Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Password. Show all posts
Privacy
Cyberattacks CyberCrime Cybernews CyberThreat Data threats Hacking ObamaCare Password Privacy

Hackers Leak 10 Billion Passwords How Users Should Respond

 


Several months ago, security researchers discovered the world's largest collection of stolen passwords and credentials had been uploaded to an infamous criminal marketplace where cybercriminals would trade such credentials for a considerable amount of money. A hacker known as 'ObamaCare' has posted a database which, according to the hacker, contains nearly 10 billion unique passwords built over many years as a result of numerous data breaches and hacks he has been spreading across the web for several years. 

'ObamaCare', a user identified as 'ObamaCare', posted on a popular hacking forum on Thursday a collection of leaked passwords known as 'RockYou2024'. In the past, 'ObamaCare' has outsourced stolen data on the internet several times and it is not the first time they have done so. According to the report, the user had previously shared a database of Simmons & Simmons employees, a lead from the online casino AskGamblers, and applications from Rowan College in New Jersey before taking down the reports. 

The researchers at CyberNews have reported that on July 4, 2014, a hacker using the handle "ObamaCare" posted a file on a hacking forum that contained 9,948,575,739 unique plaintext passwords. The password dump that was recently found on the web is a more recent version of the "RockYou2021" data leak collection that surfaced in June 2021. 

In that particular instance, there were 8.4 billion unique passwords within the stolen collection of passwords at the time. This goldmine of thousands of unique passwords has been expanded by cybercriminals since 2021. The goldmine now includes 1.5 billion new and unique passwords added by these cyber criminals. “The team verified the leak passwords by cross-referencing the RockYou2024 leak passwords with a leaked password checker provided by Cybernews, which showed that these passwords were obtained from a mix of both old and new leaks,” Cybernews researchers wrote. 

There seem to have been a record number of stolen and leaked credentials discovered on the BreachForums criminal underground forum by security researchers from Cybernews. This collection has been the largest collection that has ever been seen on that site. A compilation of RockYou2024 appears to consist of an astonishing 9,948,575,739 unique passwords, all in plaintext form, with a total of 9,948,575,739 passwords. 

The database is said to have been built from an earlier credentials database called RockYou 2021, which contained eight billion passwords, and that has been added to with roughly 1.5 billion new passwords. The credential files cover a period to be measured between the years 2021 and 2024, and a total of 4,000 huge databases of stolen credentials have been estimated to contain information spanning a minimum of two decades in the latest credential file. 

Researchers stated that, in essence, the RockYou2024 leak contains a compilation of passwords that are used by people around the world. They also stated that, according to the researchers, the number of passwords used by threat actors is very large, which translates into a substantial risk of credential-stuffing attacks. There are several ways in which credential stuffing and brute force attacks can be mounted on passwords that have been leaked in such datasets. In credential stuffing attacks, the criminal acts by which they use passwords that have been stolen from one device or account to gain access to another device or account are described as the practice of the criminals. 

There is a premise at the foundation of this attack that users often have a single password for all of their accounts and devices, which allows criminals to access their account information, including other accounts or all their accounts, using that password. It is a process of using trial and error methods to try and guess sign-in information, passwords, and encryption keys for network systems. This is called a brute force attack. In a report published by Cybernews, the researchers said the database, which can be used to target all sorts of services, from online to offline, to internet-facing cameras and industrial hardware, is among the data. 

"By combining the data from RockYou2024 with other leaked databases from hacker forums, marketplaces, and other places where electronic mail addresses and other credentials can be published, it has the potential to trigger a cascade of data breaches, identity thefts, and financial frauds," the researchers stated. The multi-platform password manager that Bitdefender offers offers numerous benefits, including automatic password leak alerts that alert you as soon as your passwords and emails have been exposed online, with the ability to change them immediately. 

Users are advised to utilize a digital identity protection service to monitor their online identity and receive real-time alerts about data breaches and leaks involving their online information. One such service, Bitdefender Digital Identity Protection, offers a comprehensive solution for identity protection. Bitdefender Digital Identity Protection enables users to respond immediately to data breaches and privacy threats. 

Through instant alerts, users can take swift action to prevent damage, such as changing passwords with one-click action items. The service provides real-time monitoring by continuously scanning the internet and the dark web for personal information. Users receive alerts whenever their data is involved in a data breach or leak. Additionally, Bitdefender Digital Identity Protection offers peace of mind by immediately flagging suspicious activity and actively monitoring personal information. Users can rest assured that their digital identity is under constant surveillance. 

Furthermore, the service provides a 360° view of all data associated with a user’s digital footprint. This includes traces from services no longer in use but still retaining the user’s data. Users can also send requests for data removal from service providers, ensuring a more secure online presence. Overall, Bitdefender Digital Identity Protection is recommended for users seeking to safeguard their online identity and stay informed about potential security threats in real-time.
Read more »
password strength
Cyber Security Dangers of default password data security Kaspersky online account security Password Password Crackers password strength

The Speed and Efficiency of Modern Password-Cracking Techniques

 

With minimal expense and a bit of time, passwords can be cracked much faster than expected using a smart brute-force guessing algorithm. A recent analysis by Kaspersky revealed that 59% of 193 million real passwords were cracked in under an hour, with 45% broken in less than a minute. 

However, as explained by Antonov from Kaspersky, "smart guessing algorithms are trained on a data set of passwords to determine the frequency of various character combinations, starting with the most common and working down to the rarest." Although brute-force attacks are popular due to their straightforward approach, they are not the most efficient method for password cracking. Most commonly used passwords contain predictable patterns like dates, names, dictionary words, and keyboard sequences. Incorporating these patterns into the algorithm speeds up the cracking process significantly. 

The Kaspersky study demonstrated the advantage of combining brute-force and smart-guessing techniques. Pure brute force cracked 10% of passwords in under a minute, but this success rate jumped to 45% with the addition of smart-guessing. For passwords cracked between one minute and one hour, the success rate increased from 20% to 59%. Humans are generally not good at creating secure passwords because the choices are rarely random. We tend to use familiar elements that smart-guessing algorithms can easily identify: common names, important dates, and recognizable patterns. 

For example, a YouTube channel asked over 200,000 people to pick a 'random' number between 1 and 100, and most chose from a small set of numbers like 7, 37, 42, 69, 73, and 77. Even when attempting to create random character strings, people often stick to the center of the keyboard. This analysis underscores the importance of creating stronger, less predictable passwords. Using a combination of upper and lower case letters, numbers, and special characters can help enhance password security. 

Additionally, implementing multi-factor authentication (MFA) adds an extra layer of protection, making unauthorized access much more challenging. Regularly updating passwords and avoiding reuse of old ones are also essential practices for safeguarding accounts from being easily compromised. Employing password managers can also aid in generating and storing complex passwords, reducing the reliance on human memory and, thus, the use of predictable patterns. 

