Security News
The vulnerability allows the bad actor to extract the encryption key or the ECDSA private key linked to a victim's account from a FIDO Universal 2nd Factor device like Google Titan Key or YubiKey, thus completely undermining the 2FA protections. An actor will have first to steal the target's login and password of an account secured by the physical key, then stealthily gain access to Titan Security Key in question, not to mention acquire expensive equipment costing north of $12,000, and have enough expertise to build custom software to extract the key linked to the account.
Challenges organizations face in combating third-party cyber riskA CyberGRX report reveals trends and challenges organizations of all sizes face in combating third-party cyber risk today. cPanel 2FA bypass vulnerability can be exploited through brute forceA two-factor authentication bypass vulnerability affecting the popular cPanel & WHM software suite may allow attackers to access secured accounts, Digital Defense researchers have found.
A security flaw in the cPanel web hosting control panel allows attackers to circumvent two-factor authentication checks via brute-force attacks for domains managed using vulnerable cPanel & WebHost Manager versions. Attackers could abuse CVE-2020-27641 to bypass 2FA for cPanel accounts on potentially millions of websites because cPanel's Security Policy did not block them from repeatedly submitting two-factor authentication codes.
cPanel last week released patches to address three vulnerabilities in cPanel & WebHost Manager, including one leading to two-factor authentication bypass. With over 20 years of web hosting experience, cPanel claims servers using cPanel & WHM have launched more than 70 million domains.
A two-factor authentication bypass vulnerability affecting the popular cPanel & WHM software suite may allow attackers to access secured accounts, Digital Defense researchers have found. Still, admins of sites that are managed through cPanel should check whether their provider did perform the update.
Scammers have hatched a new way to attempt to bypass two-factor authentication protections on Facebook. The first step in the "Appeal?" The victim is asked to submit a username, password and 2FA code from their mobile device, according to Sophos researcher Paul Ducklin, allowing fraudsters bypass 2FA. 2FA is an added layer of protection on top of a username and password that usually involves sending a unique code to a mobile device, which must be entered to access a platform.
Notification of Alleged Copyright Violation Recently there have been reports citing copyright violations of your Page posts. The link on the Facebook page above looks as though it stays on facebook.com, but the URL you see in blue above isn't the URL you visit if you click it.
A newly uncovered banking trojan called Alien is invading Android devices worldwide, using an advanced ability to bypass two-factor authentication security measures to steal victim credentials. Researchers believe Alien is a "Fork" of the infamous Cerberus banking malware, which has undergone a steady demise in use over the past year.
Researchers have uncovered a threat group launching surveillance campaigns that target victims' personal device data, browser credentials and Telegram messaging application files. One notable tool in the group's arsenal is an Android malware that collects all two-factor authentication security codes sent to devices, sniffs out Telegram credentials and launches Google account phishing attacks.
Video conferencing platform Zoom this week announced that all user accounts can now benefit from improved protection, courtesy of support for Two-Factor Authentication. With 2FA enabled on their accounts, users should be protected from security breaches, including those that originate from the Zoom platform itself, the company claims.