Category Archives: two factor authentication

Automated Social Engineering Driven OTP (One-Time-Passwords) and Two Factor Authentication Bypassing Platform and Mobile Application Spotted in the Wild – An Analysis

Posted on by

I’ve recently stumbled upon a newly released DIY social engineering and OTP (One-Time-Passwords) and two-factor authentication bypassing platform and mobile application which is fully capable of socially engineering a gullible end user into falling vic… Continue reading Automated Social Engineering Driven OTP (One-Time-Passwords) and Two Factor Authentication Bypassing Platform and Mobile Application Spotted in the Wild – An Analysis→

Problems with Multifactor Authentication

Posted on by

Roger Grimes on why multifactor authentication isn’t a panacea:

The first time I heard of this issue was from a Midwest CEO. His organization had been hit by ransomware to the tune of $10M. Operationally, they were still recovering nearly a year later. And, embarrassingly, it was his most trusted VP who let the attackers in. It turns out that the VP had approved over 10 different push-based messages for logins that he was not involved in. When the VP was asked why he approved logins for logins he was not actually doing, his response was, “They (IT) told me that I needed to click on Approve when the message appeared!”…

Continue reading Problems with Multifactor Authentication→

Top 10 WordPress website maintenance tips

Posted on by

A newly installed WordPress site feels so good. No speed issues, no plugin conflict, no errors, no problems at all. You are exhilarated, and you can’t wait to see thousands of readers on your website every week. Few months down the line, your seemingly… Continue reading Top 10 WordPress website maintenance tips→

Four Steps to Protect Strategic Information

Posted on by

The COVID-19 pandemic has shifted the spotlight back on security issues that organizations have struggled with for years. Workers are connecting to corporate networks from more devices than ever before – but moves to protect, manage and back up the se… Continue reading Four Steps to Protect Strategic Information→

Cloning Google Titan 2FA keys

Posted on by

This is a clever side-channel attack:

The cloning works by using a hot air gun and a scalpel to remove the plastic key casing and expose the NXP A700X chip, which acts as a secure element that stores the cryptographic secrets. Next, an attacker connec… Continue reading Cloning Google Titan 2FA keys→

FBI Warn Hackers are Using Hijacked Home Security Devices for ‘Swatting’

Posted on by

Stolen email credentials are being used to hijack home surveillance devices, such as Ring, to call police with a fake emergency, then watch the chaos unfold. Continue reading FBI Warn Hackers are Using Hijacked Home Security Devices for ‘Swatting’→

How the SolarWinds Hackers Bypassed Duo’s Multi-Factor Authentication

Posted on by

This is interesting:

Toward the end of the second incident that Volexity worked involving Dark Halo, the actor was observed accessing the e-mail account of a user via OWA. This was unexpected for a few reasons, not least of which was the targeted mail… Continue reading How the SolarWinds Hackers Bypassed Duo’s Multi-Factor Authentication→

‘Copyright Violation’ Notices Lead to Facebook 2FA Bypass

Posted on by

Fraudulent Facebook messages allege copyright infringement and threaten to take down pages, unless users enter logins, passwords and 2FA codes. Continue reading ‘Copyright Violation’ Notices Lead to Facebook 2FA Bypass→

Researcher: I Hacked Trump’s Twitter by Guessing Password

Posted on by

Trump’s weak Twitter password and lack of basic two-factor authentication protections made it shockingly simple to hack his account, Dutch security researcher Victor Gevers reported.   Continue reading Researcher: I Hacked Trump’s Twitter by Guessing Password→