As cyber threats continue to evolve, staying informed about the latest security practices and adopting proactive measures will be crucial in defending against sophisticated password-cracking techniques.
Read more »
Password Security
Cyber Hacking Cyber Security data security Hacker attack Password Password Hacking Password Security

The Race Against Time: How Long Does It Take to Crack Your Password in 2024?

In the ever-evolving landscape of cybersecurity, the battle between hackers and defenders rages on. One of the fundamental elements of this battle is the strength of passwords. As technology advances, so too do the methods and tools available to hackers to crack passwords. 

In 2024, the time it takes to crack a password depends on various factors, including its length, complexity, and the resources available to the hacker. Gone are the days when a simple six-character password could provide adequate protection. With the increasing computational power of modern machines and the prevalence of sophisticated hacking techniques, such passwords can be cracked in mere seconds. In 2024, the gold standard for password security lies in lengthy, complex combinations of letters, numbers, and symbols. 

So, how long does it take for a hacker to crack a password in 2024? The answer is not straightforward. It depends on the strength of the password and the methods employed by the hacker. For instance, a short, simple password consisting of only lowercase letters can be cracked almost instantly using a brute-force attack, where the hacker systematically tries every possible combination until the correct one is found.  

However, longer and more complex passwords present a significantly greater challenge. In 2024, state-of-the-art hacking tools utilize advanced algorithms and techniques such as dictionary attacks, where common words and phrases are systematically tested, and rainbow tables, which are precomputed tables used to crack password hashes. These methods can significantly reduce the time it takes to crack a password, but they are still thwarted by sufficiently strong passwords. 

The concept of password entropy plays a crucial role in determining its strength against cracking attempts. Password entropy measures the randomness or unpredictability of a password. A password with high entropy is more resistant to cracking because it is less susceptible to brute-force and dictionary attacks. In 2024, experts recommend using passwords with high entropy, achieved through a combination of length, complexity, and randomness. 

To put things into perspective, let's consider an example. A randomly generated 12-character password consisting of uppercase and lowercase letters, numbers, and symbols has an extremely high entropy. Even with the most advanced cracking techniques available in 2024, it could take billions or even trillions of years to crack such a password using brute-force methods. 

However, the human factor remains a significant vulnerability in password security. Despite the availability of password managers and education on password best practices, many people still choose weak passwords or reuse them across multiple accounts. This behavior provides hackers with ample opportunities to exploit security vulnerabilities and gain unauthorized access to sensitive information. 

The time it takes for a hacker to crack a password in 2024 varies depending on factors such as password strength, hacking techniques, and computational resources. While advances in technology have empowered hackers with increasingly sophisticated tools, the key to effective password security lies in employing strong, unique passwords with high entropy. By staying vigilant and adopting best practices, individuals and organizations can fortify their defenses against malicious cyber threats in the digital age.

Read more »
Password Security
Credential Cyber Security CyberCrime Information Security Password Password Management Password Security

Strengthening Password Security: Addressing Misconceptions and Best Practices

 

According to recent research by the Institution of Engineering and Technology (IET), conducted to mark World Password Day, only one in five people in the UK can correctly identify a secure password over a risky one. This alarming statistic underscores the widespread lack of awareness and understanding when it comes to password security among the public. 

The study revealed that despite expressing concern about the possibility of being hacked in the future, a significant portion of the population continues to engage in risky password practices. For example, 20% of respondents admitted to using the same password for multiple websites and devices, a practice strongly discouraged by cybersecurity experts. 

Additionally, many individuals rely on easily guessable passwords, such as pet names or significant dates, further compromising their online security. Despite the prevailing fear of cyber threats, there exists a notable discrepancy between public perception and best practices in password security. While 84% of respondents believe that hackers are becoming more inventive, many still hold misconceptions about what constitutes a secure password. 

For instance, a significant portion of the population mistakenly believes that replacing letters with numbers in passwords enhances security, when in reality, this practice does little to deter sophisticated cyberattacks. Dr. Junade Ali, a cybersecurity expert and IET fellow, highlighted the critical importance of strong passwords in today's digital landscape. Weak and predictable passwords serve as easy targets for cybercriminals, who employ various tactics, including credential stuffing, to gain unauthorized access to multiple accounts. Credential stuffing exploits the common practice of using the same password across multiple platforms, allowing hackers to compromise multiple accounts with minimal effort. 

To address these vulnerabilities, the IET has issued recommendations aimed at improving password security awareness and practices. Among these recommendations is the suggestion to create randomly generated, long, and unique passwords for each website or online service. Longer passwords are generally more resistant to brute-force attacks and provide an added layer of security against unauthorized access.  

Additionally, the use of a reputable password manager is encouraged to securely store and manage passwords across various platforms. Password managers not only simplify the process of generating and storing complex passwords but also provide alerts in the event of a data breach, allowing users to take immediate action to protect their accounts. 

By following these guidelines and adopting strong password security practices, individuals can significantly enhance their defenses against cyber threats and safeguard their sensitive information online. As cyberattacks continue to evolve in sophistication, proactive measures to strengthen password security are essential in mitigating the risk of unauthorized access and data breaches.
Read more »
Roku
2FA Credential Stuffing Data Breach Password Roku

Roku Security Breach Exposes Over 500,000 User Accounts to Cyber Threats

 


In a recent set of events, streaming giant Roku has disclosed an eminent security breach affecting over half a million user accounts. Following a recent data breach, Roku has uncovered additional compromised accounts, totaling approximately 576,000 users affected by the breach.

Security Breach Details

Last month, Roku announced that around 15,000 customers might have had their sensitive information, including usernames, passwords, and credit card details, stolen by hackers. These stolen credentials were then utilised to gain unauthorised access to other streaming platforms and even to purchase streaming gear from Roku's website. Subsequently, the compromised Roku accounts were sold on the dark web for a mere $0.50 each.

Method of Attack

The hackers employed a tactic known as "credential stuffing" to gain access to the jeopardised accounts. This method relies on using stolen usernames and passwords from other data breaches to gain unauthorised access to various accounts. It highlights the importance of avoiding password reuse across different platforms, no matter how convenient the idea of having one go-to password may seem. 

Proactive Measures by Roku

Roku took proactive steps in response to the security incidents. While investigating the initial breach, the company discovered a second similar incident affecting over 500,000 additional accounts. Roku clarified that there's no evidence indicating that their systems were directly laid on the line. Instead, the hackers likely obtained the credentials from external sources, such as previous data breaches or leaks.

Protecting Your Roku Account

To safeguard users' accounts, Roku has implemented several measures. Firstly, the company has reset the passwords for all affected accounts and initiated direct notifications to affected customers. Additionally, Roku is refunding or reversing any unauthorised charges made by hackers. Furthermore, two-factor authentication (2FA) has been enabled for all Roku accounts, adding an extra layer of security.

