The Hacker News

JUNE 17, 2024

ASUS has shipped software updates to address a critical security flaw impacting its routers that could be exploited by malicious actors to bypass authentication. Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device," out of a maximum of 10.0.

Authentication 144

Authentication Software 144

The Last Watchdog

MARCH 1, 2023

The IT world relies on digital authentication credentials, such as API keys, certificates, and tokens, to securely connect applications, services, and infrastructures. According to BetterCloud, the average number of software as a service (SaaS) applications used by organizations worldwide has increased 14x between 2015 and 2021.

Authentication 222

Authentication CISO Passwords Software 222

Security Affairs

MAY 22, 2024

A critical security vulnerability in Veeam Backup Enterprise Manager could allow threat actors to bypass authentication. A critical vulnerability, tracked as CVE-2024-29849 (CVSS score: 9.8), in Veeam Backup Enterprise Manager could allow attackers to bypass authentication.

Backups 136

Backups Authentication Accountability Software 136

Tech Republic Security

AUGUST 8, 2024

Discover how to safeguard IVR banking from hackers and implement secure authentication methods for customer protection. Find out how these digital alternatives benefit both customers and agents.

Banking 149

Banking Authentication Software Network Security 149

The Hacker News

MARCH 10, 2024

Technical specifics and a proof-of-concept (PoC) exploit have been made available for a recently disclosed critical security flaw in Progress Software OpenEdge Authentication Gateway and AdminServer, which could be potentially exploited to bypass authentication protections. on the CVSS scoring system.

Software 138

Software Authentication 138

Penetration Testing

MAY 20, 2024

GitHub, the world’s leading software development platform, has disclosed a critical security vulnerability (CVE-2024-4985) in its self-hosted GitHub Enterprise Server (GHES) product.

Authentication 145

Authentication Penetration Testing Software 145

Krebs on Security

SEPTEMBER 13, 2023

Info-stealers like RedLine typically are deployed via opportunistic email malware campaigns, and by secretly bundling the trojans with cracked versions of popular software titles made available online. Also, unless you really know what you’re doing, please don’t download and install pirated software.

Cybercrime 323

Cybercrime Passwords Authentication Malware 323

Malwarebytes

MAY 16, 2024

More and more websites and services are making multi-factor-authentication (MFA) mandatory, which makes it much harder for cybercriminals to access your accounts. A type of phishing we’re calling authentication-in-the-middle is showing up in online media. Use security software. That’s a great thing.

Authentication 145

Authentication Phishing Password Management Scams 145

Krebs on Security

DECEMBER 18, 2020

government cybersecurity agencies warned this week that the attackers behind the widespread hacking spree stemming from the compromise at network software firm SolarWinds used weaknesses in other, non-SolarWinds products to attack high-value targets. National Security Agency (NSA) warned on Dec. ” Indeed, the NSA’s Dec.

Software 362

Software Authentication Hacking Government 362

Security Affairs

SEPTEMBER 11, 2024

The software firm released security updates to address a maximum security vulnerability, tracked as CVE-2024-29847, in its Endpoint Management software (EPM). The software firm released security updates to address a maximum security vulnerability, tracked as CVE-2024-29847, in its Endpoint Management software (EPM).

Software 136

Software Authentication IoT Hacking 136

Schneier on Security

NOVEMBER 21, 2023

TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. To ensure protection against these types of exploits, TAG urges users and organizations to keep software fully up-to-date and apply security updates as soon as they become available.

Authentication 289

Authentication Government Software 289

Schneier on Security

JANUARY 15, 2021

Monthly: The user pays their bill to the MVNO (credit card or otherwise) and the phone gets anonymous authentication (using Chaum blind signatures) tokens for each time slice (e.g., If it’s valid, the MVNO tells the MNO that the user is authenticated, and the user receives a temporary random ID and an IP address.

Surveillance 327

Surveillance Mobile Authentication VPN 327

Krebs on Security

MAY 29, 2021

Here’s the story of how bogus reviews on a counterfeit Microsoft Authenticator browser extension exposed dozens of other extensions that siphoned personal and financial data. A counterfeit version of CapCut , a professional video editing software suite, claimed nearly 24,000 downloads over a similar time period.

Accountability 335

Accountability Authentication Scams Software 335

Security Affairs

JULY 25, 2024

Progress Software addressed a critical remote code execution vulnerability, tracked as CVE-2024-6327, in the Telerik Report Server. Progress Software addressed a critical remote code execution flaw, tracked as CVE-2024-6327 (CVSS score of 9.9), in the Telerik Report Server that can be exploited to compromise vulnerable devices.

Software 130

Software Authentication Hacking Accountability 130

Schneier on Security

JANUARY 5, 2021

Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. The October files, distributed to customers on Oct.

Hacking 338

Hacking System Administration Software Surveillance 338

Security Affairs

SEPTEMBER 11, 2024

The software firm released security updates to address a maximum security vulnerability, tracked as CVE-2024-29847, in its Endpoint Management software (EPM). The software firm released security updates to address a maximum security vulnerability, tracked as CVE-2024-29847, in its Endpoint Management software (EPM).

Software 117

Software Authentication IoT Hacking 117

Schneier on Security

JUNE 15, 2022

The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it.

Artificial Intelligence 272

Artificial Intelligence Authentication Software Malware 272

Daniel Miessler

MAY 14, 2020

A password manager is a piece of software that creates all these for you, keeps them stored safely, and then fills them in for you automatically when you need to log in. Keep your firmware and software updated. Keep all of your software and hardware religiously updated. Enable two-factor authentication on all critical accounts.

