1940 matches found
FC Barcelona Suffers Likely Credential-Stuffing Attack on Twitter
Just ahead of its Champion’s League Round of 16 appearance next week, FC Barcelona’s official Twitter account was hacked in an apparent credential-stuffing attack. The strike resulted in account takeover and bogus tweets being sent out. The hacking collective known as OurMine, which made headline...
OpenSSH now supports FIDO U2F security keys for 2-factor authentication
Here's excellent news for sysadmins. You can now use a physical security key as hardware-based two-factor authentication to securely log into a remote system via SSH protocol. OpenSSH, one of the most widely used open-source implementations of the Secure Shell SSH Protocol, yesterday announced th...
Business Email Compromise. What to do
The FBI has just released it’s annual Internet Crime Report for 2019, it makes for some really interesting and depressing reading. The mainstream media focused on the headline figure of $3.5Bn in losses in 2019, but what caught my eye is the Business Email Compromise BEC or CEO Fraud stats. I...
CVE-2014-4198
A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...
CVE-2014-4198
The vulnerability CVE-2014-4198 affects BS-Client Private Client, versions 2.4 and 2.5. A flaw in the authentication flow allows a two-factor bypass via an XML request that omits ADPswID and AD parameters, enabling a malicious user to access privileged functions. Root cause stated as improper han...
CVE-2020-8953
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...
Authentication flaw
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...
CVE-2020-8953
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...
CVE-2020-8953
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...
Localize: 2-factor authentication can be disabled when logged in without confirming account password
Description === When users wants to Disable his/her TwoFactor Authentication, they have to know their account password. But using this vulnerability They don't need password to disable it. this will allow hacker who get someone cookie to disabling twofactor auth and also Fullytakeover the account...
Use iPhone as Physical Security Key to Protect Your Google Accounts
Great news for iOS users! You can now use your iPhone or iPad, running iOS 10 or later, as a physical security key for securely logging into your Google account as part of the Advanced Protection Program for two-factor authentication. Android users have had this feature on their smartphones since...
Use iPhone as Physical Security Key to Protect Your Google Accounts
Great news for iOS users! You can now use your iPhone or iPad, running iOS 10 or later, as a physical security key for securely logging into your Google account as part of the Advanced Protection Program for two-factor authentication. Android users have had this feature on their smartphones since...
What the continued escalation of tensions in the Middle East means for security
Cisco Talos works with many organizations around the world, monitoring and protecting against sophisticated threats every day. As such, we are watching the current state of events in the Middle East very closely for our customers and partners who may be impacted by the ongoing situation. We are...
Chinese Hackers Bypassing Two-Factor Authentication
Interesting story of how a Chinese state-sponsored hacking group is bypassing the RSA SecurID two-factor authentication system. How they did it remains unclear; although, the Fox-IT team has their theory. They said APT20 stole an RSA SecurID software token from a hacked system, which the Chinese...
Authentication Bypass
scheb/two-factor-bundle is vulnerable to authentication bypass. The vulnerability exists as the JwtTokenEncoder does not properly verify the validity of the JWT token, allowing an attacker to generate trusted device cookies and bypass the two-factor authentication...
Authentication Bypass
scheb/two-factor-bundle is vulnerable to authentication bypass. The 2-factor authentication can be bypassed by logging in with the REMEMBERME cookie and subsequently removing the SESSIONID key...
Facebook Finally Fixes Its Two-Factor Mess
A Wawa breach, Russian spies, and more of the week's top security news...
[SECURITY] Fedora 31 Update: freeipa-4.8.3-1.fc31
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
PYSEC-2019-135
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...