IT Security Guru

MAY 2, 2024

On this World Password Day , we should all pause and think about how we can adopt passkeys. Passkeys represent a significant industry shift in identity security, moving away from traditional credentials of usernames and passwords to a more secure “no knowledge” approach to authentication that is a vastly better user experience.

Passwords 86

Passwords Password Management Authentication Accountability 86

Security Affairs

JULY 17, 2024

A vulnerability in Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers allows threat actors to change any user’s password. The issue is due to an improper implementation in the password-change process. “This vulnerability is due to improper implementation of the password-change process. .

Passwords 139

Passwords Software Authentication Hacking 139

Krebs on Security

JANUARY 30, 2024

9, 2024, U.S. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. technology companies during the summer of 2022.

Social Engineering 340

Social Engineering Mobile Passwords Cybercrime 340

SecureList

JUNE 18, 2024

A side effect is that passwords that were impossible to guess just a few years ago can be cracked by hackers within mere seconds in 2024. For example, the RTX 4090 GPU is capable of guessing an eight-character password consisting of same-case English letters and digits, or 36 combinable characters, within just 17 seconds.

Passwords 138

Passwords Password Management Hacking Authentication 138

SecureList

JANUARY 25, 2024

Australia has also unveiled a national strategy for digital identity resilience, aiming for mainstream use in 2024. The year 2023 marked the emergence of several important trends, which will influence the privacy field in 2024. This is no longer adequate in 2024.

Passwords 118

Passwords Authentication Technology Insurance 118

Duo's Security Blog

MAY 2, 2024

We are excited to have partnered closely with Microsoft in the co-development of Microsoft Entra ID External Authentication Methods, available in Public Preview May 2024! External Authentication Methods (EAM) enables frictionless integration of Duo’s full security feature set.

Authentication 135

Authentication Phishing Passwords Risk 135

Security Affairs

MAY 29, 2024

A credential stuffing attack is a type of cyber attack where hackers use large sets of username and password combinations, typically obtained from previous data breaches, phishing campaigns, or info-stealer infections, to gain unauthorized access to user accounts on various online services. ” reads advisory. ” reads advisory.

Authentication 125

Authentication Accountability Passwords Data breaches 125

Krebs on Security

DECEMBER 18, 2024

Griffin said a follow-up investigation revealed the attackers had used his Gmail account to gain access to his Coinbase account from a VPN connection in California, providing the multi-factor code from his Google Authenticator app. You may also wish to download Google Authenticator to another mobile device that you control.

Cryptocurrency 360

Cryptocurrency Accountability Authentication Phishing 360

The Last Watchdog

JULY 11, 2024

Passwords have been the cornerstone of basic cybersecurity hygiene for decades. But as secure and user-friendly as these authentication methods are, cybercriminals are already busily sidestepping all forms of authentication – passwords, MFA, and passkeys – to sometimes devastating effect.

Authentication 124

Authentication Passwords Malware Accountability 124

SecureWorld News

MAY 2, 2024

In our digitally connected world, passwords are the gateway to protecting our online lives—from email and social media accounts to banking and private data. Yet, many of us still use alarmingly weak passwords or reuse the same ones across multiple sites, putting our digital identities at severe risk.

Passwords 88

Passwords Password Management Identity Theft Authentication 88

Krebs on Security

APRIL 9, 2024

Ben McCarthy , lead cyber security engineer at Immersive Labs called attention to CVE-2024-20670 , an Outlook for Windows spoofing vulnerability described as being easy to exploit. “Microsoft has updated their backend and notified any customers who have been affected by the credential leakage.”

DNS 281

DNS Social Engineering Malware Media 281

Troy Hunt

FEBRUARY 4, 2024

That's not unprecedented, but this is: password: "$2y$10$B0EhY/bQsa5zUYXQ6J.NkunGvUfYeVOH8JM1nZwHyLPBagbVzpEM2", No way! Is that genuinely a bcrypt hash of my own password? Yep, that's exactly what it is : The Spoutible API enabled any user to retrieve the bcrypt hash of any other user's password.

Passwords 363

Passwords Accountability Backups Data breaches 363

SecureWorld News

JULY 8, 2024

Case in point: a colossal password compilation dubbed "RockYou2024" has emerged, containing nearly 10 billion unique passwords. The name "RockYou2024" pays homage to the infamous RockYou data breach of 2009, which exposed 32 million passwords due to insecure storage practices. The file with the data, titled rockyou2024.txt,

Passwords 110

Passwords Password Management Education Accountability 110

Malwarebytes

OCTOBER 6, 2023

Recently, Amazon announced that it will require all privileged Amazon Web Services (AWS) accounts to use multi-factor authentication (MFA) , starting in mid-2024. Our regular readers will know that we feel that passwords alone are not adequate protection , especially not for your important accounts.

