mail.huntbrothers.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1179763 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Alleged Hacker Behind Massive ‘Collection 1’ Data Dump Arrested

A hacker accused of selling hundreds of millions of stolen credentials from last year’s “Collection 1” data dump on the dark web has been arrested in the Ukraine. The Security Service of Ukraine SSU took into custody a threat actor known as “Sanix,” who they claim posted 773 million e-mail...

HackerOne: How the Bug stole hacking

In light of the season - here's a story I wrote for you: Every hacker down in Hackerone liked hacking alot, But the Bug who lived down in the source code, did not! The Bug hating hacking! The whole Bug-hunt season! Now please don’t ask why. No one quite knows the reason. It could be perhaps, that...

CISO MAG Honors KrebsOnSecurity

CISO MAG, a publication dedicated to covering issues near and dear to corporate chief information security officers everywhere, has graciously awarded this author the designation of "Cybersecurity Person of the Year" in its December 2019 issue. KrebsOnSecurity is grateful for the unexpected honor...

CVE-2013-1391: Improper Authentication

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration...

PT-2019-6845

Name of the Vulnerable Software and Affected Versions Hunt CCTV affected versions not specified Capture CCTV affected versions not specified Hachi CCTV affected versions not specified NoVus CCTV affected versions not specified Well-Vision Inc DVR systems affected versions not specified Descriptio...

Google Adds Password Checkup Feature to Chrome Browser

Google will soon alert Chrome browser users of weak or compromised passwords. The checks will be in real time as Chrome users visit a password protected website. Bad passwords will trigger a red dialogue box alerting users to take action to better protect their account. The move integrates a...

Senate Passes Bill Aimed At Combating Ransomware Attacks

The U.S. Senate has approved new legislation aimed at helping government agencies and private-sector companies combat ransomware attacks. The legislation comes as local governments and schools continue to be hit by sophisticated – and in some cases coordinated – ransomware attacks. The proposed...

HELK - The Hunting ELK

The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed...

Troy Hunt Looks to Sell Have I Been Pwned

Citing overwhelming demands on his time, Troy Hunt is looking for a buyer for his site, Have I Been Pwned HIBP. HIBP offers a free service for consumers wanting to know if their user names and passwords have been compromised in a data breach; it also offers commercial services that include alerts...

Malwarebytes Labs wins best cybersecurity vendor blog at InfoSec’s European Security Blogger Awards

Infosec Europe is now well underway, and last night was the annual EU Security Blogger Awards, where InfoSecurity Magazine: …recognises the best blogs in the industry as first nominated by peers and then judged by a panel of mostly respected industry experts. Malwarebytes Labs was announced as...

Google Maps help Police catch serial masturbator after 4-year hunt

By Carolina An alleged "serial masturbator" who has been causing disturbance among citizens around Brisbane’s inner-city for the past four years has finally been caught by the Queensland Police thanks to Google Maps. Google Maps: Hubby divorces wife after finding her on Street View with another m...

773M Password ‘Megabreach’ is Years Old

My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessl...

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online ch...

Troy Hunt on Passwords

Troy Hunt has a good essay about why passwords are here to stay, despite all their security problems: This is why passwords aren't going anywhere in the foreseeable future and why insert thing here isn't going to kill them. No amount of focusing on how bad passwords are or how many accounts have...

Public Shaming of Companies for Bad Security

Troy Hunt makes some good points, with good examples...

What ‘Nightingale Floors’ From Historical Japan Can Teach Us About Intrusion Suppression

Multinational corporations are under siege from a multiplicity of threat actors. The cyber arms bazaar that flourishes around the world has allowed for criminals and nations to wage long-term campaigns against corporations and government agencies. These cyber criminals stalk businesses and...

Revamp of ‘Pwned Passwords’ Boosts Privacy and Size of Database

Researcher Troy Hunt announced a major revamp of his Pwned Passwords tool that includes more passwords, added features and tightened privacy for organizations who want to check if their in-use passwords can easily be cracked. In V2 of Pwned Passwords, launched last week, Hunt updated his password...

Leaky RootsWeb Server Exposes Some Ancestry.com User Data

Ancestry.com said it closed portions of its community-driven genealogy site RootsWeb as it investigated a leaky server that exposed 300,000 passwords, email addresses and usernames to the public internet. In a statement issued over the weekend, Chief Information Security Officer of Ancestry.com...

Hacked Password Service Leakbase Goes Dark

Leakbase, a Web site that indexed and sold access to billions of usernames and passwords stolen in some of the world largest data breaches, has closed up shop. A source close to the matter says the service was taken down in a law enforcement sting that may be tied to the Dutch police raid of the...