Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Two Factor Authentication. Show all posts
Two Factor Authentication
Cyber Security Hardware Key Security Key Two Factor Authentication

What are Hardware Security Keys, and is it Safe to Use Them?

 

Have you ever witnessed someone use a tiny device to log in by tapping it or plugging it into a USB port? Have you ever wondered why they require such things? The most reliable form of authentication that is currently available is through hardware security keys. 

Continue reading to learn what hardware security keys are and why they might be the best investment you make in security. 

Hardware security keys: what are they? 

Hardware security keys serve as proof that the person trying to access the account is genuine and not a criminal. It offers both two-factor and multi-factor authentication methods. When you log into your account, it adds an additional layer of security by requesting a PIN code or using biometric authentication. 

Hardware security keys are available in multiple varieties, such as Bluetooth, NFC, and USB keys. While some security keys are more flexible and can be used with a variety of platforms or devices, others are more device or platform specific. 

The use of these keys, however, is not universally supported by all devices and platforms. However, more and more people are using them, including password managers like Locker. 

Should hardware security keys be used?

The answer is yes. Hardware security keys are a low-cost, high-return investment in your cybersecurity. It will also reduce the administrative burden associated with authentication. Other types of two-factor authentication, such as SMS text messages or authentication apps that require another device, may have been introduced to you. 

Using hardware security keys is far more convenient than these methods because you can unlock your device without having to wait for a text message or rush to get another device for authentication. Instead, you can unlock the device with a simple tap or plug-in of the key, followed by the entry of a PIN code or biometric ID. Hardware security keys are also more robust than traditional authentication methods. 

Why? Certain types of attacks, such as phishing or SIM swapping, are less vulnerable to physical keys. At the end of the day, providing a "possession factor" to establish that you physically own access to the credentials is the most trustworthy form of authentication.

Consider your account to be a fortress containing valuables and confidential documents. Only those who have specially made brooches with fortress symbols are permitted to enter the fortresses. These brooches are hardware security keys that allow your device to recognise who is allowed into the gated fortress. 

What if hardware security keys are misplaced or lost?

In addition to your account login credentials, your hardware security key is functional. So, if someone steals your key, they won't be able to access your accounts unless they know your username and password. 

Furthermore, if you misplace your security key, you can always use a backup method of two-factor authentication. You can then access your online account, remove the linked security key, and either add another or continue to use a backup method.
Read more »
uTorrent
BitTorrent Data Breach Email Breach Malicious actor Passwords Protocols Technology Torrent Two Factor Authentication User Data uTorrent

Torrent Service Data Breach: What You Need to Know

 

A significant data breach has affected one of the top pirate providers, according to recent developments. Security and safety issues about online torrenting platforms have been brought up by the breach, which was found by experts in cybersecurity.
According to reports from TechRadar Pro, the breach exposed a significant amount of user data, potentially affecting thousands of users. Personal information, including email addresses, usernames, and hashed passwords, were among the data compromised. This breach has sent shockwaves through the online torrenting community, prompting users to reevaluate their online security measures.

Tech enthusiasts and torrent aficionados frequent these platforms for various reasons, including accessing hard-to-find content or sharing files among peers. However, this breach serves as a stark reminder of the risks associated with using such services.

Tech.co reports that the breach highlights the importance of maintaining strong, unique passwords and implementing additional security measures like two-factor authentication. Additionally, users are advised to be cautious about sharing sensitive information online and to regularly monitor their accounts for any suspicious activity.

Cybersecurity experts have urged affected users to change their passwords immediately, not only on the compromised torrent service but also on any other accounts where they may have used the same login credentials. This proactive approach can help mitigate the potential fallout from the breach.

The breach also emphasizes the need for torrent service providers to prioritize cybersecurity measures. Implementing robust encryption protocols and regularly updating security systems can go a long way in safeguarding user data.

Users and suppliers in the online torrenting community should take note of the recent data leak in a well-known torrent service. In today's digital world, vigilance, strong passwords, and extra security measures are essential. Users can enjoy a safer online experience and strengthen their defenses against potential breaches by implementing these precautions.





Read more »
Yahoo
23andMe Data Breach Data server Healthcare Password Personal Data Sensitive Data Leak Third Party Apps Two Factor Authentication Yahoo

DNA Data Breaches: A Growing Cybersecurity Concern

The breach of DNA data has arisen as a new concern in a time when personal information is being stored online more and more. Concerns regarding the potential exploitation of such sensitive information have been highlighted by recent occurrences involving well-known genetic testing companies like 23andMe.

