Schneier on Security

NOVEMBER 22, 2023

Signal has had the ability to manually authenticate another account for years. iMessage is getting it : The feature is called Contact Key Verification, and it does just what its name says: it lets you add a manual verification step in an iMessage conversation to confirm that the other person is who their device says they are.

Authentication 315

Authentication Encryption Accountability 315

Daniel Miessler

MARCH 24, 2021

Basically, how secure is someone’s current behavior with respect to passwords and authentication, and what can they do to improve? This post is an attempt to create an easy-to-use security model for the average internet user. People like moving up rankings, so let’s use that! How to use this model.

Authentication 363

Authentication Passwords Internet Internet 363

Schneier on Security

NOVEMBER 16, 2023

Seth Godin wrote an article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code: Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code (..)

Authentication 320

Authentication Cryptocurrency Accountability Software 320

The Last Watchdog

MAY 24, 2022

Perhaps not coincidently, it comes at a time when enterprises have begun adopting passwordless authentication systems in mission-critical parts of their internal operations. Fortifications, such as multi-factor authentication (MFA) and password managers, proved to be mere speed bumps. Coming advances.

Authentication 342

Authentication Passwords Banking Digital transformation 342

Schneier on Security

MARCH 1, 2023

A reporter used an AI synthesis of his own voice to fool the voice authentication system for Lloyd’s Bank.

Authentication 286

Authentication Banking Artificial Intelligence 286

Tech Republic Security

MARCH 5, 2024

Learn about passwordless authentication, and explore the different types, benefits and limitations to help you decide which solution to choose.

Authentication 195

Authentication 195

The Last Watchdog

JULY 24, 2023

The next big thing is passwordless authentication. First and foremost, most solutions rely on connected devices like mobile phones to authenticate users. Attackers will continue to find ways to breach our systems, and authentication cryptography will become increasingly vulnerable to attack. Some solutions do this today.

Authentication 245

Authentication Passwords Social Engineering Phishing 245

Thales Cloud Protection & Licensing

OCTOBER 11, 2024

Passwordless Authentication without Secrets! This highlights an increasing demand for advanced authentication methods like passkeys and multi-factor authentication (MFA), which provide robust security for most use cases. Similarly, in retail and manufacturing, delays caused by authentication procedures reduce overall efficiency.

Authentication 132

Authentication Retail Healthcare Manufacturing 132

Penetration Testing

SEPTEMBER 22, 2024

Tracked as CVE-2024-8698,... The post CVE-2024-8698: Keycloak Vulnerability Puts SAML Authentication at Risk appeared first on Cybersecurity News.

Authentication 145

Authentication Risk Cybersecurity 145

Daniel Miessler

MARCH 10, 2022

People are starting to get the fact that texts (SMS) are a weak form of multi-factor authentication (MFA). It might have been a text, or it could have been something “strong”, like a mobile authenticator app like Google Authenticator or Authy. It completely changes how authentication is done.

Authentication 364

Authentication Phishing Passwords Accountability 364

Schneier on Security

AUGUST 25, 2022

Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication: Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into.

Phishing 346

Phishing Authentication Passwords Accountability 346

Schneier on Security

DECEMBER 27, 2023

No passcode fallback is available in the event that the user is unable to complete Face ID or Touch ID authentication. For especially sensitive actions, including changing the password of the Apple ID account associated with the iPhone, the feature adds a security delay on top of biometric authentication.

Authentication 321

Authentication Passwords Accountability 321

Penetration Testing

NOVEMBER 7, 2024

this flaw is classified as a high-severity vulnerability,... The post CVE-2024-40715: Authentication Bypass Threat in Veeam Backup Enterprise Manager appeared first on Cybersecurity News. Veeam recently disclosed a new security vulnerability, tracked as CVE-2024-40715, that impacts Veeam Backup Enterprise Manager.

Backups 119

Backups Authentication Cybersecurity 119

The Last Watchdog

SEPTEMBER 24, 2024

About the essayist: Ambuj Kumar is Co-founder and CEO of Simbian , AI Agents for cybersecurity The post GUEST ESSAY: Massive NPD breach tells us its high time to replace SSNs as an authenticator first appeared on The Last Watchdog.

Authentication 215

Authentication Identity Theft Banking Data breaches 215

The Hacker News

SEPTEMBER 18, 2024

GitLab has released patches to address a critical flaw impacting Community Edition (CE) and Enterprise Edition (EE) that could result in an authentication bypass. The vulnerability is rooted in the ruby-saml library (CVE-2024-45409, CVSS score: 10.0), which could allow an attacker to log in as an arbitrary user within the vulnerable system.

Authentication 140

Authentication 140

Schneier on Security

APRIL 9, 2021

Developers have moved PHP to GitHub, which has better authentication. They were discovered and removed before being pushed out to any users. But since 79% of the Internet’s websites use PHP, it’s scary. Hopefully it will be enough — PHP is a juicy target.

Authentication 362

Authentication Internet Internet Hacking 362

Schneier on Security

JULY 10, 2024

New attack against the RADIUS authentication protocol: The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request.

