Auth0 Glitch Allows Attackers to Launch Phishing Attacks

UPDATE Researchers are warning of a glitch in the Auth0 identity-as-a-service offering, which could allow bad actors to spoof a legitimate website and collect sensitive information from visitors. Researchers at Imperva on Tuesday found that the subdomain names of Auth0 are susceptible to security...

Liberapay: REGISTRATION USING FAKE EMAIL ACCOUNT

Go to page https://liberapay.com/sign-up 2. Input email address I tried to register with some email address [email protected] [email protected] [email protected] [email protected] [email protected] 3. Select the currency you want to use 4. click "GO" button 5. Will automatically enter into account without going through the process of verification email...

2018 Fraud World Cup

There are only two weeks to go before the start of the massive soccer event — FIFA World Cup. This championship has already attracted the attention of millions worldwide, including a fair few cybercriminals. Long before kick-off, email accounts began bulging with soccer-related spam, and scammers...

Reverb.com: Items bought for free due to lacks of quantity controls

Hi, The server fails to check the quantity of the items that are going to be sell. Values = 0 are accepted as 1. PoC: Go here https://sandbox.reverb.com/fr/item/139897-fender-2-strap-leather-test-2018-leather Intercept the response after clicking "Add to cart" and put "quantity: 0" F302179 Procee...

3 Charged In Fatal Kansas ‘Swatting’ Attack

Federal prosecutors have charged three men with carrying out a deadly hoax known as "swatting," in which perpetrators call or message a target's local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target's address -- with the expectation that local police may...

Fake Malwarebytes helpline scammer caught in the act

An estimated one in every 10 American adults lost money in a cyber scam in the past 12 months, according to a report released by the FTC earlier in the month. On average, each scam victim lost $430, totaling about $9.5 billion overall. To put this in perspective, that’s over 22 million Americans...

CVE-2018-10825

Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy BLE communication from a Turtle to a Lilypad, which allows attackers to inject fake information about the position and temperature of a baby via a replay or spoofing attack...

A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely...

Airline Ticket Fraud

New research: "Leaving on a jet plane: the trade in fraudulently obtained airline tickets:" Abstract: Every day, hundreds of people fly on airline tickets that have been obtained fraudulently. This crime script analysis provides an overview of the trade in these tickets, drawing on interviews wit...

Netflix phish claims your membership is on hold

The days of ugly-looking phish pages hosted on something akin to a Geocities page are slowly receding into the distance. For quite some time now, phish attacks have made attempts to look fairly sophisticated and stand a decent chance of fooling anyone not keeping their guard up. Today, we have a...

Mobile Menace Monday: re-emergence of a fake Android AV

Back in early 2013, a new mobile antivirus AV company called Armor for Android emerged into the mobile security software industry that had everyone perplexed. It seemed eerily like malware known as a Fake AV, and some even gave it that label. As a younger mobile researcher, I was one of those who...

Over 20 Million Users Installed Malicious Ad Blockers From Chrome Store

If you have installed any of the below-mentioned Ad blocker extension in your Chrome browser, you could have been hacked. A security researcher has spotted five malicious ad blockers extension in the Google Chrome Store that had already been installed by at least 20 million users. Unfortunately,...

Tens of thousands per Gram

Looking at Instagram one morning, I spotted several posts from some fairly well-known people in certain circles who had invested in an ICO held by Telegram. Interesting, I thought to myself. I fancy a piece of that. Only I was pretty sure that if Telegram was indeed holding an ICO, it would be a...

A Sobering Look at Fake Online Reviews

In 2016, KrebsOnSecurity exposed a network of phony Web sites and fake online reviews that funneled those seeking help for drug and alcohol addiction toward rehab centers that were secretly affiliated with the Church of Scientology. Not long after the story ran, that network of bogus reviews...

Over 20 million Chrome users have installed fake malicious Ad Blockers

By Waqas Ad Blockers play a vital role in hurting the earnings This is a post from HackRead.com Read the original post: Over 20 million Chrome users have installed fake malicious Ad Blockers...

Facebook Graph Metadata Crosswalk Mapping Proof Of Concept

!/usr/bin/perl Facebook 'Graph' metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate facebook users with fake news...

Facebook Graph Phone Number Metadata Crosswalk Mapping Proof Of Concept

!/usr/bin/perl Facebook 'Graph' Phone Number metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate facebook users...

Fake Chrome & Firefox browser update lead users to malware infection

By Waqas Another day, another malware scam - This one uses Chrome This is a post from HackRead.com Read the original post: Fake Chrome & Firefox browser update lead users to malware infection...

Roblox: Subdomain Takeover to Authentication bypass

Vulnerability Type: ----------- Subdomain Takeover Description: ----------- Due to unclaimed or expired Hubspot instance an attacker is able to claim and serve content from devrel.roblox.com and perform different kind of attacks which i shared in impact section. Affected Area: -----------...

Fake Software Update Abuses NetSupport Remote Access Tool

Over the last few months, FireEye has tracked an in-the-wild campaign that leverages compromised sites to spread fake updates. In some cases, the payload was the NetSupport Manager remote access tool RAT. NetSupport Manager is a commercially available RAT that can be used legitimately by system...