Wake-up call to those who still rely on SMS-based authentication and believes it is secure (don't give up, just replace SMS with OTP apps)

According to Reddit, the unknown hacker(s) managed to gain read-only access to some of its systems that contained its users' backup data, source code, internal logs, and other files

According to Slowe, the most significant data contained in the backup was account credentials (usernames and their corresponding salted and hashed passwords), email addresses and all content including private messages.

The hack was accomplished by intercepting SMS messages that were meant to reach Reddit employees with one-time passcodes, eventually circumventing the two-factor authentication (2FA) Reddit had in place attacks.

https://thehackernews.com/2018/08/hack-reddit-account.html

Your vendor/ Partner's security practices has a direct impact on your organization's security - 157 GB of Automaker Secrets Leaked because of insecure backup protocol used by third-party firm.

A total of seven auto companies were impacted by the data leak, including divisions of automakers Chrysler, Ford, GM, Tesla, Toyota and Volkswagen, along with automotive supplier ThyssenKrupp.

One also inadvertently leaked its own internal data, including employee scans of driver’s licenses and passports, along with invoices, contracts, and bank-routing numbers and SWIFT codes

To blame was rsync, which stands for “remote sync,” a common file transfer protocol used to mirror or backup large data sets,

Leaky rsync services are typically a result of permissions set on the rsync server. In the case of Level One, the rsync server was publicly writable.



https://threatpost.com/leaky-backup-spills-157-gb-of-automaker-secrets/134293/

Verizon DBIR 2017 Report - This picture could help you with your Security Spending

Software service provider [24]7.ai was breached - You might think I, don't know this company so I don't care.NOT IF YOU ARE a Delta, Sears, Best Buy or Kmart customer.

MORAL OF THE STORY - Security practice of our Partners is indirectly a part of our security practice.


Last week software service provider [24]7.ai, a company that provides online chat services for Delta, Sears and other companies, announced that its platform was a victim of a data breach in 2017.

On Wednesday, Delta Air Lines and Sears came forward to announce that they had been impacted – and on Friday, the number of impacted companies expanded to include Best Buy,


“The question needs to be asked, who are our partners, what are their security practices, what data are we sharing, and what systems will they have access to? In this example, [24]7.ai – the software service provider for Sears (and many other large retail and airline brands) – became the source for the breach exposing customer credit card data,”

https://threatpost.com/impact-of-chat-service-breach-expands-to-best-buy-kmart/131062/

Have you enabled MFA for your account? - Because, someone found 1.4 billion usernames and passwords in clear text

The collective database contains plain text credentials leaked from Bitcoin, Pastebin, LinkedIn, MySpace, Netflix, YouPorn, Last.FM, Zoosk, Badoo, RedBox, games like Minecraft and Runescape, and credential lists like Anti Public, Exploit.in.


"None of the passwords are encrypted, and what's scary is that we've tested a subset of these passwords and most of the have been verified to be true," Casal said


For More:
https://thehackernews.com/2017/12/data-breach-password-list.html

Cloud based Password Manager - Really do people trust the Cloud so much, Anyway they were breached

I am not against cloud.
But, I won't trust  (at least, for now) the cloud t to the point of saving my passwords in the cloud .
Looks like they had multi-factor authentication. (At least, they have it NOW)

They claim to have strong encryption but, TRUST without VERIFY is not RELIABLE.



From the article

Password manager LastPass disclosed today that its network was breached and advised users to change their master passwords and enable multifactor authentication.

Tod Beardsley, security engineering manager at Rapid7, pointed out that since the attackers don’t seem to have access to the passwords encrypted with the master, the stolen account email addresses may pose a more immediate risk. 

For more info:

https://threatpost.com/lastpass-network-breached-calls-for-master-password-reset/113324

70 Percent of World's Critical Utilities Breached

78 percent of the senior security officials responded that a successful attack is at least somewhat likely within the next 24 months



The link below has more information:-

http://www.darkreading.com/attacks-breaches/infographic-70-percent-of-worlds-critical-utilities-breached/a/d-id/1298006

Back to the Past - Message from First American Bank - Avoid paying for cab rides in Chicago with credit or debit cards,

This might sound like bad message but, given the context , it looks like the right thing to do.

why?

Here is the public statement from the bank:

“We have reported the breach to MasterCard® and have kept them apprised of details as they’ve developed. We have also made repeated attempts to deal directly with Banc of America Merchant Services and Bank of America, the payment processors for the taxis, to discontinue payment processing for the companies suffering this compromise until its source is discovered and remediated. These companies have not shared information about their actions and appear to not have stopped the breach.”

The link below has more details:

http://krebsonsecurity.com/2014/03/illinois-bank-use-cash-for-chicago-taxis/

360 million account credentials found in the wild

A cybersecurity company said Tuesday it has obtained a list of 360 million account credentials for Web services, likely collected through multiple data breaches.

One batch of 105 million details, discovered about 10 days ago by the company, included email addresses and corresponding passwords, but it isn't clear what Web services the credentials

My Thoughts:

We not only lose our credentials, The hackers also get to know how we determine the process of creating passwords (Ex: P@55w0rd would disclose that I am replacing alphabets with similar looking characters)

The link below has more details:

http://www.computerworld.com/s/article/9246604/360_million_account_credentials_found_in_the_wild_says_security_firm

Neiman Marcus CC # theft - 60,000 Alerts ignored.

Here is an reason/excuse from the company spokeswoman - “These 60,000 entries, which occurred over a three-and-a-half month period, would have been on average around 1 percent or less of the daily entries on these endpoint protection logs, which have tens of thousands of entries every day,”

A company that receives 60,000x100 alerts a day has a problem defining what an ALERT is or, the spokeswomen does not know what an ALERT means or why it is generated in the first place.

http://www.businessweek.com/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data