Tag Archive for: Confirmed

Data breach at Social Blade confirmed. Hacker offers to sell database on underground website

/in


Social media analytics service Social Blade has confirmed that it is investigating a security breach after a hacker offered its user database for sale on an underground criminal website.

In a notification sent to Social Blade users, the firm said that it had confirmed that its database was being offered for sale on a hacking forum after being notified of a potential breach on December 14th.

According to Bleeping Computer, Social Blade’s data was first put on sale on the underground forum on December 12, 2022.

The hacker, meanwhile, claims to have stolen the database of 5.6 million records in September.

Social Blade, which monitors the social media accounts of tens of millions of users, issued a reassurance that no credit card information had been leaked, but did say that the leaked data included email addresses, IP addresses, password hashes, client IDs and tokens for business API users, auth tokens for connected accounts, and “many other pieces of non-personal and internal data.”

In addition, the firm warned that “a very small subset of the data (about a tenth of a percent)”” also included the addresses of users.

Social Blade went on to say that although password hashes had been leaked, it did not believe they were at risk as the strong bcrypt encryption algorithm had been used. Nonetheless, it would be sensible for affected Social Blade users to change their passwords, ensuring that new passwords are hard-to-crack or guess, and are unique.

Business API tokens have meanwhile been reset to prevent exploitation by unauthorised third parties.

Social Blade believes that the individual who stole its data accessed it by exploiting a website vulnerability. It says it has closed the security hole and is conducting additional reviews of its systems to ensure that security is further hardened.

Anyone who has used Social Blade would be wise to not only change their password but also to be on the lookout for scams and phishing attacks which attempt to use the breached information to trick the unwary into handing over further details.

Source…

Zero-Day Twitter Hack Confirmed, Impact Could Exceed 20 Million Users

/in


At least 5 million Twitter users impacted by zero-day hack, total could yet exceed 20 million.

On 5 August 2022, Twitter confirmed that a threat actor used a zero-day vulnerability to compile a database of user information. That vulnerability was fixed, Twitter said, in January 2022. However, Bleeping Computer has reported that the database, which includes non-public information of more than 5 million users, has now been shared for free within a breached data marketplace forum. The publication also reports that another database, potentially containing 17 million records, was created using the same vulnerability. Here’s what we know so far.

Database of 5,485,635 Twitter users shared by cybercriminals online

The Bleeping Computer report confirms that the database of 5,485,635 Twitter user records, initially offered for sale at $30,000 in July, has been shared on 24 November, for free, on the Breach Forums site. Most of the data, it would appear, is publicly known, such as Twitter usernames, login names, and verification status. However, the report also states that private information, such as telephone numbers and email addresses, is also included.

MORE FROM FORBESTwitter Users Warned Not To Delete Their Accounts-Here’s WhyBy Davey Winder

The information appears to have been gathered using an Application Programming Interface (API) vulnerability, as first disclosed by a hacker on the HackerOne bug bounty platform (who received a $5,000 payment from Twitter), enabling the data to be scraped. “APIs allow computers to communicate with one another, and account for around 80% of all the traffic that traverses the Internet. In short, APIs are very important and should be treated as such,” Ed Williams, director of SpiderLabs (EMEA) at Trustwave, says. “Yet, we still see common security-related issues around APIs, most notably authentication (or lack of) based issues, a lack of resource and rate limiting, and generic API security misconfigurations like TLS, error handling, and logging. We know from recent data breaches that a combination of these can yield significant amounts of personal data.”

Twitter…

Source…

London Police Arrest Teen Hacking Suspect, Have Not Confirmed GTA 6 Leak Link

/in


London police have arrested a 17-year-old on suspicion of hacking and some have speculated that it has something to do with the Grand Theft Auto VI leaks. Last weekend, 90+ videos of GTA 6 footage were posted on the GTAForums before it spread across the rest of the internet. Although some were doubtful it was real given Rockstar Games‘ immense secrecy, it became evident fairly quickly that the footage was authentic and this was the first look at the highly anticipated game. The leaker in question claimed to have been responsible for a hack on both Rockstar Games and Uber. Rockstar Games issued a statement on Monday morning confirming that it had a security breach and that the leaked footage was indeed real. Shortly after this, Uber reported that it was working with the FBI and US Department of Justice to find the hacker.

London City Police announced on Twitter on September 23rd that it had arrested a 17-year-old on suspicion of hacking as part of an investigation conducted by the National Crime Agency’s Cyber Crime Unit. The teen is currently in custody, though no specifics have been given. Although there’s been rumors and intense speculation prior to the arrest that the hacker was a teen operating out of the UK, London police have not confirmed any link between the two cases. ComicBook reached out to London police for more information and received this brief statement: “We have no further information to share at this stage. Any updates will be shared on our Twitter.” We also reached out to Rockstar Games, but did not receive a response in time for publication.

As of right now, it remains to be seen what will come of this. Rockstar Games has already confirmed that it doesn’t expect any long term disruption to the development of the next Grand Theft Auto, so fans don’t have to worry about the game being internally delayed by years. We still have…

Source…

Bad News Confirmed For 1.3 Billion Apple iMessage Users

/in


Yes, Apple’s iPhone is materially more secure than Android and yes, Apple still leads the way when it comes to your privacy. But there is a huge exception to the Cupertino giant’s security- and privacy-first approach, one that impacts a billion-plus iPhone and iPad users. And we had stark confirmation this week that Apple is stubbornly refusing to step up to the plate and fix it.

We’re talking iMessage—Apple’s ubiquitous messaging platform. We all know that texting between iPhones and Androids is a pretty awful throwback to the early days of SMS. “It’s not about the color of the bubbles,” Google says. “It’s the blurry videos, broken group chats, missing read receipts and typing indicators, no texting over Wi-Fi, and more.”

But as fun as all these features would be, there’s a much more serious issue lurking in the background. iMessage has been central to Apple’s wider security challenges over the last year. Sophisticated (read national security level) cyber attacks have been found exploiting its architecture, and Apple has hardened the platform as a result. But there’s a much bigger problem that still hasn’t been fixed.

As much as we read about nation state level attacks, these impact just handfuls of users. You might be better protected from Chinese cyber-spies, but if you reuse passwords, click on dangerous links and casually open email attachments, then you, your data, your bank balance are far more at risk.

And so it is with iMessage. While Apple has sandboxed messages, plugging high-risk gaps, its end-to-end security only protects you while you stay enclosed within its ecosystem. As soon as those blue bubbles turn green, as soon as you text someone with an Android device in their hand, all bets are off.

Until fairly recently, there was no solution to this. Google had no real alternative to iMessage. The carriers were slowly deploying SMS v2, known as RCS or Rich Communication Services, but that still relied on the archaic SMS architecture that bounced from carrier to carrier, exposing data to all along the way. Google stepped in to fix this. First by taking over responsibility for driving RCS adoption across its user base. And then,…

Source…