Krebs on Security

MAY 24, 2019

The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser. billion in 2018. No authentication was required to read the documents.

Insurance 279

Insurance Banking Identity Theft Scams 279

Krebs on Security

NOVEMBER 20, 2020

Conor Freeman of Dublin took part in the theft of more than two million dollars worth of cryptocurrency from different victims throughout 2018. One way to protect your accounts against SIM swappers is to remove your phone number as a primary or secondary authentication mechanism wherever possible.

Cryptocurrency 292

Cryptocurrency Mobile Authentication Accountability 292

Krebs on Security

JULY 12, 2024

AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed). For its part, Snowflake says it now requires all new customers to use multi-factor authentication. In a regulatory filing with the U.S.

Data breaches 347

Data breaches Passwords Authentication Accountability 347

Krebs on Security

AUGUST 7, 2018

On July 18, 2018, Pasco County authorities arrested Ricky Joseph Handschumacher , an employee of the city of Port Richey, Fla, charging him with grand theft and money laundering. In some cases, fraudulent SIM swaps succeed thanks to lax authentication procedures at mobile phone stores. A WORRIED MOM. GRAND PLANS.

Mobile 247

Mobile Cryptocurrency Computers and Electronics Scams 247

Krebs on Security

AUGUST 16, 2018

Terpin alleges that crooks stole almost $24 million worth of cryptocurrency after fraudulently executing a “SIM swap” on his mobile phone account at AT&T in early 2018. Terpin claims an investigation by AT&T into the 2018 breach found that an employee at an AT&T store in Norwich, Conn.

Mobile 266

Mobile Cryptocurrency Accountability Authentication 266

Krebs on Security

FEBRUARY 8, 2021

Brad Marden , superintendent of cybercrime operations for the Australian Federal Police (AFP), said their investigation into who was behind U-Admin began in late 2018, after Australian citizens began getting deluged with phishing attacks via mobile text messages that leveraged the software.

Phishing 328

Phishing Scams Banking Mobile 328

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. That’s down from 53 percent that did so in 2018, Okta found.

Mobile 339

Mobile Phishing Authentication Accountability 339

Krebs on Security

NOVEMBER 21, 2018

The problem stemmed from an authentication weakness in a USPS Web component known as an “application program interface,” or API — basically, a set of tools defining how various parts of an online application such as databases and Web pages should interact with one another. .

Accountability 278

Accountability Authentication Identity Theft Advertising 278

Security Affairs

FEBRUARY 5, 2025

Microsoft.NET Framework Information Disclosure Vulnerability CVE-2018-9276 (CVSS score of 7.2) Paessler PRTG Network Monitor OS Command Injection Vulnerability CVE-2018-19410 (CVSS score of 9.8) The vulnerability allowed authenticated threat actors to execute code or SQL queries, leading to remote code execution.

Authentication 63

Authentication Hacking Cybersecurity Software 63

Krebs on Security

DECEMBER 16, 2021

Truglia admitted to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin , a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.

Cryptocurrency 363

Cryptocurrency Mobile Accountability Scams 363

Krebs on Security

MARCH 16, 2021

But Lucky225 said the class of SMS interception he’s been testing targets a series of authentication weaknesses tied to a system developed by NetNumber , a private company in Lowell, Mass. Surprisingly, despite the fact that I publicly disclosed this in 2018 , nothing has been done to stop this relatively unsophisticated attack.”

Telecommunications 363

Telecommunications Mobile Accountability Wireless 363

Krebs on Security

AUGUST 12, 2020

As KrebsOnSecurity observed back in 2018 , many people — particularly older folks — proudly declare they avoid using the Web to manage various accounts tied to their personal and financial data — including everything from utilities and mobile phones to retirement benefits and online banking services. In 2018, the U.S.

Accountability 357

Accountability Mobile Banking Passwords 357

Krebs on Security

JUNE 21, 2021

He said the percentage of companies that reported already having inventoried all of their IT systems is roughly equal to the number of larger water utilities (greater than 50,000 population) that recently had to certify to the Environmental Protection Agency (EPA) that they are compliant with the Water Infrastructure Act of 2018.