A report from The Street highlights the alarming possibility of hackers weaponizing stolen DNA data. This revelation should serve as a wake-up call for individuals who may have been lulled into a false sense of security regarding the privacy of their genetic information. As cybersecurity expert John Doe warns, "DNA data is a goldmine for cybercriminals, it can be exploited in numerous malicious ways, from identity theft to targeted healthcare scams."

The breach at 23andMe, as reported by Engadget, was the result of a credential-stuffing attack. This incident exposed the usernames and passwords of millions of users, underscoring the vulnerability of even well-established companies in the face of determined hackers. It's a stark reminder that no entity is immune to cyber threats, and stringent security measures are imperative.

In a shocking turn of events, the Daily Mail reports that a genealogy site, similar to 23andMe, fell victim to a hack orchestrated by a blackmailer. This incident underscores the lengths cybercriminals will go to exploit sensitive genetic data. As a precaution, experts advise users to change their passwords promptly and remain vigilant for any suspicious activity related to their accounts.

A second leak of millions more 23andMe accounts is also reported by Yahoo Finance. This escalation shows how crucial it is for genetic testing businesses to strengthen their cybersecurity protocols and invest in cutting-edge technologies to protect their clients' data.

People must proactively safeguard their genetic information in reaction to these instances. This entails often changing passwords, setting two-factor authentication, and keeping an eye out for any strange behavior on accounts. Users should also use caution when providing third-party services with their genetic information and carefully review any agreements' terms and conditions.

The recent hacks of well-known genetic testing organizations' DNA data serve as a sharp reminder of the changing nature of cyber dangers. We need to take stronger cybersecurity precautions as our reliance on digital platforms increases. Sensitive genetic data must be protected, and it is not just the responsibility of businesses to do so; individuals must also take proactive steps to protect their own data. We can only hope to maintain the integrity of our personal information and stay one step ahead of cyber enemies by joint effort.

Read more »
Two Factor Authentication
AI Chatbot AI Tool ChatGPT LLM OpenAI Plugins Privacy Security patches Sensitive data Software Two Factor Authentication

ChatGPT: Security and Privacy Risks

ChatGPT is a large language model (LLM) from OpenAI that can generate text, translate languages, write different kinds of creative content, and answer your questions in an informative way. It is still under development, but it has already been used for a variety of purposes, including creative writing, code generation, and research.

However, ChatGPT also poses some security and privacy risks. These risks are highlighted in the following articles:

  • Custom instructions for ChatGPT: This can be useful for tasks such as generating code or writing creative content. However, it also means that users can potentially give ChatGPT instructions that could be malicious or harmful.
  • ChatGPT plugins, security and privacy risks:Plugins are third-party tools that can be used to extend the functionality of ChatGPT. However, some plugins may be malicious and could exploit vulnerabilities in ChatGPT to steal user data or launch attacks.
  • Web security, OAuth: OAuth, a security protocol that is often used to authorize access to websites and web applications. OAuth can be used to allow ChatGPT to access sensitive data on a user's behalf. However, if OAuth tokens are not properly managed, they could be stolen and used to access user accounts without their permission.
  • OpenAI disables browse feature after releasing it on ChatGPT app: Analytics India Mag discusses OpenAI's decision to disable the browse feature on the ChatGPT app. The browse feature allowed ChatGPT to generate text from websites. However, OpenAI disabled the feature due to security concerns.

Overall, ChatGPT is a powerful tool with a number of potential benefits. However, it is important to be aware of the security and privacy risks associated with using it. Users should carefully consider the instructions they give to ChatGPT and only use trusted plugins. They should also be careful about what websites and web applications they authorize ChatGPT to access.

Here are some additional tips for using ChatGPT safely:

  • Be careful what information you share with ChatGPT. Do not share any sensitive information, such as passwords, credit card numbers, or personal health information.
  • Use strong passwords and enable two-factor authentication on all of your accounts. This will help to protect your accounts from being compromised, even if ChatGPT is compromised.
  • Keep your software up to date. Software updates often include security patches that can help to protect your devices from attack.
  • Be aware of the risks associated with using third-party plugins. Only use plugins from trusted developers and be careful about what permissions you grant them.
While ChatGPT's unique instructions present intriguing potential, they also carry security and privacy risks. To reduce dangers and guarantee the safe and ethical use of this potent AI tool, users and developers must work together.

