Insurance Customers’ Personal Data Exposed Due to Misconfigured NAS Server

Detailed personal information from thousands of insurance customers in Maryland–as well as login credentials for a massive national insurance claims database–was exposed due to an an open port on a NAS server. The misconfiguration exposed a wealth of information on Maryland Joint Insurance...

Leaky Amazon S3 Bucket Exposes Personal Data of 12,000 Social Media Influencers

An erroneously configured Amazon S3 Simple Storage Service bucket managed by Paris marketing firm Octoly left contact information and personal details for more than 12,000 social media influencers. Octoly connects popular Instagram, Twitter and YouTube users with companies that provide them...

Registered at SSA.GOV? Good for You, But Keep Your Guard Up

KrebsOnSecurity has long warned readers to plant your own flag at the my Social Security online portal of the U.S. Social Security Administration SSA -- even if you are not yet drawing benefits from the agency -- because identity thieves have been registering accounts in peoples' names and...

Razer US: SQL Injection on careers.razerzone.com within the Admin interface without any access credentials

The researcher discovered a SQL Injection vulnerability on our careers.razerzone.com host, which is used to list job openings for Razer worldwide and receive application submissions from potential hires. This vulnerability could have allowed the exfiltration of admin credentials as well as person...

Nissan Finance Canada Suffers Data Breach — Notifies 1.13 Million Customers

It's the last month of this year, but possibly not the last data breach report. Nissan warns of a possible data breach of personal information on its customers who financed their vehicles through Nissan Canada Finance and INFINITI Financial Services Canada. Although the company says it does not...

Pursuing The Right to be Left Alone

The three pillars of privacy, defined in “The Right to Privacy” 4 Harvard L.R. 193 Dec 15, 1890, are 1 the right to know what information is gathered about you, 2 the right to know how it will be used, and 3 the right to be left alone. The European Union has incorporated these principles into the...

Zomato: User Profiles Leak PII in HTML Document for Mobile Browser User Agents

@chriszielinski found that user personal information was leaking when you make a request using mobile user agent...

Dangerous liaisons

It seems just about everyone has written about the dangers of online dating, from psychology magazines to crime chronicles. But there is one less obvious threat not related to hooking up with strangers – and that is the mobile apps used to facilitate the process. We're talking here about...

Yet more mobile adware found in Google Play

Finding an adware variant that made its way past the Google Play store is out of the ordinary. So when two adware variants slip by in one week, we take notice. Last week, we added two new Ad SDKs to our growing list of adware detections—Adware.Solid and Adware.Cootek. Both Ad SDKs were found in a...

Today’s Predictions for Tomorrow’s Internet

This weekend I realized just how much the future of securing the Internet of Things IoT will become a critical component to maintain our lifestyle. CyberPatriot is the National Youth Cyber Education Program created by the Air Force Association to encourage careers in STEM. Each year the program...

Equifax Breach Fallout: Your Salary History

In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment...

Grab: stored xss in comments : driver exam

@pareshparmar found a Stored XSS vulnerability in an out-of-scope third party web application use by Grab. We decided to make an exception of our bug bounty policy here and accepted this out-of-scope finding because we believed that the stored-XSS was a real risk for our customers. With the...

Fear Not: You, Too, Are a Cybercrime Victim!

Maybe you've been feeling left out because you weren't among the lucky few hundred million or billion who had their personal information stolen in either the Equifax or Yahoo! breaches. Well buck up, camper: Both companies took steps to make you feel better today. Yahoo! announced that, our bad!:...

October is National Cybersecurity Awareness Month

October is National Cybersecurity Awareness Month NCSAM. NCSAM is a collaborative effort between DHS and its public and private partners--including the National Cyber Security Alliance NCSA--to raise awareness about the vital role cybersecurity plays in the lives of U.S. citizens. US-CERT will be...

The Data Tinder Collects, Saves, and Uses

Under European law, service providers like Tinder are required to show users what information they have on them when requested. This author requested, and this is what she received: Some 800 pages came back containing information such as my Facebook "likes," my photos from Instagram even after I...

Zomato: [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint

Hacker is able to get the PIPersonal Information of any Zomato user...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime community. The actual version of the product is...

Hacker Who Hacked US Spy Chief, FBI & CIA Director Gets 5-Year in Prison

Remember "Crackas With Attitude"? The hacking group behind a series of embarrassing hacks that targeted personal email accounts of senior officials at the FBI, the CIA, and the White House, among other United States federal agencies in 2015. A member of Crackas With Attitude, who was arrested las...

Equifax Data Breach: Steps You should Take to Protect Yourself

Equifax has suffered one of the largest data breaches in history that has left highly sensitive data of as many as 143 million people—that's nearly half of the US population—in the hands of hackers. Based on the company's investigation, some unknown hackers managed to exploit a security flaw on t...

Breach at Equifax May Impact 143M Americans

Equifax, one of the "big-three" U.S. credit bureaus, said today a data breach at the company may have affected 143 million Americans, jeopardizing consumer Social Security numbers, birth dates, addresses and some driver's license numbers. In a press release today, Equifax NYSE:EFX said it...