Troy Hunt

SEPTEMBER 17, 2019

Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. This just feels wrong but I can’t come up with a strong argument against it.

Banking 253

Banking Passwords Accountability Authentication 253

Malwarebytes

JANUARY 6, 2022

million customers have had their user accounts compromised in credential stuffing attacks. Credential stuffing is the automated injection of stolen username and password pairs in to website login forms, in order to fraudulently gain access to user accounts. Using a forum or social media account to send phishing messages or spam.

Passwords 144

Passwords Accountability Identity Theft Password Management 144

Krebs on Security

JANUARY 6, 2020

Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. ” WHOLESALE PASSWORD THEFT. In mid-November 2019, Wisconsin-based Virtual Care Provider Inc.

Passwords 255

Passwords Ransomware Password Management Malware 255

Schneier on Security

DECEMBER 27, 2023

No passcode fallback is available in the event that the user is unable to complete Face ID or Touch ID authentication. No passcode fallback is available in the event that the user is unable to complete Face ID or Touch ID authentication.

Authentication 337

Authentication Passwords Accountability 337

Troy Hunt

NOVEMBER 19, 2020

I'm going to highlight one particular row that used a Mailinator address simply because Mailinator accounts are public email addresses where there is no expectation whatsoever of privacy. txt" had a small number of email address and password hex pairs. The "Rejected.txt" file contained malformed email addresses and "Result(HEX).txt"

Passwords 364

Passwords Password Management Accountability Risk 364

Malwarebytes

JANUARY 3, 2025

If interested, the victim will receive a download link and a password for the archive containing the promised installer. The archives are offered for download on various locations like Dropbox, Catbox, and often on the Discord content delivery network (CDN), by using compromised accounts which add extra credibility. fr leyamor[.]com

Scams 140

Scams Identity Theft Media Accountability 140

Troy Hunt

JUNE 1, 2020

I've now seen several versions of the same set of email addresses and passwords albeit with different attribution up the top of the file. In other words, these accounts are breached way more than usual. There are 798 email addresses in the data set but only 689 unique ones.

Hacking 364

Hacking Passwords Data breaches Accountability 364

Krebs on Security

MARCH 15, 2021

com , a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card.

Passwords 346

Passwords Accountability Hacking Data breaches 346

Krebs on Security

SEPTEMBER 13, 2023

USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus’ systems. By stealing these tokens, attackers can often reuse them in their own web browser, and bypass any authentication normally required for that account. Microsoft Corp. government inboxes.

Cybercrime 340

Cybercrime Passwords Authentication Malware 340

Krebs on Security

JUNE 15, 2024

. “He stands accused of hacking into corporate accounts and stealing critical information, which allegedly enabled the group to access multi-million-dollar funds,” Murcia Today wrote. ” The cybercrime-focused Twitter/X account vx-underground said the U.K.

Hacking 336

Hacking Cybercrime Phishing Passwords 336

Krebs on Security

JULY 4, 2020

One of the most-read advice columns on this site is a 2018 piece called “ Plant Your Flag, Mark Your Territory ,” which tried to impress upon readers the importance of creating accounts at websites like those at the Social Security Administration , the IRS and others before crooks do it for you.

Accountability 340

Accountability Passwords Authentication Insurance 340

Security Boulevard

NOVEMBER 18, 2024

Bot operators and scalpers have refined their tactics, leveraging fake account creation as a primary tool to bypass purchase limits. By deploying bots at scale, they quickly create multiple accounts to snatch up inventory, preventing genuine customers from securing these high-demand products.

Accountability 59

Accountability Retail Authentication Risk 59

SecureList

OCTOBER 4, 2024

The attackers uploaded numerous videos in English from multiple accounts which were presumably stolen. Inside the archive is an MSI file and a TXT file with a password required for installation. If the user specifies the right password, the CustomAction field value of the MSI file is executed — this is effectively a VB script.

Scams 145

Scams Cryptocurrency Malware Software 145

Troy Hunt

JANUARY 17, 2024

Website, username and password: That's just the first 20 rows out of 5 million in that particular file, but it gives you a good sense of the data. The question of how valid the accompanying passwords remain aside, time and time again the email addresses in the stealer logs checked out on the services they appeared alongside.