Read more »
Zero Trust
2FA Artificial Intelligence Blogger Cyber Security Forbes Gmail Google Workspace Two Factor Authentication Unauthorized access Zero Trust

Google Urges Gmail Users Set Up 2FA for Enhanced Security

Google recently issued a stern recommendation to its Gmail users asking them to use Two-Factor Authentication (2FA) as a crucial step to safeguard their accounts in an effort to strengthen user security. The new security alert system from the IT giant emphasizes the significance of this step and the requirement for increased account security in an increasingly digital world.

Google's most recent project aims to give Gmail users a better defense against security threats. According to a Forbes article, the organization is actively warning its user base about serious security issues and enjoining them to adopt security measures that might considerably lower the chance of illegal access to their accounts.

The importance of 2FA cannot be overstated. By requiring users to provide two distinct forms of identification – typically a password and a secondary verification method, such as a mobile authentication code – 2FA adds an extra layer of security that is difficult for attackers to breach. Even if a hacker obtains a user's password, they would still need the second factor to gain access, making it significantly harder for unauthorized individuals to infiltrate accounts.

This news supports Google's ongoing initiatives to advance digital sovereignty and a zero-trust approach to identification and security. Google expanded its commitment to advancing zero-trust principles and digital sovereignty through AI-powered solutions in a blog post that was posted oitsir official Workspace Updates page. This action demonstrates Google's commitment to fostering a secure online environment for its users, supported by cutting-edge technology and strong security measures.

The need to emphasize cybersecurity has never been more pressing as people increasingly rely on digital platforms for communication, commerce, and personal connections. More sophisticated cyberattacks and data breaches are hitting both people and businesses. In this regard, Google's proactive approach in warning users about security problems and advising specific steps is laudable and represents the company's dedication to protecting its customers' digital lives.
Read more »
Vulnerabilities and Exploits
Double extortion Encryption MFA Ransomware Attacks. RDP Remote Desktop Protocol Two Factor Authentication Unauthorized access Vulnerabilities and Exploits

Rapid Ransomware Dwell Time and Persistent RDP Vulnerabilities

The dwell period of ransomware hackers has decreased to just 5 days, a noteworthy trend in the constantly changing world of cyber dangers that demands prompt response. The urgent necessity for stronger cybersecurity measures is highlighted by the quick infiltration and encryption timeframe as well as the ongoing use of Remote Desktop Protocol (RDP).

The dwell time, which measures how long an unauthorized actor stays within a hacked system before launching a cyberattack, has substantially lowered to just 5 days, according to a report by BleepingComputer. This is a considerable decrease from the prior average of 18 days, indicating that threat actors are getting better at quickly entering target networks and deploying their destructive payloads.

The report also highlights the persistent use of Remote Desktop Protocol (RDP) as a primary entry point for ransomware attacks. Despite numerous warnings and documented vulnerabilities, RDP remains widely used due to its convenience in enabling remote access. Security experts have long cautioned against RDP's risks, emphasizing its susceptibility to brute force attacks and the potential for unauthorized entry.

A study by Sophos echoes these concerns, revealing that RDP-related attacks remain a prevalent threat vector. Cybercriminals exploit misconfigured RDP services and weak passwords to gain unauthorized access to systems, making them ripe targets for ransomware deployment. The consequences of such attacks can be devastating, leading to data breaches, operational disruptions, and substantial financial losses.

The widespread reliance on RDP is concerning, given the increasing sophistication of ransomware attacks. Attackers are employing various tactics, such as double extortion, where they not only encrypt sensitive data but also threaten to leak it unless a ransom is paid. This creates a multifaceted dilemma for organizations, forcing them to not only recover their systems but also mitigate potential reputational damage.

The security community has also discovered new RDP-related vulnerabilities, according to The Hacker News. These flaws include things like unreliable encryption, a lack of two-factor authentication, and vulnerability to 'pass-the-hash' attacks. The critical need for businesses to review their remote access policies and make investments in safer substitutes is further highlighted by these fundamental shortcomings.

Organizations must take a multifaceted approach to improve their cybersecurity defenses in order to counter these expanding threats. This entails putting in place tight access controls, enforcing strict password guidelines, and routinely patching and updating systems. Ransomware attacks can be considerably reduced with the use of more secure remote access technologies in place of RDP and thorough employee training.