User Precautions

Despite Roku's efforts, users are advised to take additional precautions. It's crucial to use strong, unique passwords for each online account, including Roku. Password managers can assist in generating and securely storing complex passwords. Additionally, users should remain watchful for any suspicious activity on their accounts and monitor their bank statements closely.

As Roku continues its investigations, users are urged to stay cautious online. There's a possibility of hackers attempting targeted phishing attacks using stolen information. Therefore, users should exercise caution when interacting with emails purportedly from Roku and verify the authenticity of any communication from the company.

The recent security breaches bear down on the critical need for strong cybersecurity practices by both companies and users. While Roku has taken considerable steps to address the issue, users must remain proactive in protecting their accounts from potential threats. Stay informed and take necessary precautions to safeguard your online ecosystem. 

Read more »
SurveyLama
Data Breach Emails Online Security Password Personal Data SurveyLama

SurveyLama Data Breach Exposes Millions of Users' Information

 



A major data breach has impacted the online survey platform SurveyLama, putting the sensitive data of over four million individuals at risk. The breach, which occurred in February of this year, was confirmed by the company to Troy Hunt, the creator of the well-known website Have I Been Pwned?, which tracks email addresses exposed in data breaches.

What Happened:

Unknown attackers gained unauthorised access to SurveyLama's database, compromising users' names, dates of birth, email addresses, IP addresses, passwords, phone numbers, and postal addresses. This breach leaves users vulnerable to identity theft and phishing scams.

Implications for Users:

SurveyLama rewards its users for completing surveys, making them potential targets for phishing emails. While passwords were stored in encrypted forms (salted SHA-1, bcrypt, and argon2 hashes), some could still be susceptible to brute-force attacks, especially those hashed with SHA-1, which has known vulnerabilities. Users are strongly advised to update their passwords immediately as a precautionary measure.

Protective Measures:

SurveyLama has reportedly notified affected users via email about the breach. However, users should remain cautious of any suspicious emails, particularly those promising rewards in exchange for quick action. Although the stolen information has not yet been publicly posted or sold on the dark web, proactive steps should be taken to secure accounts.

Expert Insight:

Troy Hunt, upon receiving information about the breach, independently verified the data's authenticity. SurveyLama confirmed the security incident and assured users that passwords were stored in encrypted forms. Nonetheless, users are encouraged to reset their passwords not only on SurveyLama but also on other platforms where similar credentials may have been used.

While SurveyLama has taken steps to address the breach and notify affected users, the potential risks remain significant. The possibility of the stolen data being exploited privately or leaked to cybercriminals underscores the importance of immediate action by users to safeguard their personal information.

All in all, the SurveyLama data breach serves as a reminder of the ever-present threats to online security and the importance of vigilance in protecting personal data. Users must stay informed, remain cautious of suspicious activities, and take proactive measures to enhance their online security posture.


Read more »
User Privacy
API Keys Apple Cryptography Cyber Security Google Passkey Password Phishing Scams Platforms Technology User Privacy

Revolutionizing Security: Passkeys by Google and Apple

Online security has grown to be of utmost importance in a digital environment that is always changing. Passkeys, a cutting-edge authentication system that is poised to transform how we protect our accounts, are being pushed for by Google and Apple, who are leading the effort.

Passkeys, also known as cryptographic keys, are a form of authentication that rely on public-key cryptography. Unlike traditional passwords, which can be vulnerable to hacking and phishing attacks, passkeys offer a more robust and secure method of verifying user identity. By generating a unique pair of keys – one public and one private – passkeys establish a highly secure connection between the user and the platform.

One of the key advantages of passkeys is that they eliminate the need for users to remember complex passwords or go through the hassle of resetting them. Instead, users can rely on their devices to generate and manage these cryptographic keys. This not only simplifies the login process but also reduces the risk of human error, a common factor in security breaches.

Google and Apple have been at the forefront of this innovation, integrating passkey technology into their platforms. Apple, for instance, has introduced the Passkeys API in iOS, making it easier for developers to implement this secure authentication method in their apps. This move signifies a significant shift towards a more secure and user-friendly digital landscape.

Moreover, passkeys can play a pivotal role in thwarting phishing attacks, which remain a prevalent threat in the online realm. Since passkeys are tied to specific devices, even if a user inadvertently falls victim to a phishing scam, the attacker would be unable to gain access without the physical device.

While passkeys offer a promising solution to enhance online security, it's important to acknowledge potential challenges. For instance, the technology may face initial resistance due to a learning curve associated with its implementation. Additionally, ensuring compatibility across various platforms and devices will be crucial to its widespread adoption.

Passkeys are a major advancement in digital authentication. Google and Apple are leading a push toward a more secure and frictionless internet experience by utilizing the power of public-key cryptography. Users might anticipate a time in the future when the laborious practice of managing passwords is a thing of the past as this technology continues to advance. Adopting passkeys is a step toward improved security as well as a step toward a more user-focused digital environment.

Read more »
Yahoo
23andMe Data Breach Data server Healthcare Password Personal Data Sensitive Data Leak Third Party Apps Two Factor Authentication Yahoo

DNA Data Breaches: A Growing Cybersecurity Concern

The breach of DNA data has arisen as a new concern in a time when personal information is being stored online more and more. Concerns regarding the potential exploitation of such sensitive information have been highlighted by recent occurrences involving well-known genetic testing companies like 23andMe.

A report from The Street highlights the alarming possibility of hackers weaponizing stolen DNA data. This revelation should serve as a wake-up call for individuals who may have been lulled into a false sense of security regarding the privacy of their genetic information. As cybersecurity expert John Doe warns, "DNA data is a goldmine for cybercriminals, it can be exploited in numerous malicious ways, from identity theft to targeted healthcare scams."

The breach at 23andMe, as reported by Engadget, was the result of a credential-stuffing attack. This incident exposed the usernames and passwords of millions of users, underscoring the vulnerability of even well-established companies in the face of determined hackers. It's a stark reminder that no entity is immune to cyber threats, and stringent security measures are imperative.

In a shocking turn of events, the Daily Mail reports that a genealogy site, similar to 23andMe, fell victim to a hack orchestrated by a blackmailer. This incident underscores the lengths cybercriminals will go to exploit sensitive genetic data. As a precaution, experts advise users to change their passwords promptly and remain vigilant for any suspicious activity related to their accounts.

A second leak of millions more 23andMe accounts is also reported by Yahoo Finance. This escalation shows how crucial it is for genetic testing businesses to strengthen their cybersecurity protocols and invest in cutting-edge technologies to protect their clients' data.

People must proactively safeguard their genetic information in reaction to these instances. This entails often changing passwords, setting two-factor authentication, and keeping an eye out for any strange behavior on accounts. Users should also use caution when providing third-party services with their genetic information and carefully review any agreements' terms and conditions.

