Duo's Security Blog

OCTOBER 13, 2023

Multi-factor Authentication (MFA) protects your environment by guarding against password weaknesses with strong authentication methods. In today’s blog, we’re unpacking why MFA is a cornerstone topic in this year’s Cybersecurity Awareness Month and how it can keep your organization safe from potentially devastating cyber attacks.

Authentication 145

Authentication Accountability Passwords Mobile 145

Krebs on Security

JANUARY 7, 2025

Lookout researchers discovered multiple voice phishing groups were using a new phishing kit that closely mimicked the single sign-on pages for Okta and other authentication providers. The image that Lookout used in its blog post for Crypto Chameleon can be seen in the lower right hooded figure. “ Annie.”

Phishing 334

Phishing Cryptocurrency Accountability Social Engineering 334

Duo's Security Blog

JUNE 25, 2024

Duo’s Risk-Based Authentication (RBA) helps solve this by adapting MFA requirements based on the level of risk an individual login attempt poses to an organization. Risky authentications are stepped-up, and users are required to authenticate with a more secure factor. Will users get blocked?

Authentication 138

Authentication Risk Artificial Intelligence Engineering 138

Schneier on Security

MARCH 25, 2022

I know him best for his work on authentication and covert channels, specifically as related to nuclear treaty verification. More blog posts. His work is cited extensively in Applied Cryptography. He has written a memoir of growing up dirt-poor in 1930s rural West Virginia.

Authentication 298

Authentication 298

Duo's Security Blog

APRIL 3, 2025

While the enforcement of multi-factor authentication (MFA) makes logging in more secure, it inevitably runs the risk of adding steps to a process users already find annoying. While this may avoid authentication fatigue, it certainly risks and may even violate some security standards.

Authentication 52

Authentication Passwords Risk VPN 52

The Last Watchdog

MARCH 1, 2023

The IT world relies on digital authentication credentials, such as API keys, certificates, and tokens, to securely connect applications, services, and infrastructures. Related: The coming of agile cryptography These secrets work similarly to passwords, allowing systems to interact with one another.

Authentication 222

Authentication CISO Passwords Software 222

Duo's Security Blog

MAY 2, 2024

We are excited to have partnered closely with Microsoft in the co-development of Microsoft Entra ID External Authentication Methods, available in Public Preview May 2024! External Authentication Methods (EAM) enables frictionless integration of Duo’s full security feature set.

Authentication 144

Authentication Phishing Passwords Risk 144

Malwarebytes

NOVEMBER 24, 2023

Researchers have found several weaknesses in Windows Hello fingerprint authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. They found vulnerabilities that allowed them to completely bypass Windows Hello authentication on all three. The input has to be authenticated.

Authentication 141

Authentication Manufacturing Engineering Hacking 141

IT Security Guru

JUNE 13, 2024

These attackers appear to be using the stolen GitHub credentials of users who have not enabled two-factor authentication (2FA). Our data shows that between 93-97% of OX Security users have activated two-factor authentication (2FA), which helps keep accounts, data, and secrets private.

Backups 134

Backups Authentication Data breaches Social Engineering 134

Krebs on Security

OCTOBER 30, 2024

“Affected insurance providers can contact us to prevent leaking of their own data and [remove it] from the sale,” RansomHub’s victim shaming blog announced on April 16. A few days after BlackCat imploded, the same stolen healthcare data was offered for sale by a competing ransomware affiliate group called RansomHub.

Healthcare 292

Healthcare Insurance Computers and Electronics Data breaches 292

The Last Watchdog

SEPTEMBER 24, 2024

About the essayist: Ambuj Kumar is Co-founder and CEO of Simbian , AI Agents for cybersecurity The post GUEST ESSAY: Massive NPD breach tells us its high time to replace SSNs as an authenticator first appeared on The Last Watchdog.

Authentication 216

Authentication Identity Theft Banking Data breaches 216

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. Image: Cloudflare.com. ” On July 28 and again on Aug. In an Aug.