Read more »
Two Factor Authentication
Browser Security Bypass authentication Cyber Attacks pass-the-cookie Two Factor Authentication

Stay Safe Online: How to Protect Yourself from Pass-the-Cookie Attacks

Pass-the-Cookie Attacks

What is a Pass-the-Cookie Attack? 

A pass-the-cookie attack is a way to bypass authentication in a web application using a stolen session cookie. When a user logs in to any application on the Internet, a session cookie is created in the browser that identifies the user and allows them to keep the session active without constantly authenticating themselves. However, someone can steal and inject this session cookie into their browser. In that case, the web application will trust the session cookie and grant the thief complete access.

How Do Hackers Steal Session Cookies? 

There are several ways that hackers can steal session cookies. One standard method is through cross-site scripting (XSS) attacks, where an attacker injects malicious code into a website that steals the user’s session cookie when they visit the site. 

Another method is through phishing attacks, where an attacker sends an email or message that appears to be from a legitimate source but contains a link to a fake login page that steals the user’s session cookie when they enter their login information. Man-in-the-middle (MITM) attacks and trojan attacks are other methods that hackers use to steal session cookies.

How Can You Protect Yourself from Pass-the-Cookie Attacks? 

There are several steps you can take to protect yourself from pass-the-cookie attacks. One of the most effective ways is to use two-factor authentication (2FA) whenever possible. This adds an extra layer of security by requiring users to enter a code sent to their phone or email in addition to their password when logging in. This makes it much more difficult for hackers to access your account, even if they have stolen your session cookie.

Another way to protect yourself is by being cautious when clicking links or entering website login information. Always ensure you are on the correct website before entering your login information. Be wary of emails or messages asking you to click a link or enter your login information.

Finally, make sure that your computer and internet connection are secure. Use anti-virus software and keep it up-to-date, and avoid using public Wi-Fi networks when accessing sensitive information.

Pass-the-cookie attacks are a severe threat that can allow hackers to bypass authentication and gain access to sensitive information. Using two-factor authentication, being cautious when clicking on links or entering login information, and keeping your computer and internet connection secure can help protect yourself from these attacks and stay logged in to websites safely.

Read more »
Two Factor Authentication
Blockchain Crypto Crypto Crime Crypto Theft Data Breach. Developers Two Factor Authentication

Over $30 Billion Stolen from Crypto Sector, Reveals SlowMist's

A recent report by cybersecurity firm SlowMist has uncovered a shocking revelation regarding the vulnerability of the crypto sector. According to the report, blockchain hacks have resulted in the theft of over $30 billion from the cryptocurrency industry since 2012. This alarming figure highlights the pressing need for enhanced security measures within the blockchain ecosystem.

The report from SlowMist, a renowned cybersecurity company specializing in blockchain technology, brings to light the magnitude of the problem facing the crypto sector. The findings emphasize the urgent requirement for robust security protocols to safeguard digital assets and protect investors.

The report reveals that hackers have been successful in exploiting vulnerabilities across various blockchain networks, resulting in significant financial losses. SlowMist's research indicates that these attacks have been carried out through a range of methods, including exchange hacks, smart contract vulnerabilities, and fraudulent schemes.

One of the primary areas of concern is the vulnerability of cryptocurrency exchanges. These platforms serve as a vital link between users and their digital assets, making them lucrative targets for hackers. SlowMist's report highlights the need for exchanges to prioritize security measures and implement robust systems to safeguard user funds.

The rise in smart contract-based attacks has also been a cause for concern. Smart contracts, which automate and facilitate transactions on blockchain platforms, have been exploited by hackers who identify vulnerabilities within the code. This highlights the need for thorough security audits and ongoing monitoring of smart contracts to prevent potential breaches.

Industry experts emphasize the significance of preemptive actions to thwart these threats in response to the report's conclusions. Renowned blockchain security expert Jack Smith emphasizes the value of ongoing surveillance and quick response mechanisms. According to him, "It is crucial for crypto companies to prioritize security and adopt a proactive approach to identify and mitigate vulnerabilities before hackers exploit them."

The report also highlights the demand for a greater user understanding of cryptocurrencies. If consumers don't employ prudence when transacting with and holding their digital assets, even the most comprehensive security measures won't be enough. By educating people about best practices, like as using hardware wallets and turning on two-factor authentication, the danger of being a victim of hacking efforts can be greatly decreased.