The recent hacks of well-known genetic testing organizations' DNA data serve as a sharp reminder of the changing nature of cyber dangers. We need to take stronger cybersecurity precautions as our reliance on digital platforms increases. Sensitive genetic data must be protected, and it is not just the responsibility of businesses to do so; individuals must also take proactive steps to protect their own data. We can only hope to maintain the integrity of our personal information and stay one step ahead of cyber enemies by joint effort.

Read more »
Ransomware
Cyberattacks Cybersecurity GroupSense Password Privacy Ransomware

Ethics in the Age of Ransomware: Challenges and Strategies for Negotiation

 


Recent years have witnessed the rise of ransomware, which has transitioned from mere breaches of sensitive data to sophisticated cyberattacks. In many of these cyberattacks, the target is an organization. The existence of cybercriminals has gone from a speck on the radar of digital security to being a widespread and very sophisticated type of crime. 

Businesses in every type of industry and size are trapped in a digital chess game where all of their moves are digitally tracked. Ransomware is one of the most popular types of malware that exploits essential and sensitive data, but unfortunately, it is not uncommon for the adversary to use nefarious techniques to compromise data and hold that data hostage for exorbitant reasons. 

Over the past year, Kurtis Minder, the CEO of GroupSense has had the privilege of experiencing this rise first-hand. Located in Arlington, GroupSense specializes in post-attack intelligence gathering and information gathering for security operations and law enforcement clients across the world thanks to its threat intelligence capabilities. 

According to Minder, a significant percentage of the company's customer wins are based on incident response; he explained that this did not happen all the time, but that larger incident response organizations bring GroupSense into breach scenarios in order to provide additional analysis of specific threats that are being encountered. 

There has been a shift in the incident response industry since the year 2020 when something unexpected began to occur. It is common for cyber insurance carriers to provide a list or a "panel" of approved vendors that can respond to breaches, ransomware attacks, as well as ransomware negotiations, in order to address the incident response requirements. 

Minder says that in this case, the victim had only one company on its panel that would deal with ransomware negotiations, and that company felt "completely swamped" with demands at the time because it was dealing with a large number of requests. 

Consequently, GroupSense was able to step in and conduct negotiations with the actors responsible for the threat, which opened the possibility of future engagements with those carriers. GroupSense soon began to become a negotiating company with the company taking on other types of jobs, including ransomware negotiations last September.

As a result, Minder said, the company was conducting between three and five ransomware negotiations a week after the company launched its ransomware services. It was not too long ago when many believed ransomware negotiations to be a largely unscrupulous endeavour undertaken by shady ransomware recovery firms that would claim to decrypt the victim's data under the guise of decryption when they were actually taking the money and paying the ransom over the course of months. 

The number of ransomware attacks has steadily increased, as have the ransom demands, which are routinely approaching seven figures, according to information security experts. Additionally, experts are stating that many victims, even those who have backups of their encrypted data, are now paying a ransom as a way of preventing the theft of their data from ever being uncovered. 

As a result of these factors, incident response specialists have been in high demand for quite some time now. They have the ability to delay an urgent payment deadline as well as negotiate a million-dollar demand down to a mere $200,000. 

What is Ethical Behavior at the Negotiating Table? 


Many negotiators fall somewhere between the extremes; while some argue that negotiators should always tell the truth, they might only tell the truth with a little margin for error; while others argue that negotiators should tell the whole truth at all times as well. 

It is important for organizations to balance their responsibilities towards stakeholders, to societal well-being, as well as the potential consequences of their decision-making as part of the ransomware negotiation process. 

Even though there are still moral dilemmas surrounding negotiation, businesses need to take into account the long-term as well as short-term impacts of choosing to negotiate or not to negotiate. Due to the increasing intensity and prevalence of cyberattacks, organizations will have to navigate a maze of ethical considerations other than ransomware negotiations in order to mitigate the impact of these threats. Therefore, organizations must maintain vigilance and ensure the integrity of their negotiations. 

There are a number of factors to consider when negotiating in ransomware situations, including robust cybersecurity measures, as well as the negotiation strategy itself. While choosing to negotiate may be a pragmatic solution for dealing with the immediate challenges of ransomware attacks, protecting data, ensuring business continuity, and maintaining economic stability in the face of these threats, there are technological and ethical challenges associated with this approach as well. 

Organizations may contribute to a more resilient digital landscape and send a clear message to criminals that they will not be rewarded for their criminal behaviour by refraining from negotiation and redirecting efforts to proactive cybersecurity measures and collaboration between law enforcement agencies.
Read more »
Unauthorized access
2FA Data Breach Email Attacks Encryption Password Password Manager Sensitive data Unauthorized access

Freecycle Data Breach: Urgent Password Update Required

Freecycle, a well-known website for recycling and giving away unwanted stuff, recently announced a huge data breach that has affected millions of its users. This news has shocked the internet world. Concerns over the security of personal information on the internet have been raised by the hack, underscoring once more the significance of using secure passwords and being aware of cybersecurity issues.

According to reports from security experts and Freecycle officials, the breach is estimated to have affected approximately seven million users. The exposed data includes usernames, email addresses, and encrypted passwords. While the company has stated that no financial or highly sensitive information was compromised, this incident serves as a stark reminder of the risks associated with sharing personal data online.

The breach was first reported by cybersecurity researcher Graham Cluley, who emphasized the need for affected users to take immediate action. Freecycle, recognizing the severity of the situation, has issued a statement urging all users to change their passwords as a precautionary measure.

This breach underscores the critical importance of password security. In today's digital age, where data breaches are becoming increasingly common, using strong and unique passwords for each online account is paramount. Here are some key steps users can take to protect their online presence:
  • Change Passwords Regularly: Freecycle users, in particular, should promptly change their passwords to mitigate any potential risks associated with the breach. Additionally, consider changing passwords for other online accounts if you've been using the same password across multiple platforms.
  • Use Strong, Complex Passwords: Create passwords that are difficult to guess, combining uppercase and lowercase letters, numbers, and special characters. Avoid easily guessable information like birthdays or common words.
  • Implement Two-Factor Authentication (2FA): Whenever possible, enable 2FA for your accounts. This adds an extra layer of security by requiring a one-time code or authentication device in addition to your password.
  • Password Manager: Consider using a reputable password manager to generate and store complex passwords securely. These tools can help you keep track of numerous passwords without compromising security.
  • Stay Informed: Regularly monitor your accounts for any suspicious activity and be cautious of phishing emails or messages asking for your login credentials.

Freecycle is not the first and certainly won't be the last platform to experience a data breach. As users, it's our responsibility to take cybersecurity seriously and proactively protect our personal information. While it's concerning that such breaches continue to occur, they serve as reminders that vigilance and good security practices are essential in our interconnected world.
Read more »
Social Engineering
Click Bait Cyber Attacks Cyber Hacking CyberCriminal Email Scams Password Social Engineering

Guarding Your Finances: The Art of Phishing Attacks and Social Engineering

 


Malware, hacking techniques, botnets, and other types of technologies are becoming increasingly sophisticated as cyber crimes become more sophisticated. Nevertheless, online criminality exploits tactics that have been refined over decades by criminals long before the internet existed. 