Authentication 137

Authentication Passwords Social Engineering Accountability 137

Security Boulevard

JULY 14, 2024

In episode 338, we discuss the recent breach of the two-factor authentication provider Authy and its implications for users. We also explore a massive password list leak titled ‘Rock You 2024’ that has surfaced online.

Passwords 72

Passwords Authentication Social Engineering Data privacy 72

eSecurity Planet

JANUARY 29, 2024

Dashlane is a password management software that’s popular for business and personal uses alike. Like many other password managers, Dashlane makes it easy for users to create new passwords and store existing ones in a secure vault. The company was founded in 2009, and the first software edition was released in 2012.

Password Management 107

Password Management Passwords Authentication Accountability 107

Security Affairs

JULY 1, 2024

Experts spotted threat actors exploiting the critical vulnerability CVE-2024-0769 affects all D-Link DIR-859 WiFi routers. Researchers from cybersecurity firm GreyNoise have spotted exploitation attempts for the critical vulnerability CVE-2024-0769 (CVSS score 9.8) impacting all D-Link DIR-859 WiFi routers. ” concludes GreyNoise.

Passwords 133

Passwords Accountability Authentication Internet 133

Security Affairs

MARCH 11, 2024

Researchers released technical specifics and a PoC exploit for a recently disclosed flaw in Progress Software OpenEdge Authentication Gateway and AdminServer. ” The vulnerability CVE-2024-1403 (CVSS score 10) is an authentication bypass issue that impacts OpenEdge versions 11.7.18 Researchers from Horizon3.ai

Software 136

Software Authentication Passwords Engineering 136

Penetration Testing

OCTOBER 6, 2024

A serious vulnerability has been identified in the OATH-Toolkit’s PAM module, exposing systems to potential root-level exploits when handling one-time password (OTP) authentication.

Authentication 93

Authentication Passwords Cybersecurity 93

Security Affairs

OCTOBER 9, 2024

. “Combined, these include information such as usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.” CVE-2024-9464 (CVSS 9.3) – An authenticated OS command injection vulnerability allows attackers root access, leading to data exposure similar to CVE-2024-9463.

Firewall 127

Firewall Passwords Authentication Phishing 127

Security Affairs

AUGUST 28, 2024

Cisco Talos observed the BlackByte ransomware group exploiting the recently patched security flaw CVE-2024-37085 in VMware ESXi hypervisors in recent attacks. The flaw CVE-2024-37085 (CVSS score of 6.8) is an authentication bypass vulnerability in VMware ESXi.

Ransomware 126

Ransomware Authentication Encryption VPN 126

Thales Cloud Protection & Licensing

OCTOBER 9, 2024

Secure Your World with Phishing Resistant Passkeys madhav Thu, 10/10/2024 - 05:12 As we celebrate Cybersecurity Awareness Month 2024 with the theme "Secure Our World," exploring innovative technologies is crucial to help us achieve this goal. Passkeys Unpacked Passkeys were designed to eliminate the weaknesses inherent in passwords.

Phishing 133

Phishing Authentication Passwords Identity Theft 133

Identity IQ

JULY 8, 2024

RockYou2024: Nearly 10 Billion Passwords Exposed in Data Leak IdentityIQ In a cybersecurity incident that has sent shockwaves through the online community, nearly 10 billion unique passwords have been exposed in the “RockYou2024” data breach. billion passwords. .” billion passwords. The additional 1.5

Passwords 104

Passwords Identity Theft Data breaches Password Management 104

Thales Cloud Protection & Licensing

OCTOBER 13, 2022

Thales and Microsoft partner to provide Azure customers with FIDO and CBA phishing-resistant authentication. The impact and cost of cyber-attacks have skyrocketed, driving the need for better identity protection with phishing-resistant Multi-Factor Authentication (MFA). Microsoft Azure Certificate-Based Authentication Support.

Authentication 127

Authentication Phishing Digital transformation Government 127

IT Security Guru

DECEMBER 20, 2023

Many of the applications that historically integrated with the on-premise corporate directory for Single Sign-On will now require manual, password-based authentication, increasing the burden on users and also further extending the attack surface for malicious actors. If they thought this year was bad, they ain’t seen nothing yet.”