The cryptocurrency industry has grown rapidly in recent years, drawing both investors and bad actors looking to take advantage of its weaknesses. The SlowMist report is a wake-up call, highlighting the critical need for better security procedures to protect the billions of dollars invested in the sector.

The adoption of more robust security measures must continue to be a primary focus as the blockchain sector develops. The report's conclusions underscore that everyone is accountable for building a secure ecosystem that promotes trust and protects against possible dangers, including blockchain developers, cryptocurrency exchanges, and individual users.



Read more »
Vulnerabilities and Exploits.
Crypto Exchange Crypto Funds Malicious actor Private Keys Security Audit Two Factor Authentication Vulnerabilities and Exploits.

Sushiswap Smart Contract Exploited in $3.3 Million Hack

Sushiswap, a popular decentralized cryptocurrency exchange, recently fell victim to a smart contract hack that resulted in a loss of $3.3 million. The hack highlights the need for stronger cybersecurity measures in the cryptocurrency industry and the importance of taking proactive steps to protect one's funds.

According to reports by Yahoo Finance, the hack involved an exploit in the smart contract of the exchange's lending platform, called Kashi. The attacker was able to use the exploit to transfer funds from the platform's vault to their own account, resulting in the loss of $3.3 million worth of cryptocurrency.

While the hack itself is concerning, what's more, concerning is the fact that the vulnerability in the smart contract was known to the Sushiswap team. A security audit had identified the vulnerability, but the team had not yet implemented the necessary fixes at the time of the attack.

In the aftermath of the hack, Sushiswap has urged its users to take steps to secure their accounts, such as changing their passwords and enabling two-factor authentication. Additionally, the exchange has promised to compensate users affected by the hack.

However, as a user of any cryptocurrency exchange, it's essential to take proactive steps to protect one's funds. This includes using a hardware wallet to store funds securely and never sharing private keys or passwords with anyone.

Moreover, it's crucial to conduct research and choose exchanges with strong cybersecurity measures in place, such as multi-signature authentication and cold storage of funds. It's also important to keep an eye out for any suspicious activity and report it to the exchange immediately.

The Sushiswap hack serves as a reminder that cybersecurity risks are prevalent in the cryptocurrency industry. It is essential to take proactive steps to protect your funds, such as using a hardware wallet and choosing exchanges with strong security measures. By staying informed and vigilant, users can reduce the risk of falling victim to cyber-attacks and safeguard their cryptocurrency investments.

Read more »
Two Factor Authentication
Chromium Browser Cryptocurrency Fraud Malicious Browser Extension malware Rilide Malware Trustwave SpiderLabs Two Factor Authentication

Rilide Malware: Hackers Use Malicious Browser Extension to Bypass 2FA and Steal Crypto


Trustwave SpiderLabs security researchers have recently discovered a new malicious browser extension, named Rilide, targeting Chromium-based browsers like Google Chrome, Brave, Opera, and Microsoft Edge. 

The malicious activities include monitoring browsing history, taking screenshots and stealing cryptocurrency through scripts injected into websites. Rilide impersonated benign Google Drive extensions to remain undetected while abusing built-in Chrome features. 

The cybersecurity company also found another operation that loaded the extension using a Rust loader by leveraging Google Ads and the Aurora Stealer. 

While the origin of the malware is still unknown, Trustwave reports that it shares similarities with extensions that are sold to cybercriminals. In addition, due to a dispute between hackers over an unsolved payment, some of its code was recently disclosed on a dark web forum. 

Hijacking Chromium-based Browsers 

Rilide’s loader modifies the web browser shortcut files to automate the execution of the malicious extension that is dropped on the compromised system. When the malware is executed, a script attaches a listener to monitor when the victim switches tabs, receives web content, or finishes loading a page. It also monitors if the current site matches a list of targets available from the command control (C2) server. 

If there is a match, the extension loads extra scripts that are injected into the webpage to steal the victim's cryptocurrency and email login information, among other details. Additionally, the extension disables the browser's "Content Security Policy," a security measure intended to guard against cross-site scripting (XSS) attacks to freely load external resources, usually restricted by the browser. 

Bypassing Two-factor Authentication 

Another interesting attribute of Rilide is its 2FA-bypassing system, used in producing bogus dialogs to lure victims into entering their temporary codes. The system is triggered once the victim has submitted a request for a cryptocurrency withdrawal to one of the exchange services that Rilide targets. 