Mobile 336

Mobile Phishing Authentication Accountability 336

Duo's Security Blog

OCTOBER 23, 2024

Available now in all paid Duo subscriptions The launch of Duo Mobile in the early 2010s changed how businesses enabled secure authentication. Other means of authentication outside of smartphones — hardware tokens, phone call authentication, SMS, etc. have proven to be either antiquated, expensive or vulnerable.

Authentication 116

Authentication Mobile Manufacturing Risk 116

Adam Shostack

JANUARY 2, 2025

Authentication is more frustrating to your customers when you dont threat model. When he did, they sent him a text message to authenticate him, and it says DO NOT share this access code with anyone. Ok, technically theres more lessons, which are in this blog post, but you know what I mean. Happier customers. Less frustration.

Banking 130

Banking Passwords Password Management Authentication 130

Schneier on Security

MARCH 16, 2021

Andrew Appel and Susan Greenhalgh have a blog post on the insecurity of ES&S’s software authentication system: It turns out that ES&S has bugs in their hash-code checker: if the “reference hashcode” is completely missing, then it’ll say “yes, boss, everything is fine” instead of reporting an error.

Authentication 279

Authentication Software 279

Troy Hunt

APRIL 6, 2020

That email would have been a reply to one you originally sent to me that would have sounded something like this: Hi, I came across your blog on [thing] and I must admit, it was really nicely written. I also have an article on [thing] and I think it would be a great addition to your blog. On a popular blog. Just the title.

Advertising 325

Advertising Internet Internet VPN 325

The Last Watchdog

JULY 11, 2024

Related: Passwordless workpace long way off However, as users engage with more applications across multiple devices, the digital security landscape is shifting from passwords and password managers towards including passwordless authentication, such as multi-factor authentication (MFA), biometrics, and, as of late, passkeys.

Authentication 124

Authentication Passwords Malware Accountability 124

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are).

Passwords 342

Passwords Mobile Authentication Banking 342

Duo's Security Blog

MAY 15, 2024

In the world of access management, we have seen wide deployment of multi-factor authentication (MFA) at the point of the Operating System (OS) to invoke the layer of something you know (i.e., See the video at the blog post. a password) and something you have (i.e., a registered device).

Authentication 124

Authentication Social Engineering Passwords Engineering 124

Schneier on Security

FEBRUARY 3, 2021

Details are in the Microsoft blog: We have published our in-depth analysis of the Solorigate backdoor malware (also referred to as SUNBURST by FireEye), the compromised DLL that was deployed on networks as part of SolarWinds products, that allowed attackers to gain backdoor access to affected devices.

Computers and Electronics 363

Computers and Electronics Malware Software Government 363

Security Boulevard

MARCH 31, 2025

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect.

Risk 64

Risk Authentication 64

Security Affairs

NOVEMBER 2, 2024

is an inadequate authentication mechanisms that could allow an attacker to access sensitive information like usernames, MD5 password hashes, and configuration data. “Read the GreyNoise Labs blog for technical analysis and deeper insight into how Sift helped discover these zero-day vulnerabilities.”

Firmware 120

Firmware Manufacturing IoT Healthcare 120

Anton on Security

OCTOBER 12, 2022

This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our fourth Threat Horizons Report ( full version ) that we just released ( the official blog for #1 report , my unofficial blog for #2 , my unofficial blog for #3 ).

Cybersecurity 246

Cybersecurity Malware Accountability Passwords 246

The Last Watchdog

APRIL 22, 2025

Typically, the attacker collects authentic media samples of their target, including still images, videos, and audio clips, to train the deep learning model. The more training data used, the more authentic the deepfake appears.

Authentication 100

Authentication Social Engineering Technology Media 100

Krebs on Security

MARCH 16, 2021

An expert on SIM-swapping attacks who’s been quoted quite a bit on this blog , Nixon said she also had Lucky225 test his interception tricks on her mobile phone, only to watch her incoming SMS messages show up on his burner phone. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code.

