Threat Actor Impersonates USPS to Deliver Backdoor Malware

A new threat actor has been found impersonating the U.S. Postal Service USPS and other government agencies to deliver and install backdoor malware to various organizations in Germany, Italy and the United States, according to new research. The campaigns, which researchers from cybersecurity firm...

Before He Spammed You, this Sly Prince Stalked Your Mailbox

A reader forwarded what he briefly imagined might be a bold, if potentially costly, innovation on the old Nigerian prince scam that asks for help squirreling away millions in unclaimed fortune: It was sent via the U.S. Postal Service, with a postmarked stamp and everything. In truth these old...

gateway.usps.com XSS vulnerability

Open Bug Bounty ID: OBB-705977 Description| Value ---|--- Affected Website:| gateway.usps.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

prodpx-promotool.usps.com XSS vulnerability

Open Bug Bounty ID: OBB-704739 Description| Value ---|--- Affected Website:| prodpx-promotool.usps.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

USPS, Amazon Data Leaks Showcase API Weaknesses

The annual holiday buying bonanza has officially kicked off for 2018, and, as if on cue, a pair of security incidents at two of the most-used services this time of year – the U.S. Postal Service and Amazon – showed up to remind us of the dangers of shopping season. Both hinged on improper API use...

Amazon Exposes Emails, Insurance Company Surveillance, and More Security News This Week

A USPS data leak, Windows passwords go bye-bye, and more security news this week...

US Postal Service Left 60 Million Users Data Exposed For Over a Year

The United States Postal Service has patched a critical security vulnerability that exposed the data of more than 60 million customers to anyone who has an account at the USPS.com website. The U.S.P.S. is an independent agency of the American federal government responsible for providing postal...

USPS Site Exposed Data on 60 Million Users

U.S. Postal Service just fixed a security weakness that allowed anyone who has an account at usps.com to view account details for some 60 million other users, and in some cases to modify account details on their behalf. Image: USPS.com KrebsOnSecurity was contacted last week by a researcher who...

U.S. Secret Service Warns ID Thieves are Abusing USPS’s Mail Scanning Service

A year ago, KrebsOnSecurity warned that "Informed Delivery," a new offering from the U.S. Postal Service USPS that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and ma...

usps-d10.org XSS vulnerability

Open Bug Bounty ID: OBB-584926 Description| Value ---|--- Affected Website:| usps-d10.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

USPS Finally Starts Notifying You by Mail If Someone is Scanning Your Snail Mail Online

In October 2017, KrebsOnSecurity warned that ne'er-do-wells could take advantage of a relatively new service offered by the U.S. Postal Service that provides scanned images of all incoming mail before it is slated to arrive at its destination address. We advised that stalkers or scammers could...

USPS ‘Informed Delivery’ Is Stalker’s Dream

A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service's potential for misuse by private investigators, identity thieves, stalkers...

gateway.usps.com XSS vulnerability

Open Bug Bounty ID: OBB-244826 Description| Value ---|--- Affected Website:| gateway.usps.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Threat Outbreak Alert RuleID22523: Email Messages Distributing Malicious Software on April 27, 2016

Medium Alert ID: 44871 First Published: 2016 April 27 16:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22523 and RuleID22523KVR may contain the followi...

USPS MOBILE® - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application USPS MOBILE® published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID21325: Email Messages Distributing Malicious Software on February 24, 2016

Medium Alert ID: 43736 First Published: 2016 February 24 20:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID21325 may contain the following files: Name |...

about.usps.com XSS vulnerability

Vulnerable URL: http://about.usps.com/search.htm?q=-B4rt'/\u0061lertString.fromCharCode88, 83, 83, 80, 79, 83, 69, 68/'-B4rt'/\u0061lert/XSSPOSED//'-B4rt'/\u0061lert/XSSPOSED//' Details: Description| Value ---|--- Patched:| Yes, at 19.08.2015 Latest check for patch:| 19.08.2015 01:40 GMT...

usps.com XSS vulnerability

Vulnerable URL: https://www.usps.com/search.htm?q= -B4rt'/\u0061lertString.fromCharCode88, 83, 83, 80, 79, 83, 69, 68/'-B4rt'/\u0061lert/XSSPOSED//'-B4rt'/\u0061lert/XSSPOSED//' Details: Description| Value ---|--- Patched:| Yes, at 24.08.2015 Latest check for patch:| 24.08.2015 01:21 GMT...

Threat Outbreak Alert RuleID15411: Email Messages Distributing Malicious Software on May 20, 2015

Medium Alert ID: 38936 First Published: 2015 May 20 19:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15411 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID15252: Email Messages Distributing Malicious Software on May 12, 2015

Medium Alert ID: 38802 First Published: 2015 May 13 13:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15252 may contain the following files: Name | Size...