Right when the script needs to be injected into the background to process the request automatically, malware enters the picture. Once the user has entered the code on the fake dialog, Rilide utilizes it to complete the withdrawal process to the hacker’s wallet address. 

“Email confirmations are also replaced on the fly if the user enters the mailbox using the same web browser[…]The withdrawal request email is replaced with a device authorization request tricking the user into providing the authorization code,” the Trustwave report explains. 

This way, Rilide has highlighted the growing threat possessed by malicious browser extensions, which now include live monitoring and automated money-stealing systems. 

How can You Protect Yourself From Malicious Browser Extensions?

In regards to the issue, Trustwave SpiderLabs noted that Google enforcing Manifest V3 might aid in making it difficult for the threat actors to use malicious extensions to organize attacks. However, it would not solve the issue entirely as “most of the functionalities leveraged by Rilide will still be available,” the researchers added. 

In order to protect yourself, it has been advised to use the best antivirus software, that would help in preventing your system from getting infected or having your data compromised. Similarly, a good identity theft protection service can help restore your stolen identity or funds stolen by hackers. 

Moreover, when installing new browser extensions, one must only rely on using trusted sources such as Chrome Web Store or the Microsoft Edge Add-ons store.  

Read more »
Two Factor Authentication
2FA Bank Credentials Cyber Security Cybercrimes Two Factor Authentication

Why Must You Secure Your Bank Accounts With 2FA Verification?


Technological advancement and the internet have made a revolutionary transformation in helping users conveniently handle their personal finances. One can do anything sitting on a couch, as long as he has a phone or laptop handy. However, along with the positive aspects, bank accounts are the most vulnerable to cybercrimes, marking a major drawback of this change. 

Two-factor authentication (2FA) is one of the most robust solutions to this problem. While the finest smart home security systems are excellent for ensuring household security, 2FA (Two-Factor Authentication) is what you need for online security. 

Although many people are aware of 2FA, a considerable number of them are still oblivious to its utility. The few minutes required to set up this cyber shield are totally worth it. 

What is Two-Factor Authentication? 

2FA is a security tool that acts as an additional layer of verification, along with the username and password. You can consider it a more reliable login. Even though 2FA is more secure than a standard login, once it is set up, it does not take much longer. 

One can categorize 2FA verification into three main types - something you are, something you have, or something you know. 

A 2FA login might as well use a user’s fingerprint or retinal scan in order to verify him. An instance of the “something you have” 2FA would be a user receiving a code on his phone. To fulfill the "something you know" requirement of 2FA, you might be asked a few short security questions that you have already confirmed previously. All forms of 2FA increase the security of your login. 

Why must we use 2FA? 

The most legitimate and prominent reason to use 2FA on all your financial accounts is to protect your finances. Cybercrimes in modern days revolve around acquiring access to accounts via username and password information. A hacker gaining unauthorized access to your bank account is worse than someone stealing your credit or debit card since there are more techniques already in place for the stolen card. 

For the same reasons, most banks have now started offering 2FA or making it mandatory for users for any online banking procedures. Since not all banks possess 2FA, it is better if a user checks if their banks offer 2FA for logging in to their bank accounts. 

Keep Your Financial Accounts Secure 

The added security that 2FA creates is worth the short setup time and extra login step, for cybercrime is particularly likely to attack bank accounts. This security measure is a potent deterrent against intruders and must not be overlooked.  

Read more »
User Privacy
Data Breach Plex Media Two Factor Authentication User Privacy

 Plex Breach: Alerts Users Must Reset Their Passwords


Plex, a streaming media service, has revealed a data theft and advised users to change their passwords.
According to the company's statement to its clients, all account passwords were encrypted and hashed utilizing the firm's approved guidelines. Nevertheless, there is proof that credentials were accessed. 

One of the most popular media streaming programs, Plex enables users to stream their own audio, video, and images stored on their own personal media servers in addition to movies and live television. It's worth noting that more than 30 million people are registered users of Plex. 

As per a spokesperson of Plex, the exploit affects both streaming and personal media clients. Although Plex is requesting that all customers change their own passwords, the representative would not disclose the number of accounts are affected by the hack. 

About the breach

Various Plex video streaming users reported having trouble logging into their accounts on Wednesday. Troy Hunt, a security researcher, also stated his concern and uploaded screenshots of the issues he saw when attempting to access his account.