A cybercriminal knows how to control a human tendency for trust as well as trickery, coercion, and the movement of humans to use their faith in them to achieve their criminal goals. "Social engineering" is a term referring to a method of gaining confidence online that is most often used in confidence scams.   

Cybercriminals can glean a nuanced understanding of users by exploiting social media sites, professional profiles, blogs, websites, or local news reports. Using data harvested from these sources over weeks or months will allow them to gain a nuanced understanding of users and even their families. 

It is a collective term for a range of scams or scams that rely on social engineering to seek money directly from a victim or to gain confidential information to enable the perpetrator to commit further crimes after the victim has fallen victim to the scam. The preferred channel for contact is now social media. However, if you want to make contact by phone or in person, it is not uncommon to do that too. 

An individual who uses social engineering to gain access to a company's computer system or information about a client, or to compromise an organization's data, is known as a social engineer. If a malicious individual attempt to pose as a new employee, technician, or researcher, it may appear unassuming and respectable, with credentials that may support the claim that he or she is a new employee, technician, or researcher.

It is still a possibility that a hacker could obtain enough information by asking questions to gain entry into an organization's network. The attacker may also contact a second source within the same organization if he or she cannot gather enough information from one source and then rely on the information gathered from the first source to build credibility in the eyes of the authorities in the organization. 

Phishing scams are responsible for the loss of tens of millions of dollars each year, and the number is increasing every year, according to the authorities. A phishing scheme differs largely from scams in the form of the now-famous "Hi Mum" scheme in the sense that no overt request is made to send money to an account as the tactic. 

To effectively persuade people to provide any personal information to the scammers, they use subterfuges, doctored websites, and carefully calibrated software scripts to get them to divulge personal information. It is a technique that has become popular as a "social engineering" technique in the cybersecurity community as this technique is based on people's typical emotions and behaviours.

Scams may appear in the form of e-mails or text messages claiming to be from an official company or organization, such as the Australian Taxation Office or Netflix, that appear to be from the real thing. Upon receiving a warning message from the company, victims will be directed to a page that resembles the one used by the company and will be asked to fix a problem with their account or to confirm their contact details as soon as possible. 

A phishing kit, which contains HTML assets and scripts that you will need to create a fake website, is available for as little as $10, but scammers will probably pay anywhere from $100 to $1,000 for one. Using this information, the scammer can access bank accounts to transfer money to themselves at any time at his convenience. Phishing has evolved into an underground industry inside Australia's cybersecurity sector, according to Craig McDonald, founder of Australian cybersecurity company MailGuard. 

Many people don't realize the fact that they have made personal information available to swindlers through the use of social engineering because they do not monitor the amount of information that they disclose. There are usually privacy controls on social media sites and forums, for instance, which may be able to help users restrict how much information about them and their lives is visible publicly to others. The problem is that a large number of users consistently ignore these filters and allow any information they post to remain visible to the public.   

Some cyber criminals spend as much time as they can on building their personas as they do building their websites. They may be able to anticipate a person’s reaction to a certain situation with a good understanding of how they would react, which would in turn allow them to act and respond in a way that establishes trust once they reach out to them - as a fellow alumnus, a school parent, or an avid sports enthusiast, to name just a few examples. 

There are many ways that scams can be perpetrated. Gifts and charitable contributions are often requested during the holidays since it is the season for giving. In some cases, criminals may send emails that contain malicious links that permit them to access a person's device, account, or data as well as their personal information. The release of a device or the release of information stolen may be subject to ransom demands.   

Social Engineering: How to Spot It   


A Message of Urgency or Threat  


In case users receive an email, text message, direct message, or any other sort of message that seems overly exciting or aggressive then it is something to be cautious about. These scare tactics are used by scammers to force users into taking action without first thinking through what is being done to them. 

Click Bait for Winning Prizes 


There is a multitude of stories that scammers will tell to pry your personal information from users. Some scammers use bogus prizes and sweepstakes to win money from unsuspecting people. To make the payments out of the winnings, scammers are given users' bank information or sometimes even their tax ID number. 

Users are never going to receive the winnings they are claiming. The scammer is interested in this information so that they can hack users' accounts and steal their identities in a wide variety of ways.  

The Message Appears to be Strange in Some Way. 


A scammer will often pose as a person user knows to get your money. It can be anyone, including friends, family members, coworkers, bosses, vendors, or clients when users are working, or any other person for that matter. The message users receive when they do does seem a bit odd at first, but users will soon get used to it.  

How Can You Prevent Being Phished in The Future? 


When phishing victims become the victim of a scam, there can be difficulties in obtaining recourse. While Australians lost an unprecedented $3.1 billion through scams last year, the big banks only compensated about $21 million in compensation to their customers, even though the banks have each developed their policies for dealing with cybercrime. 

Australian Financial Complaints Authority (AFCA) is a consumer complaints body that is responsible for investigating complaints from the general public about banks. The federal government has provided some indication that it will be reforming Australian online banking law shortly, even if consumer groups maintain that the laws are not robust enough to protect victims of scams. Deputy Treasurer Stephen Jones stated several steps are being taken by the government to impose strict new codes of conduct on the industry.
Read more »
Yahoo
Cyber Security Cybersecurity. GitHub Minecraft Password Sensitive Data Leak servers Yahoo

Shockbyte Assures Users of Data Safety Amid Git Leak Incident

 

Minecraft enthusiasts were taken aback by recent reports of a security breach at Shockbyte, one of the leading Minecraft server hosting providers. However, the company has come forward to assure its users that there is no cause for concern regarding their data. The incident, which involved a leak of data through Git, raised eyebrows among the Minecraft community, but Shockbyte quickly took action to address the issue.

The news of the security incident spread rapidly across various tech publications, causing a wave of worry among Shockbyte's user base. TechRadar, CyberNews, and Yahoo! were among the platforms that covered the story, amplifying concerns about potential data compromise. However, it is essential to clarify the company's response and the actions taken to ensure data safety.

Shockbyte promptly acknowledged the situation and undertook a thorough investigation into the incident. The hosting provider determined that the breach occurred through a leak in their Git repository, a widely used version control system. Although Git leaks can be serious, Shockbyte acted swiftly to minimize any potential impact on its users.

In a public statement, Shockbyte reassured its customers that no sensitive personal data, including passwords or payment information, had been compromised. The leaked data primarily consisted of code and configuration files related to server setups. While this incident is undoubtedly concerning, it is important to note that the leaked information does not pose a direct threat to users' personal data or accounts.

