devise-two-factor prior to v4.0.2, where an OTP can be reused for one immediately trailing time interval due to an incomplete fix. Multiple connected records (e.g., CVE-2021-43177 references) confirm the vulnerability pattern and the remediation: upgrade to devis...

PT-2017-7164

Name of the Vulnerable Software and Affected Versions Tinfoil Devise-two-factor versions prior to 2.0.0 Description The issue arises from not strictly following section 5.2 of RFC 6238, which leads to not "burning" a successfully validated one-time password OTP. This allows attackers with a targe...

CVE-2015-7225: Undefined Security Weakness

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...

Problems of Vulnerability Prioritization and Detection

It’s the third part of our talk with Daniil Svetlov at his radio show “Safe Environment” recorded 29.03.2017. In this part we talk about Vulnerability Prioritization and Detection: Common Vulnerability Scoring System CVSS Environmental factor Manual and automated vulnerability detection...

Error: "32 authentication policies are already bound" While Binding Authentication Policy

When multiple policies two-factor are used for one virtual server with the total number of policies exceeding 32, there will be error message popping up "32 authentication policies are already bound"...

Instagram Hacker Puts 6 Million Celebrities Personal Data Up For Sale On DoxaGram

It's now official, Instagram has suffered a massive data breach, and reportedly an unknown hacker has stolen personal details of more than 6 million Instagram accounts. Just yesterday, we reported that Instagram had patched a critical API vulnerability that allowed the attacker to access phone...

Instagram Suffers Data Breach! Hacker Stole Contact Info of High-Profile Users

Instagram has recently suffered a possibly serious data breach with hackers gaining access to the phone numbers and email addresses for many "high-profile" users. The 700 million-user-strong, Facebook-owned photo sharing service has currently notified all of its verified users that an unknown...

Someone Hacked Selena Gomez Instagram, Shared Nude Justin Bieber Photos

The highest followers account on Instagram owned by Selena Gomez has recently been hacked with unknown hackers posting a bunch of nude photographs of her ex-boyfriend Justin Bieber on her account. The latest hack is not part of the ongoing Fappening events affecting a majority of celebrities by...

Fappening 2017: More Celebrity Photos Hacked and Leaked Online

It seems like celebrities have not taken their security seriously, which once again resulted in the leaking of personal photographs of more a-listed celebrities. Dozens of personal and intimate photos of Anne Hathaway, Miley Cyrus, Kristen Stewart, Katharine McPhee, golfer Tiger Woods and his ex...

XenMobile: Enroll with Two Factor and MAM login using CERT in XenMobile MAM only mode

The objective of this article is to help XenMobile administrators configure XenMobile 10.6 server, Enroll using Username + Password + PIN OTP and subsequent login with Certificate based authentication when XenMobile server is in MAM only mode, in Simple words: 1. You device will not be managed by...

Back to school cybersecurity tips for parents and kids

The time to start the new school term is just around the corner. And for parents, the excitement and anxiety may be palpable, especially if it's their kid's first time attending a new school. Ads for back-to-school gear start as early as July, increasing in frequency and urgency until the kiddos...

Gmail for iOS Adds Anti-Phishing Feature that Warns of Suspicious Links

Phishing — is an older style of cyber-attack but remains one of the most common and efficient attack vectors for attackers, as a majority of banking malware and various ransomware attacks begin with a user clicking on a malicious link or opening a dangerous attachment in an email. Phishing has...

Certificate Based Authentication : Troubleshooting steps

3. . If the value forDS Mapper usage isDisabled , run the following command to enable it: netsh http add sslcert ipport=0.0.0.0:443 certhash=20c70a6c6e66c3f82cf6098b7bcd2859486ecd10 appid=4dc3e181-e14b-4a21-b022-59fc669b0914 certstorename=my verifyclientcertrevocation=Enable...

CopyKittens Exposed by ClearSky and Trend Micro

CopyKittens is a cyberespionage group that ClearSky has been reporting on since 2015, tracking their attacks on government-related bodies around the world. Trend Micro has supported this research at several points, including for their latest report released today on the group’s vast espionage...

How Do SMEs Fight Off Cyberattacks?

I'd like to address some of the concerns that small and medium sized enterprises SMEs may have around cybersecurity, especially in the wake of the WannaCry ransomware attack and a continuous news flow around successful attacks on high profile companies. Does the fact that well-known brands are...

How to sacrifice security using a public YubiKey Linux guides

This month I moved to YubiKey as a authentication token for my personal daily usage. One of the convents applications of this device it’s a login screen authentication. I found some popular guides how to use YubiKey with a Linux lock screen tools and these guides surprised me. Please find these...

Zeus - AWS EC2 / S3 Auditing & Hardening Tool

Zeus is a powerful tool for AWS EC2 / S3 best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access Management Avoid the use of the "roo...

Nextcloud: Password of failed (2FA) login attempt is stored in log

If I try to log in on Webdav with my usual Nextcloud password, it doesn't work due to 2FA. I need an application password. The password of a failed login attempt by any user is stored plain text in the log: ...OCA\\DAV\\Connector\\Sabre\\Auth-validateUserPass'matthes', 'THEPASSWORD'... Even...

Telegram 4.0.1 Two Factor Authentication Bypass Vulnerability

Exploit for multiple platform in category remote exploits Title: =============== Telegram 4.0.1 - "TwoFactor Authentication" ByPass 0day Author: =============== Shahab Shamsi Vendor Homepage =============== https://telegram.org/ Date: =============== 2017-06-25 Exploitation-Technique:...