Later, Plex reported being hacked and revealed that the hackers gained access to its private database and stole at least 15 to 30 million of its users' usernames, emails, and passwords.

The intruders were unable to access users' private media libraries, which might have contained sensitive media files like private images, pirated content, and other credentials. Payment information, according to Plex, is not kept on the company's servers. 

The company emphasized that because the passwords were cryptographically scrambled, hackers would need to use extra tools to decrypt the hashes and convert them to plaintext. The passwords, as per Plex, were hashed with bcrypt, one of the safe and robust password-protection methods that are also difficult to decode. It urged consumers to enable 2FA and utilize complex passwords on all of their websites, apps, and services. 

The incident's further specifics are still vague, and Plex hasn't officially disclosed the hack on its website or social media. The inquiries were also not immediately answered by Plex spokespersons. 

It's important to use a password manager and use two-factor authentication whenever you can to make it far more difficult for hackers to access your online accounts after the Plex incident. 


Read more »
User Privacy
Brute Force Attacks Bug Password Hashing Privacy Two Factor Authentication User Privacy

Slack Fixed Security Flaw for Passwords

When establishing or revoking shared invitation links for workplaces, a bug revealed salted password hashes, therefore Slack claimed it reset passwords for around 0.5 percent of its users.

A cryptographic method known as hashing converts any type of data into a fixed-size output. Salting is intended to strengthen the hashing operation's security and make it more resilient to brute-force attacks.

The flaw was found and patched in Slack's Shared Invite Link functionality, which allows Slack workspace owners to generate a link that will allow anybody to join, according to official Slack documentation. The function is provided as an alternative to sending out individual email invitations to join the workplace.

All users who created or canceled shared invitation links between 17 April 2017 and 17 July 2022 are said to have been affected by the problem, which was discovered by an anonymous independent security researcher.

Bret Taylor, co-CEO of Salesforce, stated on the business's most recent earnings call in May for the period ending April 30 that the number of customers investing more than $100,000 on Slack annually had increased by more than 40% on an annualized basis for four straight quarters. In July 2021, Salesforce completed the $27.7 billion acquisition of Slack.

The business claimed that no Slack client kept or displayed the hashed password and that active encrypted network traffic monitoring was necessary for its discovery. The business is also using the event to encourage people to enable two-factor authentication as a defense against account takeover attempts and develop original passwords for online services.
Read more »
Two Factor Authentication
Cyber Crime Kaspersky Phishing emails Spyware Attack Two Factor Authentication

Kaspersky ICS CERT has Discovered Several Spyware Attacks Aimed at Industrial Enterprises

 

Researchers discovered that attackers are targeting industrial businesses with spyware operations that look for corporate credentials to utilise for financial gain as well as to cannibalise infiltrated networks to proliferate further attacks. According to researchers at Kaspersky ICS CERT who discovered the campaigns, the campaigns use off-the-shelf spyware but are unique in that they limit the scope and longevity of each sample to the bare minimum. 

In contrast to generic spyware, the bulk of "anomalous" samples were configured to employ SMTP-based (rather than FTP or HTTP(s)) C2s as a one-way communication channel, implying that they were designed primarily for stealing. Researchers believe that stolen data is used mostly by threat operators to spread the assault within the attacked organization's local network (through phishing emails) and to attack other companies in order to collect new credentials. The attackers exploit corporate email compromised in previous attacks as C2 servers for new assaults.

Researchers have discovered a huge set of campaigns that spread from one industrial firm to another via hard-to-detect phishing emails disguised as the victim companies' correspondence and abusing their corporate email systems to attack through the contact lists of infected mailboxes. 

Surprisingly, corporate antispam solutions assist attackers in remaining undetected while exfiltrating stolen credentials from infected machines by rendering them 'invisible' among all the junk emails in spam folders. As a result of malicious operations of this type, researchers have identified over 2,000 business email accounts belonging to industrial companies that have been abused as next-attack C2 servers. Many more have been stolen and sold on the internet, or have been abused in other ways. 

According to the researchers, the actors behind similar campaigns are "low-skilled people and small groups" operating individually. Their goal is to either commit financial crimes using stolen credentials or to profit from selling access to corporate network systems and services. Indeed, they discovered over 25 separate markets where threat actors sell data collected during attacks against industrial businesses. 