Hacking 359

Hacking Accountability Cybersecurity Technology 359

Krebs on Security

FEBRUARY 26, 2023

Many companies now require employees to supply a one-time password — such as one sent via SMS or produced by a mobile authenticator app — in addition to their username and password when logging in to company assets online. The key works without the need for any special software drivers.

Hacking 324

Hacking Social Engineering Phishing Scams 324

Krebs on Security

JULY 4, 2020

One of the most-read advice columns on this site is a 2018 piece called “ Plant Your Flag, Mark Your Territory ,” which tried to impress upon readers the importance of creating accounts at websites like those at the Social Security Administration , the IRS and others before crooks do it for you.

Accountability 338

Accountability Passwords Authentication Insurance 338

Krebs on Security

FEBRUARY 5, 2019

Investigators allege that between October 2016 and May 2018, Hared and Ditman grew proficient at SIM swapping, a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims. According to indictments unsealed this week, Tucson, Ariz. Winblo’s account on ogusers[.]com

Cryptocurrency 221

Cryptocurrency Identity Theft Mobile Accountability 221

Troy Hunt

JANUARY 10, 2018

agarwal_mohit) January 5, 2018. I think the URL is right but it seems inaccessible from other countries: [link] — Troy Hunt (@troyhunt) January 9, 2018. Security /= George blocking — Vatsalya Goel (@vatsalyagoel) January 9, 2018. — Khas Mek (@KhasMek) January 10, 2018. FergusInLondon) January 10, 2018.

Hacking 279

Hacking Government Encryption Risk 279

Krebs on Security

SEPTEMBER 22, 2023

LastPass officially instituted this change back in 2018, but some undisclosed number of the company’s earlier customers were never required to increase the length of their master passwords. In February 2018, LastPass changed the default to 100,100 iterations. LastPass sent this notification to users earlier this week.

Passwords 320

Passwords Encryption Password Management Cryptocurrency 320

Troy Hunt

MARCH 29, 2018

— Dan Blank (@danblank000) March 20, 2018. — Brian Ford (@BrianPFord) March 9, 2018. — Edward Deaver (@EdwardCDeaver) March 10, 2018. This is a product I was already endorsed in by my own free volition and from the perspective of my own authenticity, that was very important. Thanks for all your work!

Password Management 273

Password Management Passwords Data breaches Retail 273

Krebs on Security

JANUARY 22, 2019

In July 2018, email users around the world began complaining of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. 13, 2018 bomb threat hoax. domaincontrol.com, and ns18.domaincontrol.com.

DNS 268

DNS Internet Internet Computers and Electronics 268

Security Affairs

MARCH 3, 2025

“Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow a remote attacker to bypass authentication or execute arbitrary commands on the underlying operating system of an affected device.” ” reads the advisory.

Small Business 58

Small Business Authentication Hacking Accountability 58

Security Affairs

MARCH 8, 2020

Netgear also addressed a high-severity flaw in several Netgear routers, the vendor tracked the flaw as PSV-2018-0352. The vulnerability is a post-authentication command injection issue and impacts Nighthawk (R7800) routers running firmware prior to version 1.0.2.60. R6700, running firmware versions prior to 1.0.2.8

Firmware 144

Firmware Wireless Advertising Authentication 144

Krebs on Security

MAY 3, 2019

The credit union said the investigation that fueled the lawsuit was prompted by a 2018 KrebsOnSecurity report about glaring security weaknesses in a Fiserv platform that exposed personal and financial details of customers across hundreds of bank Web sites. Brookfield, Wisc.

Banking 234

Banking Accountability Passwords Technology 234

Krebs on Security

AUGUST 23, 2024

The proliferation of new top-level domains (TLDs) has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names in TLDs that didn’t exist at the time. Alas, in 2018, the.llc TLD was born and began selling domains.

DNS 323

DNS Internet Internet Authentication 323

Krebs on Security

FEBRUARY 18, 2019

27, 2018, Cisco’s Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed “ DNSpionage.” Two of those domains only appeared at that Internet address in December 2018, including domains in Lebanon and — curiously — Sweden. 14, 2018 and Jan.