Passwords 361

Passwords Password Management Hacking Accountability 361

SecureWorld News

JULY 8, 2024

Case in point: a colossal password compilation dubbed "RockYou2024" has emerged, containing nearly 10 billion unique passwords. The name "RockYou2024" pays homage to the infamous RockYou data breach of 2009, which exposed 32 million passwords due to insecure storage practices.

Passwords 126

Passwords Password Management Education Accountability 126

Schneier on Security

DECEMBER 14, 2018

When targets entered passwords into a fake Gmail or Yahoo security page, the attackers would almost simultaneously enter the credentials into a real login page. In the event targets' accounts were protected by 2fa, the attackers redirected targets to a new page that requested a one-time password. This isn't new.

Authentication 231

Authentication Passwords Phishing Government 231

Troy Hunt

JUNE 8, 2021

Ever notice how there was a massive gap of almost 9 months between announcing the intention to start open sourcing Have I Been Pwned (HIBP) in August last year and then finally a couple of weeks ago, actually taking the first step with Pwned Passwords ? I was pretty excited when I saw PRs coming in right after launching that last blog post.

Passwords 359

Passwords Accountability 359

SecureList

JUNE 18, 2024

A side effect is that passwords that were impossible to guess just a few years ago can be cracked by hackers within mere seconds in 2024. For example, the RTX 4090 GPU is capable of guessing an eight-character password consisting of same-case English letters and digits, or 36 combinable characters, within just 17 seconds.

Passwords 139

Passwords Password Management Hacking Authentication 139

eSecurity Planet

MARCH 8, 2022

The average internet user has somewhere around 100 accounts, according to NordPass research, meaning they have to track 100 different passwords or risk using the same one over and over. Users can share password files securely with encrypted transmissions. Vault health reports Directory sync Secure password sharing.

Password Management 131

Password Management Passwords Encryption Accountability 131

Malwarebytes

MARCH 19, 2025

The information potentially involved varies by customer but includes names and one or more of the following: Drivers license numbers Bank account and routing numbers. Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you dont use for anything else.

Banking 85

Banking Data breaches Computers and Electronics Passwords 85

SecureWorld News

DECEMBER 30, 2024

This may involve identifying compromised servers, web applications, databases, or user accounts. Disable compromised accounts or restrict their permissions immediately, update passwords for authorized users to prevent further unauthorized access. Enforce strict password guidelines that disallow weak and commonly used passwords.

Data breaches 110

Data breaches Social Engineering Passwords Accountability 110

Krebs on Security

SEPTEMBER 28, 2018

Facebook said today some 90 million of its users may get forcibly logged out of their accounts after the company fixed a rather glaring security vulnerability in its Web site that may have let attackers hijack user profiles. That page also has an option to force a simultaneous logout of all devices connected to your account.

Accountability 273

Accountability Passwords Data breaches 273

Krebs on Security

APRIL 11, 2019

and higher can now be used as Security Keys , an additional authentication layer that helps thwart phishing sites and password theft. Once a user has enrolled their Android phone as a Security Key, the user will need to approve logins via a prompt sent to their phone after submitting their username and password at a Google login page.

Mobile 266

Mobile Authentication Passwords Accountability 266

Duo's Security Blog

FEBRUARY 13, 2025

To illustrate the point, last quarter our own Cisco Talos team saw a surge in password-spraying attacks. In one of their documented cases, an organization reported that 13 million authentication attempts were made in 24 hours against known accounts.

Authentication 80

Authentication Accountability Passwords Risk 80

IT Security Guru

JANUARY 27, 2023

Darren Guccione, CEO and Co-founder of Keeper Security, has offered up some tips to best secure your online accounts and stay safe on the internet. Improving your password habits: Do not use any combination of characters that is easy to guess. Recognisable keystroke patterns or short passwords should also be avoided.

Password Management 124

Password Management Data privacy Passwords Accountability 124

Troy Hunt

JANUARY 15, 2021

A little bit of a change of pace this week with the video being solely on the events unfolding around removing content, people and even entire platforms from the internet. These are significant events in history, regardless of your political persuasion, and they're likely to have a very long-lasting impact on the way we communicate online.