Risk 345

Risk Password Management Passwords Accountability 345

Krebs on Security

NOVEMBER 12, 2024

Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451 , a spoofing flaw that could reveal Net-NTLMv2 hashes , which are used for authentication in Windows environments.

Authentication 238

Authentication Engineering Malware Passwords 238

Schneier on Security

MARCH 16, 2021

Andrew Appel and Susan Greenhalgh have a blog post on the insecurity of ES&S’s software authentication system: It turns out that ES&S has bugs in their hash-code checker: if the “reference hashcode” is completely missing, then it’ll say “yes, boss, everything is fine” instead of reporting an error.

Authentication 271

Authentication Software 271

Schneier on Security

FEBRUARY 3, 2021

Once the attackers had that initial foothold, they used a variety of complex privilege escalation and authentication attacks to exploit flaws in Microsoft’s cloud services. I don’t want to hype this defense too much without knowing a lot more, but I like the approach of verifying the software build process.

Computers and Electronics 358

Computers and Electronics Malware Software Government 358

Krebs on Security

AUGUST 21, 2020

” “The actors then convinced the targeted employee that a new VPN link would be sent and required their login, including any 2FA [2-factor authentication] or OTP [one-time passwords]. Employ the principle of least privilege and implement software restriction policies or other controls; monitor authorized user accesses and usage.

VPN 362

VPN Social Engineering Authentication Engineering 362

Troy Hunt

APRIL 26, 2021

Prepared in conjunction with the FBI, following is the recommended guidance for those that find themselves in this collection of data: Keep security software such as antivirus up to date with current definitions. Turn on 2 factor authentication wherever available. Keep operating systems and software patched.

Malware 346

Malware Passwords Banking Password Management 346

Penetration Testing

NOVEMBER 18, 2024

The Apache Software Foundation has recently disclosed three new vulnerabilities affecting Apache Tomcat, a widely-used open-source web server and servlet container.

Authentication 96

Authentication Software Cybersecurity 96

Krebs on Security

DECEMBER 10, 2024

Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The security firm Rapid7 notes there have been a series of zero-day elevation of privilege flaws in CLFS over the past few years.

Engineering 200

Engineering Authentication Software Accountability 200

Krebs on Security

JUNE 9, 2020

Microsoft today released software patches to plug at least 129 security holes in its Windows operating systems and supported software, by some accounts a record number of fixes in one go for the software giant.

Authentication 312

Authentication Software Backups Accountability 312

Krebs on Security

SEPTEMBER 12, 2023

Microsoft today issued software updates to fix at least five dozen security holes in Windows and supported software, including patches for two zero-day vulnerabilities that are already being exploited. Also, Adobe , Google Chrome and Apple iOS users may have their own zero-day patching to do. More details are at Adobe’s advisory.

Spyware 279

Spyware Software Surveillance Authentication 279

Krebs on Security

JUNE 15, 2024

.” In a SIM-swapping attack, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls sent to the victim — including one-time passcodes for authentication, or password reset links sent via SMS.

Hacking 311

Hacking Phishing Cybercrime Passwords 311

Krebs on Security

MARCH 23, 2022

For a fee, the willing accomplice must provide their credentials and approve the MFA prompt or have the user install AnyDesk or other remote management software on a corporate workstation allowing the actor to take control of an authenticated system. ” LAPSUS$ recruiting insiders via its Telegram channel. .

Social Engineering 327

Social Engineering Accountability Mobile Passwords 327

Krebs on Security

MARCH 2, 2021

today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products. Web shells are essentially software backdoors that allow attackers to steal data and perform additional malicious actions that lead to further compromise.

Internet 326

Internet Internet Software Education 326

Krebs on Security

APRIL 4, 2021

But some of that shine started to come off recently for Ubiquiti’s more security-conscious customers after the company began pushing everyone to use a unified authentication and access solution that makes it difficult to administer these devices without first authenticating to Ubiquiti’s cloud infrastructure. And on Jan.

Authentication 345

Authentication IoT Accountability Passwords 345

Troy Hunt

APRIL 5, 2023

We implement two factor authentication. Use multifactor authentication. Never download or install illegal software. When installing legal software, always check that the website is genuine. Cybercriminals then use this data for purposes ranging from identity theft to phishing attacks to credential stuffing.

Marketing 352

Marketing Passwords Authentication Accountability 352

Krebs on Security

NOVEMBER 14, 2023

Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three “zero day” vulnerabilities that Microsoft warns are already being exploited in active attacks.

Social Engineering 287

Social Engineering Phishing Internet Internet 287

Troy Hunt

AUGUST 29, 2023

Guidance for those impacted by this incident is the same tried and tested advice given after previous malware incidents: Keep security software such as antivirus up to date with current definitions. Enable multi-factor authentication where supported, at least for your most important services (email, banking, social, etc.)

Malware 325

Malware Passwords Password Management Antivirus 325

Krebs on Security

APRIL 26, 2021

Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s website, and it reminded me of how truly broken authentication and security remains in the credit bureau space. Dune Thomas is a software engineer from Sacramento, Calif. and $24.99

Authentication 350

Authentication Accountability Identity Theft Account Security 350

Krebs on Security

MAY 10, 2022

Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. “This allows attackers to perform a man-in-the-middle attack to force domain controllers to authenticate to the attacker using NTLM authentication,” Wiseman said.

Authentication 315

Authentication Engineering Internet Internet 315

The Last Watchdog

NOVEMBER 14, 2023

Combining DevSecOps with Generative Artificial Intelligence (Gen-AI) holds the potential to transform both software development and cybersecurity protocols. This frees up the DevSecOps teams to focus on higher-order tasks, such as testing and developing new authentication features.

Artificial Intelligence 262

Artificial Intelligence Software Engineering Cybersecurity 262