Cybersecurity 142

Cybersecurity Phishing Scams Cloud Migration 142

Approachable Cyber Threats

OCTOBER 7, 2024

What changed, and what is NIST's updated password guidance and the role of password strength in 2024?” “What changed, and what is NIST's updated password guidance and the role of password strength in 2024?” What are the key takeaways from NIST's updated password guidance?”

Passwords 95

Passwords Password Management Authentication Risk 95

Security Affairs

OCTOBER 11, 2024

As of September 5, 2024, the Internet Archive held more than 42.1 31M records breached The breach exposed user records including email addresses, screen names and bcrypt password hashes. ” New breach: Internet Archive had 31M records breached last month including email address, screen name and bcrypt password hash.

Data breaches 121

Data breaches Internet Internet DDOS 121

Webroot

OCTOBER 31, 2024

Steam the Webinar on demand HERE As we look back on the cybersecurity landscape of 2024, it’s clear that the world of digital threats continues to evolve at an alarming pace in parallel with AI. The saga of LockBit in 2024 exemplifies the resilience and adaptability of these cybercriminal groups.

Malware 83

Malware Ransomware Passwords Healthcare 83

Security Affairs

MAY 29, 2024

Check Point released hotfixes for a VPN zero-day vulnerability, tracked as CVE-2024-24919, which is actively exploited in attacks in the wild. Check Point released hotfixes to address a VPN zero-day vulnerability, tracked as CVE-2024-24919 , which is actively being exploited in attacks in the wild.

VPN 125

VPN Authentication Passwords Accountability 125

Krebs on Security

NOVEMBER 21, 2024

The targeted SMS scams asked employees to click a link and log in at a website that mimicked their employer’s Okta authentication page. The bot allowed the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website. police as part of an FBI investigation into the MGM hack.

Identity Theft 228

Identity Theft Phishing Cryptocurrency Accountability 228

Duo's Security Blog

MAY 6, 2024

The security industry has diligently battled compromised credentials, evolving from passwords to multifactor authentication (MFA) to passwordless — our most secure and phishing-resistant method to date — and one that is fully supported in Duo. This means there are serious holes in our authentication armor today.

Authentication 95

Authentication Accountability VPN Phishing 95

Security Affairs

NOVEMBER 15, 2024

Combined, these include information such as usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.” CVE-2024-9464 (CVSS 9.3) – An authenticated OS command injection vulnerability allows attackers root access, leading to data exposure similar to CVE-2024-9463.

Firewall 109

Firewall Passwords Authentication Phishing 109

Security Boulevard

OCTOBER 11, 2024

Passwordless Authentication without Secrets! divya Fri, 10/11/2024 - 08:54 As user expectations for secure and seamless access continue to grow, the 2024 Thales Consumer Digital Trust Index (DTI) research revealed that 65% of users feel frustrated with frequent password resets.

Authentication 69

Authentication Retail Healthcare Manufacturing 69

Duo's Security Blog

MAY 15, 2024

In the world of access management, we have seen wide deployment of multi-factor authentication (MFA) at the point of the Operating System (OS) to invoke the layer of something you know (i.e., a password) and something you have (i.e., a registered device). See the video at the blog post. How does this improve the proverbial front door?

Authentication 103

Authentication Social Engineering Passwords Engineering 103

The Last Watchdog

MARCH 7, 2024

7, 2024 — Badge Inc. , The new Badge Partner Program further accelerates the adoption and integration of Badge’s privacy-preserving authentication, enabling even more users to benefit from seamless MFA experiences across any device or application without storing user secrets or private keys. “We San Francisco, Calif.,

Authentication 100

Authentication Software Digital transformation Marketing 100

Security Affairs

NOVEMBER 2, 2024

Hackers are exploiting two zero-day vulnerabilities, tracked as CVE-2024-8956 and CVE-2024-8957, in PTZOptics cameras. Threat actors are attempting to exploit two zero-day vulnerabilities, tracked as CVE-2024-8956 and CVE-2024-8957 , in PTZOptics pan-tilt-zoom (PTZ) live streaming cameras, GretNoise researchers warn.

Firmware 121

Firmware Manufacturing Healthcare IoT 121

Krebs on Security

AUGUST 15, 2024

On July 21, 2024, denizens of the cybercrime community Breachforums released more than 4 terabytes of data they claimed was stolen from nationalpublicdata.com, a Florida-based company that collects data on consumers and processes background checks. billion rows of records — they claimed was taken from nationalpublicdata.com. .”

Hacking 351

Hacking Data breaches Identity Theft Accountability 351