Authentication 276

Authentication Passwords 276

The Hacker News

NOVEMBER 5, 2024

Google's cloud division has announced that it will enforce mandatory multi-factor authentication (MFA) for all users by the end of 2025 as part of its efforts to improve account security. "We

Authentication 134

Authentication Engineering Account Security Accountability 134

Schneier on Security

JANUARY 9, 2024

The malware captures any PINs and passwords the victim enters to unlock their device and can later use them to unlock the device at will to perform malicious activities hidden from view.

Malware 296

Malware Banking Authentication Passwords 296

Tech Republic Security

JULY 30, 2024

Hackers managed to compromise “a few thousand” Google Workspace accounts by circumventing the verification process.

Authentication 184

Authentication Accountability 184

Schneier on Security

MAY 30, 2023

It’s neither hard nor expensive : Unlike password authentication, which requires a direct match between what is inputted and what’s stored in a database, fingerprint authentication determines a match using a reference threshold.

Authentication 280

Authentication Encryption Passwords 280

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are).

Passwords 352

Passwords Mobile Authentication Banking 352

Krebs on Security

MAY 19, 2021

The Princeton team further found 100 of those 259 numbers were linked to leaked login credentials on the web, which could enable account hijackings that defeat SMS-based multi-factor authentication. While you’re at it, consider removing your phone number as a primary or secondary authentication mechanism wherever possible.

Mobile 361

Mobile Wireless Authentication Accountability 361

Krebs on Security

JANUARY 21, 2022

One example is Genesis Market , where customers can search for stolen credentials and authentication cookies from a broad range of popular online destinations. What’s more, relatively few cybercrime shops online offer their users any sort of multi-factor authentication.

Hacking 321

Hacking Cybercrime Authentication Passwords 321

Schneier on Security

SEPTEMBER 27, 2024

However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) ”) or security questions when choosing passwords.

Passwords 305

Passwords Authentication 305

Krebs on Security

JULY 26, 2024

Google says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services that allow logins through Google’s “Sign in with Google” feature.

Accountability 297

Accountability Authentication Cryptocurrency Web Fraud 297

Krebs on Security

NOVEMBER 12, 2024

The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451 , a spoofing flaw that could reveal Net-NTLMv2 hashes , which are used for authentication in Windows environments. Narang notes that CVE-2024-43451 is the third NTLM zero-day so far this year.

Authentication 238

Authentication Engineering Malware Passwords 238

Krebs on Security

SEPTEMBER 13, 2023

Credentials stolen by info-stealers often end up for sale on cybercrime shops that peddle purloined passwords and authentication cookies (these logs also often show up in the malware scanning service VirusTotal ).

Cybercrime 323

Cybercrime Passwords Authentication Malware 323

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. That’s down from 53 percent that did so in 2018, Okta found.

Mobile 329

Mobile Phishing Authentication Accountability 329

Krebs on Security

NOVEMBER 29, 2023

20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. For this reason, they can’t be locked down with multifactor authentication the way user accounts can.

Authentication 273

Authentication Accountability Passwords Antivirus 273

Joseph Steinberg

JANUARY 26, 2022

To do so, they ask you to perform a form of Google authentication in which, to confirm your identity, you need to provide them with a number that will be sent to your phone by either text or voice message. As such, the criminal’s request may seem innocuous, when it is anything but.

Scams 321

Scams Authentication Accountability Artificial Intelligence 321

Krebs on Security

NOVEMBER 26, 2021

” Lumen told KrebsOnSecurity that it continued offering MAIL-FROM: authentication because many of its customers still relied on it due to legacy systems. Nevertheless, after receiving Korab’s report the company decided the wisest course of action was to disable MAIL-FROM: authentication altogether.

Internet 72

Internet Internet Authentication Telecommunications 72

Krebs on Security

APRIL 6, 2021

From there, the bad guys can reset the password of any account to which that mobile number is tied, and of course intercept any one-time tokens sent to that number for the purposes of multi-factor authentication. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code.

Mobile 360

Mobile Accountability Passwords Authentication 360

Krebs on Security

MARCH 16, 2021

But Lucky225 said the class of SMS interception he’s been testing targets a series of authentication weaknesses tied to a system developed by NetNumber , a private company in Lowell, Mass. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code.

Telecommunications 363

Telecommunications Mobile Accountability Wireless 363

Krebs on Security

NOVEMBER 11, 2023

I immediately suspected that Experian was still allowing anyone to recreate their credit file account using the same personal information but a different email address, a major authentication failure that was explored in last year’s story, Experian, You Have Some Explaining to Do. 9, 2022 and Dec.

Accountability 333

Accountability Authentication Passwords Identity Theft 333

The Last Watchdog

FEBRUARY 20, 2024

Authentication and authorization vulnerabilities: Weak authentication methods and compromised access tokens can provide unauthorized access. Multi-factor authentication: Implement multi-factor authentication for administration and privileged users to enhance access control and prevent unauthorized entry.

Cybersecurity 273

Cybersecurity Penetration Testing Authentication Social Engineering 273

The Last Watchdog

NOVEMBER 19, 2023

As the companies face nine federal lawsuits for failing to protect customer data, it’s abundantly clear hackers have checkmated multi-factor authentication (MFA). But the coup de gras was how easily they brushed aside the multi-factor authentication protections. How they steamrolled multi-factor authentication is a reason for pause.

Social Engineering 310

Social Engineering Passwords Authentication Marketing 310