Telecommunications 363

Telecommunications Mobile Accountability Wireless 363

IT Security Guru

FEBRUARY 25, 2025

A prime example is multi-factor authentication (MFA), a security process that requires users to verify their identity in two or more ways, such as a password, a code sent to their phone, or a fingerprint. Advanced authentication systems can analyse contextual factors, like location, device, and login behaviour, to detect anomalies.

Social Engineering 119

Social Engineering Authentication Risk Accountability 119

eSecurity Planet

DECEMBER 4, 2024

David Weston, VP of enterprise and OS security, said in a blog post , “We are committed to ensuring that Windows remains the most reliable and resilient open platform for our customers.” This includes strengthening password policies, implementing multi-factor authentication, and leveraging advanced threat detection techniques.

Encryption 107

Encryption Phishing Passwords Authentication 107

Krebs on Security

NOVEMBER 21, 2020

. “A domain hosting provider ‘GoDaddy’ that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor,” Liquid CEO Kayamori said in a blog post. authenticate the phone call before sensitive information can be discussed.

Cryptocurrency 363

Cryptocurrency VPN Scams Social Engineering 363

Security Affairs

FEBRUARY 10, 2025

CVE-2024-57968 allows remote authenticated users to upload files to unintended folders, while CVE-2025-25181 is an SQL injection flaw enabling remote SQL execution (no patch available). The group was also observed exploiting vulnerabilities in Telerik UI such as CVE-2017-9248 and CVE-2019-18935. .

Manufacturing 109

Manufacturing Cybercrime Passwords Authentication 109

Krebs on Security

SEPTEMBER 2, 2021

Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials. “For context, our research indicates that multi-factor authentication prevents more than 99.9%

Accountability 341

Accountability Authentication Passwords Hacking 341

Krebs on Security

FEBRUARY 8, 2021

Perhaps the biggest selling point for U-Admin is a module that helps phishers intercept multi-factor authentication codes. Qbot) — to harvest one-time codes needed for multi-factor authentication. 2020 blog post on an ongoing Qakbot campaign that was first documented three months earlier by Check Point Research.

Phishing 327

Phishing Scams Banking Mobile 327

Troy Hunt

OCTOBER 28, 2020

Everything becomes clear(er) if I manually change the font in the browser dev tools to a serif version: The victim I was referring to in the opening of this blog post? Obviously, the image is resized to the width of paragraphs on this blog, give it a click if you want to check it out at 1:1 size. What's the solution here?

Phishing 363

Phishing Password Management Passwords Internet 363

Duo's Security Blog

FEBRUARY 29, 2024

The choice of authentication methods plays a key role in defending against identity threats. In the first two blogs of this three-part series, we discussed the MFA methods available to users and their strengths and weaknesses in defending against five types of cyberattack. What authentication methods are right for you?

Authentication 135

Authentication Social Engineering Phishing Software 135

Krebs on Security

OCTOBER 20, 2023

Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. ET: BeyondTrust has published a blog post about their findings. Update, 2:57 p.m.

Social Engineering 355

Social Engineering Engineering Accountability Hacking 355

Duo's Security Blog

APRIL 24, 2025

Were thrilled to announce Duo Wear , a companion app for Duo Mobile that brings fast and easy multi-factor authentication (MFA) to your Wear OS smartwatch! Its quick, simple, and offers a frictionless authentication experience. What is Duo Wear? Duo Wear is an app designed specifically for Wear OS smartwatches. Why Make a Wear OS App?

Authentication 69

Authentication Mobile Technology 69

Duo's Security Blog

FEBRUARY 26, 2024

Administrators and end-users of a multi-factor authentication (MFA) product like Duo’s face a variety of options for how to authenticate. In this first blog of a three-part series, we’ll define four categories of authentication methods encompassing a broad array of device types.

Authentication 132

Authentication Mobile Passwords Software 132

Malwarebytes

JANUARY 15, 2025

Interestingly, the malicious ad we found was for Google Authenticator, despite the obvious ads-goo[.]click There is also a distant feel of ‘software download via Google ads’ we have reported on previously (see Threat actor impersonates Google via fake ad for Authenticator ). click domain name.

Advertising 136

Advertising Accountability Phishing Scams 136