Password Management 269

Password Management Internet Internet Accountability 269

Webroot

MARCH 3, 2025

The event is sponsored by the Federal Trade Commission (FTC), and other participating agencies include the Federal Deposit Insurance Corporation (FDIC), AARP , and the Better Business Bureau (BBB). How to protect yourself and your data Smart ways to secure your devices Strong passwords – Make them long, random, and unique.

Consumer Protection 87

Consumer Protection Identity Theft Scams Social Engineering 87

Adam Levin

MARCH 17, 2022

Sensitive information including passwords and financial information can be exfiltrated and ransomware can be deployed to block access to critical data. A single compromised account is usually the point of entry for hacking campaigns. Change passwords regularly. Keep employee email accounts up to date.

Cyber threats 229

Cyber threats Phishing Passwords Malware 229

Pen Test Partners

AUGUST 29, 2024

TL;DR Strong passwords : Use a password manager. This makes it harder for unauthorised users to gain access even if they have your password. Secure networks : Avoid using untrusted public Wi-Fi to access social media accounts, instead, use mobile data. These systems store your passwords in a single encrypted vault.

Media 116

Media Accountability Password Management Passwords 116

SecureList

OCTOBER 29, 2024

Patch management issues The vulnerability patching process typically takes time for a variety of reasons: from actual patch release all the way to identifying vulnerable assets and “properly” patching them, considering any pre-existing asset inventory and whether the accountable personnel will learn about the vulnerability in time.

Risk 109

Risk Antivirus Accountability Malware 109

Thales Cloud Protection & Licensing

OCTOBER 4, 2022

Cybersecurity Awareness Month: Resilient Multi-factor Authentication (MFA) and Strong Passwords. Historically, October has always been an important month for the cybersecurity community and a month of major cybersecurity events. Use strong passwords. Resilient multi-factor authentication and strong passwords are critical.

Authentication 127

Authentication Passwords Cybersecurity Data breaches 127

Troy Hunt

NOVEMBER 20, 2024

We'd save on Azure Function execution costs, storage account hits and especially egress bandwidth ( which is very expensive ). Note: As of today, HIBP reports over 14 billion breached accounts, the number of unique email addresses is lower as on average, each breached address has appeared in multiple breaches.)

Data breaches 303

Data breaches Passwords DDOS Accountability 303

Troy Hunt

MARCH 29, 2018

The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember. In an era well before the birth of Have I Been Pwned (HIBP), I was doing a bunch of password analysis on data breaches and wouldn't you know it - people are terrible at creating passwords! Everywhere.

Password Management 274

Password Management Passwords Data breaches Retail 274

Malwarebytes

SEPTEMBER 23, 2024

With couples today regularly sharing access to one another’s email accounts, streaming services, social media platforms, online photo albums, and more, the risk of a bad breakup isn’t just heartache. The use of multifactor/two-factor authentication on every sensitive account that allows it. The internet has made it harder.

Accountability 102

Accountability Passwords Media Banking 102

Webroot

APRIL 4, 2025

Imagine waking up one day to find that someone has stolen your identity, opened credit cards in your name, or even withdrawn money from your bank accounts. The best ways to do that are: Strong passwords : The number one way to protect your personal information is the simplest one. Make your passwords long, complex, and unique.

Identity Theft 60

Identity Theft Banking Password Management Passwords 60

Krebs on Security

JULY 13, 2020

Data Viper , a security startup that provides access to some 15 billion usernames, passwords and other information exposed in more than 8,000 website breaches, has itself been hacked and its user database posted online. Password re-use becomes orders of magnitude more dangerous when website developers engage in this unsafe practice.

Hacking 363

Hacking Marketing Cybercrime Accountability 363

Troy Hunt

OCTOBER 9, 2017

From that moment, the timeline in their public disclosure began which I highlighted in this tweet: 23 hours and 42 minutes from initial private disclosure to @disqus to public notification and impacted accounts proactively protected pic.twitter.com/lctQEjHhiH — Troy Hunt (@troyhunt) October 6, 2017.

Data breaches 271

Data breaches Passwords Accountability Internet 271