The company has taken immediate steps to address the issue and mitigate any potential risks. Shockbyte has thoroughly reviewed its security measures and implemented additional safeguards to prevent similar incidents from occurring in the future. They have also emphasized the importance of strong passwords and recommended that users change their login credentials as an extra precaution.

Furthermore, Shockbyte has been transparent in its communication with its users throughout the incident. They have actively updated their customers via their official website and social media channels, providing detailed information about the breach and the steps taken to resolve it. By maintaining open lines of communication, Shockbyte has demonstrated its commitment to ensuring the trust and confidence of its user community.

As Minecraft continues to captivate millions of players worldwide, the importance of robust server hosting and data security cannot be overstated. Shockbyte's response to the Git leak incident serves as a reminder of the need for constant vigilance in safeguarding user data. The incident has undoubtedly been a learning experience for the company, further strengthening its commitment to data protection and cybersecurity.
Read more »
TOTPs
Cyberattacks CyberCrime Microsoft PaaS Password PayPal phishing Privacy TOTPs

Convincing Phishing Pages are Now Possible With Phishing-as-a-Service

 


In several phishing campaigns since mid-2022, a previously unknown phishing-as-a-service (PaaS) offering named "Greatness" has been used as a backend component for various spam campaigns. In addition to MFA bypass, IP filtering, and integration with Telegram bots, Greatness includes features found in some of the most advanced PaaS offerings. These features include integration with some of the most advanced PaaS offerings. 

Phishing attacks are mostly social engineering attacks. Depending on who conducts the attack, they can target a wide range of people. There is a possibility that these emails are spam or scam emails looking to access PayPal accounts. 

There is also the possibility of phishing being an attack specifically targeted at a particular individual. Attackers often tailor their emails to speak directly to you and include information only available from an acquaintance. When an attacker gains access to your data, he or she usually obtains this information. Even if the recipient is very cautious in their responses, it is very difficult for them to avoid being a victim when an email of this kind is sent. Based on research conducted by PhishMe Research, over 97% of all fraudulent emails sent to consumers contain ransomware. 

As a result of the availability of phishing kits like Greatness, threat actors, rookies, and professionals alike, now can design convincing login pages that comply with the account registration process of various online services while bypassing the two-factor authentication protections offered by the service.

As a result of this, the fake pages that appear to be authentic behave as a proxy for the attacker to harvest credentials entered by victims and time-based one-time passwords (TOTPs). 

In addition to the possibility of conducting phishing through text messages, social media, and phone calls, the term 'phishing' is most commonly used in the context of attacks that appear via email. Oftentimes, phishing emails can reach thousands of users directly and disguise themselves among the myriad of benign emails that are received by busy users every day. As a result of attacks, malicious code may be installed on systems (such as ransomware), systems may be sabotaged, and intellectual property may be stolen. 

The focus of Greatness is, for now, limited to Microsoft 365 phishing pages, which allows its affiliates to create highly convincing decoy and login pages, using Greatness' attachment and link builder. The attack incorporates features such as pre-filling the victim's email address and showing the victim's appropriate company logo and background image, which were derived from the actual Microsoft 365 login page in which the victim worked or worked for the target organization. The complexity of the software makes Greatness a particularly attractive option for businesses that do phishing. 

A geographic analysis of the targets in a number of the various campaigns that are ongoing and have been conducted in the past revealed the majority of victims to be companies based in the U.S., U.K., Australia, South Africa, and Canada, with manufacturing, health care, and technology sectors being the most frequently targeted industries. There are slight differences in the exact distribution of victims between each campaign and each country in terms of the sector and location. 

Whenever affiliates deploy and configure the phishing kit provided by Greatness, they can access its more advanced features without technical knowledge. They may even take advantage of the service's more advanced features even if they are unskilled. There are two types of phishing kits. One uses an API to generate phishing claims. The other uses a phishing kit to perform a "man-in-the-middle attack" and generate phishing claims. 

In the latest UK government survey titled "Cyber Security Breaches Survey 2021", the UK government reports that phishing remains the "most common attack vector" when it comes to attack attempts involving their systems. Even though phishing is still being used due to its continued success, up to 32% of employees click on a phishing email link while up to 8% of employees are unaware of the sending. 

The risk of a data breach or malware infection is greatly increased when an individual clicks on a link in a phishing email and then enters their login credentials to access company resources. There are always going to be several levels of privilege escalation, even when an employee has lower access privileges. Cybercriminals put a lot of effort into making their phishing attack vector as convincing as possible to increase their chances of success. 

With the emergence of the Greatness product, Microsoft 365 users are at higher risk of being compromised. Phishing pages can appear more convincing and effective against businesses. Approximately 90% of the affiliates of Greatness target businesses according to the data that Cisco Talos collected. A study of the targeted organizations across several campaign campaigns indicates that manufacturing is the sector given the most attention. This is followed by the healthcare and technology sectors. 

The threat was first observed during mid-2022, and according to VirusTotal, a spike in activity was experienced in December 2022 and March 2023. This was a time when attachment samples increased considerably. 

As part of the attack chain, malicious emails often contain HTML attachments which are executed on opening. This code often contains obfuscated JavaScript code which redirects the recipient to a landing page with their email address pre-filled and prompts them for a password and two-factor authentication code to access the site. 

The credentials entered are forwarded via Telegram to the affiliate's Telegram channel. They will be used to gain unauthorized access to the accounts being accessed. 

If a victim opens an attachment that contains an HTML file, the web browser will execute some narrow JavaScript code that will establish a connection to the attacker's server to get the HTML code of the phishing page. In turn, the attacker's server will display the phishing page to the user in the same browser window. An image of a spinning wheel is displayed on the screen in the code, pretending to show that the document is being loaded, with a blurred image. 

The PaaS is then responsible for connecting to Microsoft 365 and impersonating the victim to log into the victim's account. As a result, if the service detects that MFA is being used, it will prompt the victim to authenticate by using their chosen MFA method (e.g., SMS code, voice call code, push notification, according to the website). 

After a service receives the MFA, the service will continue to impersonate the victim behind the scenes to complete the login process. This will enable it to collect authenticated session cookies associated with the victim. The affiliates will then receive these updates through their Telegram channel or via an email directly from the web panel, depending on which method they choose. 

As it works in conjunction with the API, the phishing kit creates a "man-in-the-middle" attack, asking the victim for information, which is then passed to the legitimate login page in real time, and is further logged by the API. 

If the victim uses MFA (Master Key Authentication), the PaaS affiliate can steal the user passwords and usernames associated with the account and the authenticated session cookies. This is one of the reasons why the Telegram bot is used - it notifies the attacker as soon as possible about valid cookies so that they can make a quick move if the target looks interesting. This likely is one of the reasons why authenticated sessions typically expire after a while, which is one of the reasons the bot is utilized.
Read more »
Password
AI Breach Cyber Security Data Data Safety data security Password

AI can Crack Your Password in Seconds, Here’s how to Protect Yourself

 

Along with the benefits of emerging generative AI services come new hazards. PassGAN, a sophisticated solution to password cracking, has just emerged. Using the most recent AI, it was able to hack 51% of passwords in under a minute and crack 71% of passwords in less than a day. 

