Fappening 2017: More Celebrity Photos Hacked and Leaked Online

It seems like celebrities have not taken their security seriously, which once again resulted in the leaking of personal photographs of more a-listed celebrities. Dozens of personal and intimate photos of Anne Hathaway, Miley Cyrus, Kristen Stewart, Katharine McPhee, golfer Tiger Woods and his ex...

Gmail for iOS Adds Anti-Phishing Feature that Warns of Suspicious Links

Phishing — is an older style of cyber-attack but remains one of the most common and efficient attack vectors for attackers, as a majority of banking malware and various ransomware attacks begin with a user clicking on a malicious link or opening a dangerous attachment in an email. Phishing has...

Certificate Based Authentication : Troubleshooting steps

3. . If the value forDS Mapper usage isDisabled , run the following command to enable it: netsh http add sslcert ipport=0.0.0.0:443 certhash=20c70a6c6e66c3f82cf6098b7bcd2859486ecd10 appid=4dc3e181-e14b-4a21-b022-59fc669b0914 certstorename=my verifyclientcertrevocation=Enable...

CopyKittens Exposed by ClearSky and Trend Micro

CopyKittens is a cyberespionage group that ClearSky has been reporting on since 2015, tracking their attacks on government-related bodies around the world. Trend Micro has supported this research at several points, including for their latest report released today on the group’s vast espionage...

How to sacrifice security using a public YubiKey Linux guides

This month I moved to YubiKey as a authentication token for my personal daily usage. One of the convents applications of this device it’s a login screen authentication. I found some popular guides how to use YubiKey with a Linux lock screen tools and these guides surprised me. Please find these...

Nextcloud: Password of failed (2FA) login attempt is stored in log

If I try to log in on Webdav with my usual Nextcloud password, it doesn't work due to 2FA. I need an application password. The password of a failed login attempt by any user is stored plain text in the log: ...OCA\\DAV\\Connector\\Sabre\\Auth-validateUserPass'matthes', 'THEPASSWORD'... Even...

Telegram 4.0.1 Two Factor Authentication Bypass Vulnerability

Exploit for multiple platform in category remote exploits Title: =============== Telegram 4.0.1 - "TwoFactor Authentication" ByPass 0day Author: =============== Shahab Shamsi Vendor Homepage =============== https://telegram.org/ Date: =============== 2017-06-25 Exploitation-Technique:...

Telegram 4.0.1 Two Factor Authentication Bypass

Title: =============== Telegram 4.0.1 - "TwoFactor Authentication" ByPass 0day Author: =============== Shahab Shamsi Vendor Homepage =============== https://telegram.org/ Date: =============== 2017-06-25 Exploitation-Technique: =============== Local,Remote References: =============== Video1:...

Enterprise Security: EAA Exceeds Compliance Standards

I sat down again with John Payne, Akamai's Chief Architect of Infrastructure and Security, as well as Keith Hillis, Director IT Risk & Security. We spoke about enterprise security compliance, and how Enterprise Application Access EAA exceeds Akamai's requirements and simplifies the process for...

FTC Recommends Steps to Protect Against Mobile Phone Theft

The Federal Trade Commission FTC has released an alert about the theft of mobile phones and the best way to prepare for and recover from this kind of theft. Precautionary steps include regularly backing up the data on the phone, using strong passwords, and using two-factor authentication on any...

FreeBSD : duo -- Two-factor authentication bypass (738e8ae1-46dd-11e7-a539-0050569f7e80)

The duo security team reports : An untrusted user may be able to set the httpproxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success. %NASLMINLEVEL 70300 C Tenable...

Should SaaS Companies Publish Customers Lists?

A few weeks back, HR and financial management firm Workday.com sent a security advisory to customers warning that crooks were sending targeted malware phishing attacks at customers. At the same time, Workday is publishing on its site a list of more than 800 companies that use its services, making...

duo -- Two-factor authentication bypass

The duo security team reports: An untrusted user may be able to set the httpproxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success...

Is Your Security Team Setup To Fail?

The ingredients for strong cybersecurity aren’t a secret. In fact, they haven’t changed significantly over the past 20 years—the ingredients are available to almost every organization out there. On the surface, doing security isn’t that hard: | Patch quickly and frequently. Use reasonable securit...

SSA.GOV To Require Stronger Authentication

The U.S. Social Security Administration will soon require Americans to use stronger authentication when accessing their accounts at ssa.gov. As part of the change, SSA will require all users to enter a username and password in addition to a one-time security code sent their email or phone. In thi...

Criminals are Now Exploiting SS7 Flaws to Hack Smartphone Two-Factor Authentication Systems

I've previously written about the serious vulnerabilities in the SS7 phone routing system. Basically, the system doesn't authenticate messages. Now, criminals are using it to hack smartphone-based two-factor authentication systems: In short, the issue with SS7 is that the network believes whateve...

Warning! Don't Click that Google Docs Link You Just Received in Your Email

Did someone just share a random Google Doc with you? First of all — Do not click on that Google Doc link you might have just received in your email and delete it immediately — even if it's from someone you know. I, my colleagues at The Hacker News, and even people all around the Internet,...

A Storm’s a Coming: How businesses can defend against threat actor groups like Pawn Storm

Pawn Storm aka Sednit5, Fancy Bear, APT28, Sofacy and STRONTIUM8 might sound like Instagram accounts, top-secret spy programs or recently passed legislation, but in reality they are all different names for the same successful cyber espionage group or threat actor group. These actors often use...

Microsoft Touts New Phone-Based Login Mechanism

It likely won’t mark the death knell of passwords but Microsoft announced this week its giving users a new way to sign into their accounts without having to enter a lengthy combination of numbers, letters and characters. The feature, which relies on users having access to their mobile phones, is...

Evilginx - MITM Attack Framework [Advanced Phishing With Two-factor Authentication Bypass]

Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes proxypass and subfilter to proxy and modify HTTP content, while intercepting traffic between client and server. You can learn...