article thumbnail

Weekly Update 395

Troy Hunt

Data breach verification: that seems like a good place to start given the discussion in this week's video about Accor. However, per that story: Cybernews couldn’t confirm the authenticity of the data. We reached out to Accor for clarification and are awaiting a response.

article thumbnail

You Don't Need to Burn off Your Fingertips (and Other Biometric Authentication Myths)

Troy Hunt

As technology has evolved, fingers (and palms and irises and faces) have increasingly been used as a means of biometric authentication. The one in storage matches the one provided at the time of authentication. All this compared to simply matching 2 strings as is done with password authentication. That is all.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Using Fake Reviews to Find Dangerous Extensions

Krebs on Security

Here’s the story of how bogus reviews on a counterfeit Microsoft Authenticator browser extension exposed dozens of other extensions that siphoned personal and financial data. A counterfeit version of CapCut , a professional video editing software suite, claimed nearly 24,000 downloads over a similar time period.

article thumbnail

GhostTouch: how to remotely control touchscreens with EMI

Security Affairs

The researchers demonstrated how to inject two types of basic touch events, taps and swipes, into targeted locations of the touchscreen. The events allowed the researchers to control the devices (i.e. GhostTouch uses electromagnetic interference (EMI) to remotely inject fake touch points into a capacitive device.

Paper 141
article thumbnail

Vulnerability Recap 4/1/24: Cisco, Fortinet & Windows Server Updates

eSecurity Planet

When either on-premise or cloud-based Active Directory domain controllers process Kerberos authentication requests, the leak causes the LSASS process to stop responding and the domain controller will unexpectedly restart. Oglio tracks vulnerability CVE-2023-48022 , rated CVSS 9.8 (out out of 10), and calls it Shadow Ray.

article thumbnail

Android 7.0+ Phones Can Now Double as Google Security Keys

Krebs on Security

Google this week made it easier for Android users to enable strong 2-factor authentication (2FA) when logging into Google’s various services. and higher can now be used as Security Keys , an additional authentication layer that helps thwart phishing sites and password theft.

Security 230
article thumbnail

Catches of the Month: Phishing Scams for December 2022

IT Governance

On Friday, a deepfake video emerged on Twitter that appeared to show FTX founder Sam Bankman-Fried offering an opportunity for users to recoup their losses. The video directed viewers to visit a website where they could enter a giveaway to win cryptocurrency. Hello everyone. To do this, just go to the site ftxcompensation.com.”.

Phishing 111