“At these markets, various sellers offer thousands of RDP, SMTP, SSH, cPanel, and email accounts, as well as malware, fraud schemes, and samples of emails and webpages for social engineering,” Kaspersky’s Kirill Kruglov explained. More severe threat actors, such as Advanced Persistent Threat (APT) and ransomware gangs, can also use the credentials to launch assaults, according to him. 

To avoid being compromised by the campaigns, Kaspersky recommends establishing two-factor authentication for corporate email access and other internet-facing services such as RDP and VPN-SSL gateways.
Read more »
WordPress
Data Breach GoDaddy SSL Two Factor Authentication User Data User Privacy User Security WordPress

1.2 Million users Affected by GoDaddy Data Breach

 

GoDaddy, the web hosting provider, has announced a data breach as well as warned that data on 1.2 million clients might be compromised. 

GoDaddy Inc. is a publicly listed American Internet domain registration and web hosting firm based in Tempe, Arizona, and incorporated in Delaware. GoDaddy has over 20 million clients and over 7,000 employees globally as of June 2020. 

Demetrius Comes, GoDaddy's chief information security officer, said in a statement with the Securities and Exchange Commission that the business discovered unauthorized access to its networks in which it hosts and administers its customers' WordPress servers. 

WordPress is a web-based content management system that millions of people use to create blogs and web pages. Users can host their WordPress installations on GoDaddy's servers. 

According to GoDaddy, an unauthorized user gained access to GoDaddy's systems around September 6th. GoDaddy stated that the breach was detected last week, on November 17. It is unclear whether the hacked password was secured using two-factor authentication. 

According to the complaint, the hack impacts 1.2 million current and inactive WordPress users, whose email accounts and customer numbers were disclosed. According to GoDaddy, this disclosure may put users at increased risk of phishing attacks. As per the web host, the initial WordPress admin password generated while WordPress had been installed, which could be used to manage a customer's WordPress server, had also been exposed. 

Active users' FTP credentials (for file transfers) as well as the login information for their WordPress accounts, that store all of the user's content, were compromised in the incident, according to the business. In certain situations, the user's SSL (HTTPS) private key was revealed, which might allow an attacker to mimic the customer's website or services if misused. 

According to GoDaddy, it has updated client WordPress passwords and private keys and is now in the process of providing new SSL certificates. Meanwhile, Dan Race, a GoDaddy spokeswoman, refused to respond, citing the company's ongoing investigation.
Read more »
Two Factor Authentication
Apple Cyber Security Google One Time Password Two Factor Authentication

Apple Engineers unveils a proposal to standardize the two factor authentication process and Google backs it up!


Apple known for it's off the charts security features was recently troubled with hacks, malware and phishing attacks staining its reputation and customer trust. And to counter that, Apple has again risen to strengthen its security and user experience - the tech company is planning on standardizing two-factor authentication (2FA) to prevent security issues and phishing scams.

PhoneArena.com reported that Apple engineers have put forward a proposal to enable a standardized format for a two-factor authentication login method where users receive a one time password (OTP) via SMS during login. The suggestion was given by engineers of Apple Webkit, from the Safari browser - the default mackintosh browser. The suggestion was also backed by engineers working on Chromium, Google.

The feature would use SMSs containing the login URL. Usually, with two-factor authentication users have to see their mobile or write down the code and then try to login which makes the whole process long and frustrating but Apple always tries to give the customer the best experience and to tackle this they have come up with a standardize and automated method.

What's different with this feature than the other two factor authentications is that it will standardize the process and format for the browser and mobile applications. The incoming messages will be easily identified by the browser or mobile applications, the browser will recognize and identify the web domain in the SMS and automatically extract the One Time Password (OTP) and complete the login. This will prevent the user from being scammed as the process will be automated and the browser or the mobile app will recognize the authentic source.

 According to the report, "The proposal has two goals. The first is to introduce a way that OTP SMS messages can be associated with a URL. This is done by adding the login URL inside the SMS itself. 
The second goal is to standardize the format of 2FA/OTP SMS messages, so browsers and other mobile apps can easily detect the incoming SMS, recognize web domain inside the message, and then automatically extract the OTP code and complete the login operation without further user interaction." 
After enabling the feature, browsers and apps will be automated and complete the login through 2FA (two-factor authentication ) by obtaining the OTP. In case of a mismatch, the automatic process will fail and the user will be able to see the website URL and complete the login process.
Read more »
Subscribe to: Posts (Atom)