DNS 279

DNS Internet Internet Government 279

SecureWorld News

FEBRUARY 20, 2025

He urges enterprises to implement Privileged Access Management (PAM) solutions and multi-factor authentication (MFA) and to enforce robust password policies to reduce the risk of account compromise. Beyond patching, identity security is a persistent weak point in defending against ransomware attacks."

Ransomware 110

Ransomware IoT Encryption Social Engineering 110

Krebs on Security

SEPTEMBER 5, 2023

“The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.” In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000.

Cryptocurrency 361

Cryptocurrency Passwords Encryption Accountability 361

Krebs on Security

FEBRUARY 12, 2019

VFEmail’s Twitter account responded that “external facing systems, of differing OS’s and remote authentication, in multiple data centers are down.” Strangely, not all VMs shared the same authentication, but all were destroyed. The first signs of the attack came on the morning of Feb. Just attack and destroy.”

Hacking 275

Hacking DDOS Backups Accountability 275

Krebs on Security

JULY 8, 2021

” The official description of CVE-2015-2862 says a would-be attacker would need to be already authenticated to the server for the exploit to work. “This is worse because the CVE calls for an authenticated user,” Holden said. “This was not.” “It was deprecated but left up,” Sanders said.

Software 329

Software Ransomware System Administration Authentication 329

Krebs on Security

NOVEMBER 6, 2018

In late September 2018, the REACT Task Force spearheaded an investigation that led to the arrest of two Missouri men — both in their early 20s — who are accused of conducting SIM swaps to steal $14 million from a cryptocurrency company based in San Jose, Calif. . million customers.

Mobile 265

Mobile Cryptocurrency Accountability Passwords 265

Schneier on Security

JANUARY 5, 2018

My next book is still on track for a September 2018 publication. Authentication and Identification are Getting Harder 6. Norton is still the publisher. The title is now Click Here to Kill Everybody: Peril and Promise on a Hyperconnected Planet , which I generally refer to as CH2KE. Computers are Still Hard to Secure 2.

Internet 182

Internet Internet Government Authentication 182

Krebs on Security

APRIL 14, 2019

This 2018 story from travel blog goatsontheroad.com tells the tale of a couple that was very nearly scammed by a Land Lordz-like trap, before the wife figures out they’re no longer on airbnb.com. According to twofactorauth.org , Airbnb currently does not support any type of multi-factor authentication that users can enable.

Scams 270

Scams Advertising Accountability Phishing 270

Krebs on Security

AUGUST 19, 2020

Time is of the essence in these attacks because many companies that rely on VPNs for remote employee access also require employees to supply some type of multi-factor authentication in addition to a username and password — such as a one-time numeric code generated by a mobile app or text message.

Phishing 363

Phishing VPN Social Engineering Media 363

Troy Hunt

NOVEMBER 14, 2018

2FA, MFA, 2-Step They may all be familiar, but there are important differences that warrant explanation and we'll start with the acronym we most commonly see: 2FA is two-factor authentication. MFA is multi-factor authentication. 2-Step authentication does not necessarily require 2 discrete factors. It's a subset of MFA.

Passwords 269

Passwords Authentication Accountability Mobile 269

Security Affairs

MAY 30, 2024

ThreatFabric observed threat actors using two publicly available exploits (CVE-2018-4233, CVE-2018-4404) to deliver macOS implants. The experts noticed that a portion of the CVE-2018-4404 exploit is likely borrowed from the Metasploit framework. The flaw resides in WebKit and impacts macOS version 10.13.3

Spyware 135

Spyware Malware Surveillance Mobile 135

Security Affairs

MAY 2, 2023

FortiGuard Labs researchers observed a worrisome level of attacks attempting to exploit an authentication bypass vulnerability in TBK DVR devices. Threat actors are attempting to exploit a five-year-old authentication bypass issue, tracked as CVE-2018-9995 (CVSS score of 9.8), in TBK DVR devices. in MVPower CCTV DVR models.

Authentication 98

Authentication Surveillance Retail Education 98

SecureWorld News

JANUARY 27, 2025

MFA is a double-edged sword While essential for secure access, multi-factor authentication (MFA) creates additional barriers for users with disabilities. These layers of authentication, which are crucial for tamper-proof access these days, alienate individuals with disabilities and prevent them from signing in successfully.

Cybersecurity 96

Cybersecurity Risk Technology Authentication 96