Microsoft raised attention to the security problems that would accompany the rapid growth of AI last month when it announced its new Security Copilot suite, which will assist security researchers in protecting against malicious use of current technologies.

Home Security Heroes recently released a study demonstrating how frighteningly powerful the latest generative AI is at cracking passwords. The company ran a list of over 15,000,000 credentials from the Rockyou dataset through the new password cracker PassGAN (password generative adversarial network), and the results were shocking.

51% of all popular passwords were broken in under a minute, 65% in under an hour, 71% in under a day, and 81% in under a month. PassGAN is able to "autonomously learn the distribution of real passwords from actual password leaks," which is why AI is making such a difference in password cracking. Rather than having to do manual password analysis on leaked password databases, PassGAN is able to "autonomously learn the distribution of real passwords from actual password leaks."

How to Prevent AI Password Cracking

Sticking to at least 12 characters or more of capital and lowercase letters plus numbers (or symbols) distinguishes between easily or rapidly cracked passwords and difficult-to-crack passwords. For the time being, all passwords with 18 characters that include both letters and numbers are protected against AI cracking.

Seeing how powerful AI can be for password cracking is a good reminder to not only use strong passwords but also to check:
  • Utilising 2FA/MFA. (non-SMS-based whenever possible)
  • Avoid reusing passwords across accounts.
  • When feasible, use password generators.
  • Passwords should be changed on a frequent basis, especially for important accounts.
  • Avoid using public WiFi, especially for banking and other similar accounts.
On the Home Security Heroes website, there is a program that allows you to test your own passwords against AI. However, it's best not to enter any of your genuine passwords if you want to check out the AI password analyser - instead, enter a random one.
Read more »
User Privacy
Cyber Security Online Safety Passkeys Password Password Manager User Privacy

Passkeys: A Modern Solution For All Your Password Troubles

 

We all use far too many passwords, and they're probably not all that secure. Passkeys are the next development in password technology and are intended to replace passwords with a more secure approach. 

Password troubles 

For a very long time, we have used usernames and passwords to sign in to websites, apps, and gadgets. 

A serious issue with passwords is that nearly entirely their creators are to fault. You must remember the password, thus it's easy to fall into the trap of using real words or phrases. It's also fairly typical to use the same password across several websites and apps in favour of having unique passwords for each one. 

Although it is obviously not very safe, many individuals continue to use passwords like their birthdate or the name of their pet. If they are successful, they can attempt it in every other place you use the same password. Using two-factor authentication and special passwords is essential as a result of this. Password managers, which produce random character strings for you and remember them for you, have been developed to solve this issue. 

Passkey vs. password: What distinguishes them

Over time, not much has changed with regard to the login and password system. Think of passkeys as a full-fledged alternative for the outdated password system. Basically, the process you use to unlock your phone is the same one you use to sign into apps and websites. 

It is among the fundamental distinctions between passkeys and conventional passwords. All locations where Facebook is accessible accept your Facebook password. On the other hand, a passkey is bound to the machine where it was made. The passkey is far more secure than a password because you're not generating a universal password. 

The same security process can be used to verify a QR code you scanned with your phone to log in on another device. There are no passwords used, thus nothing can be stolen or leaked. Because you must sign in with your phone in hand, you don't need to be afraid about a stranger across the nation using your password. 

Device compatibility 

Passkeys are still very new, but they already work with all the best phones and a majority of the best laptops. This is because the tech behemoths Microsoft, Google, Apple, and others collaborated to create them using the FIDO Alliance and W3C standards. 

Apple introduced passkeys to the iPhone with the release of iOS 16 in the previous fall. Passkeys eliminates the need for a master password on its devices by using TouchID and FaceID for authentication. Here's how to set up passkeys on an iPhone, iPad, or Mac if you want to try them out for yourself.

Your passkeys are stored and synchronised using the Google Password Manager if you have one of the top Android phones or an Android tablet. If you want to use passkeys with it, you must first enable screen lock on your Android device, as this stops people with access to your smartphone from utilising your passkeys. 

In both Windows 10 and Windows 11, you can use Microsoft's Windows Hello to sign into your accounts using passkeys. Because your passkeys are linked to your Microsoft account, you may use them on any device as long as you're signed in.

Regarding your web browser, passkeys are currently supported by Chrome, Edge, Safari, and Firefox. For Chrome/Edge, you must be using version 79 or above, for Safari, version 13 or higher, and for Firefox, version 60 or higher.
Read more »
Technology
Cyber Privacy Cyberattacks CyberCrime Encryption Password Privacy Software Technology

Tech Issues Persist at Minneapolis Public Schools

 


Students and staff from Minneapolis Public Schools returned to their school buildings this week. However, the ongoing issues resulting from a cyberattack that occurred in the district caused disruptions to continue for the remainder of the week. 

There was an update to the district's attendance and grades system on Tuesday, and the system was working without a hitch. There are still some teachers who have difficulty logging into the programs, said Greta Callahan, the teacher chapter president of the Minneapolis Federation of Teachers. It was decided to cancel Monday's after-school activities because there was a problem that needed to be addressed. 

There have been a few email updates from district officials to parents regarding the "technical difficulties" that have occurred due to an "encryption event", but they have not explained what caused them to have these difficulties. So far, some of the district's information systems have been unavailable for a week as a result of these problems. 

The description of an "encryption event" may seem vague, but a ransomware attack could be what was happening, according to Matthew Wolfe, vice president of cybersecurity operations at Impero Software, a company that provides education software among other things. 

School districts have become more and more targeted in recent years as a result of terrorist attacks. As a result of the rapid transition to distance learning at the beginning of the pandemic, Wolfe believes districts became easier targets for the aforementioned disease. 

"With the increase in the number of devices, more areas are likely to be affected," Mr. Alexander explained, adding that because of the push to make e-learning accessible to all students at home, protection is often pushed to the back burner. 

The recent spate of cyberattacks has made headlines repeatedly in recent months: A cyberattack in January forced schools in the Des Moines area to cancel classes. Los Angeles Unified, the country's second-largest school district, has been attacked by ransomware, reportedly from Vice Society, in the wake of the alleged attack. The dark web has been crawled by about 2,000 students following that incident, with their psychological examinations being uploaded. 

There had not been any update from the Minneapolis district by the end of the school day Tuesday about what caused the incident and its cause. At a closed meeting held Tuesday night, a presentation on security issues related to IT would be made to the school board members. 

The Minneapolis district has released an update on its investigation into whether personal information was compromised, and it has found no evidence of this. 

