Info Security Magazine
4 years ago
Financial Firms Failing to Fix Authentication Breaches
Four in five breaches down to compromised credentials, research finds
Security news aggregator
Latest coverage for Authentication
Stay secure online with the latest on authentication techniques, best practices, and industry updates at the forefront of information security.
12
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
Authentication confirms the identity of users or systems before granting access to resources, typically using factors like passwords (knowledge), hardware tokens (possession), or biometrics (inherence). It establishes trust boundaries that prevent unauthorized entities from impersonating legitimate users or devices within networks and applications.
Weak authentication enables attackers to perform account takeover, privilege escalation, or lateral movement by exploiting stolen credentials, phishing, or replay attacks. Deploying multi-factor authentication (MFA) with independent factors significantly reduces these risks. Secure credential storage, regular rotation, and monitoring authentication logs for anomalies are critical defenses to detect and block unauthorized access attempts early in the attack chain.
Showing 12 most recent headlines
Filtered view
Bleeping Computer
4 years ago
Attackers scan 1.6 million WordPress sites for vulnerable plugin
Security researchers have detected a massive campaign that scanned close to 1.6 million WordPress sites for the presence of a vulnerable plugin that allows uploading files without authentication. [...]
Dark Reading
4 years ago
Report: Financial Institutions Overly Complacent About Current Authentication Methods
New research report finds most financial organizations have experienced a breach due to an authentication weakness, yet only a third took action
The Register
4 years ago
This big phish can swim around MFA, says Microsoft Security
Slippery AiTM attacks targeted more than 10,000 orgs over the past nine months A widespread phishing campaign that has hit more than 10,000 organizations since September 2021 uses adversary-in-the-middle (AiTM) proxy sites to get around multifactor authentication (MFA) features and steal credentials that are then used to compromise business email accounts.…
Dark Reading
4 years ago
Microsoft: 10,000 Orgs Targeted in Phishing Attack That Bypasses Multifactor Authentication
The massive phishing campaign does not exploit a vulnerability in MFA. Instead, it spoofs an Office 365 authentication page to steal credentials.
Threat Post
4 years ago
Large-Scale Phishing Campaign Bypasses MFA
Attackers used adversary-in-the-middle attacks to steal passwords, hijack sign-in sessions and skip authentication and then use victim mailboxes to launch BEC attacks against other targets.
The Hacker News
4 years ago
Microsoft Warns of Large-Scale AiTM Phishing Attacks Against Over 10,000 Organizations
Microsoft on Tuesday disclosed that a large-scale phishing campaign targeted over 10,000 organizations since September 2021 by hijacking Office 365's authentication process even on accounts secured with multi-factor authentication (MFA)
Info Security Magazine
4 years ago
Microsoft Details How Phishing Campaign Bypassed MFA
A large-scale phishing campaign stole passwords, hijacked a user’s sign-in session and skipped the authentication process even if MFA was enabled
Bleeping Computer
4 years ago
VMware patches vCenter Server flaw disclosed in November
Eight months after disclosing a high-severity privilege escalation flaw in vCenter Server's IWA (Integrated Windows Authentication) mechanism, VMware has finally released a patch for one of the affected versions. [...]
Dark Reading
4 years ago
PyPI Mandates 2FA, Plans Google Titan Key Giveaway
Python's most popular package manager is intent on securing the supply chain by requiring developers to enable two-factor authentication.
The Register
4 years ago
Amazon squashes years-old authentication bugs in AWS Kubernetes service
Three vulnerabilities in one line of code AWS fixed three authentication bugs present in one line of code in its IAM Authenticator for Kubernetes, used by the cloud giant's popular managed Kubernetes service Amazon EKS, that could allow an attacker to escalate privileges within a Kubernetes cluster.…
The Hacker News
4 years ago
PyPI Repository Makes 2FA Security Mandatory for Critical Python Projects
The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed "critical." "We've begun rolling out a 2FA requirement: soon, maintainers of critical projects must have 2FA enabled to publish, update, or modify them," Python Package Index (PyPI) said in a tweet last week