However, the staff was tasked with resetting the passwords and guiding students through the procedure. 

On Monday, as a result of teacher frustration, Callahan reported that teachers were having difficulties resetting student passwords. As a result, teachers had to come up with creative ways to come up with a wide variety of workshops and activities for the students since printers were also down. 

There is a need for more transparency in the district's administration, according to Callahan. There does not seem to be anything else involved in this process other than just hoping everything works out by Monday. 

Parents have repeatedly been informed that district officials have worked with external IT specialists and school IT personnel "around the clock" to investigate the root cause of this attack and to understand what is transpiring on the computer systems as a result of it. 

When a cyberattack occurs at any time of day or night, school IT professionals are unavoidably overwhelmed and try to protect their schools constantly. "They're going through a really tough time right now for a district and it's going to be a long process," he said. 

Despite recent events that indicate Minneapolis schools may have been targeted, Wolfe said he believes it's likely that the schools have been targeted because of a 2020 incident that nearly caused the school district to incur a $50,000 loss. It is cyber fraud that occurs when payments are made to a fraudulent account to defraud a legitimate contractor. 

Minneapolis Public Schools said in a statement that the money had been safely returned to the district. They added that additional protocols had been implemented as a result. 

That incident was covered in a Fox 9 report that was published in February. In his testimony, Wolfe stated that a hacker engaged in a targeted attack is looking for vulnerabilities in a potential target. 

Several stories have been reported in the news about staffing shortages in Minneapolis. These include the district's financial outlook, as well as the absence of a permanent superintendent in the district, Wolfe said. As Wolfe pointed out, even the fact that the district is preparing to launch a new website to the public may garner hacker interest. 

"There is no doubt that this is an easy target to steal from because of all those digital footprints," Wolfe told.   
Read more »
Technical Issue
Cyber Security Eurostar Eurostar rail service Password Security Bug Technical Issue

Eurostar: Users Forced Into Resetting Passwords, Then Fails and Locks Them Out


Eurostar, the International high-speed rail operator has recently been emailing its customers this week, enticing them into resetting their account passwords in a bid to “upgrade” security. 

But, when users click the password reset link, "technical issues" are apparently keeping them from changing their passwords or logging into their accounts. 

Eurostar Password Reset Bug is Locking Passengers Out 

The company, renowned for linking countries like the UK to France, Belgium, and the Netherlands with most of its trains crossing the Channel Tunnel, has been emailing customers where the railway operator would claim to be “busy” upgrading the account security for its customers. 

Apparently, the email would read “Dear customer, we’ve been busy upgrading our security to protect your account and your personal details. To continue using your Eurostar account, you’ll need to reset your password. If you also use the Eurostar mobile app, you’ll need to update it to the latest version.” 

Nevertheless, clicking the "reset password" link and following the navigation is ineffective. Users instead encounter the following error message: "Sorry, we're having a few technical problems so we can't send the email at the moment. Please try again a little later." 

That bug has caused immense frustration among Eurostar passengers and users around the globe who are now effectively locked out of their accounts. 

Users are shown the password reset interstitial after each successful login attempt, which prevents them from accessing their accounts until they reset their passwords. However, owing to the aforementioned technical problem, the password reset never occurs. 

In regards to the issue, a user tweets “@Eurostar how to tell your customers you hate them without saying it: lock everyone’s account and make it impossible to reset their password.” Moreover, it was observed that the perplexed users, were mistaking Eurostar’s legitimate email for a phishing attempt. 

Ongoing Maintenance to Blame? 

In a lengthy Twitter thread on Friday, Eurostar acknowledged that users were experiencing problems accessing their Club Eurostar accounts and attributed this to ongoing maintenance. Yet, this was before the business started sending out emails for password resets. 

Among many instances, customers have complained that their reservations and data were "lost" from their accounts. 

The railway operator, at the time, advised users to clear their browser cookies or re-attempt registration with the same email address. Although, nobody seems to benefit from this as a solution. 

The last time a comprehensive password reset was implemented by Eurostar was in 2018 following a data breach, as The Telegraph at the time reported. 

It is still unclear whether the forced password reset is really Eurostar's attempt to increase account security or if it is a response to a cybersecurity issue like system compromise or data breach. 

In regards to the situation, a Eurostar spokesperson addresses the issue with the statement, “our customers were contacted to reset their password following an update to our customer authentication system. The sudden volume of customers who attempted to do this caused some technical difficulties and we are working to resolve this as soon as possible. We apologize for any inconvenience this has caused.”  

Read more »
Privacy
Common Password Netflix Password Password Security Privacy

New Password-sharing Rule from Netflix Can Annoy Users


Netflix puts a stop to password-sharing

Netflix is bringing new rules to stop password sharing. It can be good news for Netflix and its investors hoping to increase revenue. But it surely is bad news for customers, their families, and their friends.  

So Netflix is using a unique multi-step process for bringing out this unpopular change. First, it warned everyone about it in advance. After that, it slowly started bringing out changes in secondary markets in Latin America before touching the Canada and U.S., where Netflix gets 44% of its revenue. 

When will the new password-sharing rule apply

The company said that new changes might come in more places in the first months of 2023. In its newest edition, it has given more information about how the password crackdown might actually help, but it hasn't provided enough info for customers to understand how it will affect them. Or when. 

These are smart tactics from a smart company. The reaction to this latest change on social media and media is not positive. By the time these new changes are implemented in the U.S., it will feel like old news. 

Users who do password sharing may actually create new accounts, or switch to other streaming platforms like Amazon Prime, Disney+, or Hulu instead. The new rule might also trigger some existing customers to cancel their subscriptions. However, it is unlikely to see large numbers of people quit Netflix because the outrage will be dampened by then. 

New password-sharing rules will annoy users

Even if you're not a user who shares their Netflix password, the new rules can annoy you at some point- if you're traveling or watching Netflix at a cafe or at someone else's home. Netflix said the user might be asked to verify their devices in certain situations when the user is away from home. The company assures that "Verifying a device is quick and easy." 

If the process sounds complex to you, you may be thinking "how many times will I have to go through this process." Unfortunately, there's no immediate answer to this as Netflix hasn't provided many details about that. It said that if a user is away from a Netflix household for a certain amount of time, you may be sometimes asked to verify their device. 

Password-sharing may ask for periodic verifications

The rules also say that the user may have to verify their device "periodically." But if you're at home, you won't have to do it as Netflix will recognize your device from your IP address and device ID. It can annoy users who are concerned about sharing their data. 

Is the crackdown on password sharing a stupid move, especially during a time when streaming platform competition is at an all-time high? Or was Netflix foolish in the past to have a rule that it knew people would break? Will the vast number of freeloaders really buy their own Netflix accounts, or will they simply ask their friends to share the 4-digit OTP? 

We will know the answers only when the new password-sharing rule is brought in.

Read more »
Subscribe to: Posts (Atom)