Exactis Data Leaked – 340 Million Records Exposed Online

                                   
While the chaos for the infamous Equifax data breach hasn’t ended, here we have another news story about another massive breach. This time, the marketing company ‘Exactis’ unwittingly exposed customers’ data. A researcher found approx. 340 million records from the Exactis data leaked online. Presently, we are not sure whether any hacker(s) had a hand in causing the leak.

Exactis Data Leaked Details Of 340 Million Americans
As disclosed by Wired on Wednesday, marketing firm Exactis exposed a huge chunk of records from its database online. Reportedly, approximately 340 million records from Exactis was leaked on publicly accessible servers. Security researcher, Vinny Troia, discovered the data containing personal information of the users.

According to Vinny Troia, the data included the details of about 230 million American individual users. Whereas, the remaining 110 million records were business data. It is yet unknown how long the data has been available on that public server. The leaked details include names, contact addresses, contact numbers, email addresses, and other personally identifiable information. However, it luckily has no financial details.

Vinny Troia is an independent security researcher and the owner of his cybersecurity firm ‘Night Lion Security’. While talking about the incident to Wired, he said,

“It seems like this is a database with pretty much every US citizen in it. I don’t know where the data is coming from, but it is one of the most comprehensive collections I have ever seen.”

Though it’s yet unknown if the data is in the hands of hackers, Troia says that finding this data online is way easier than one might expect. He himself stumbled upon this chunk as he was scraping ElasticSearch using  ‘Shodan’. According to him, anybody using such scanning software can easily trace such databases.

Exactis Preferred To Stay Quiet
After discovering the data, Vinny Troia informed Exactis and FBI about his discovery. Since then, Exactis has most probably protected the data as it’s no more accessible. However, the firm has given no official statements about the incident.

Yet, several other security analysts have expressed their thoughts regarding the matter.

“The sheer amount of cloud databases left accessible on the internet is astounding, especially when one considers the type and amount of data that users store on it without giving it a second thought,”

says John Robinson, security strategist at Cofense Inc.

Likewise, Marc Rotenberg, Executive Director at the EPIC comments,

“The likelihood of financial fraud is not that great, but the possibility of impersonation or profiling is certainly there.”

As we haven’t heard anything from Exactis regarding the incident, it is yet unknown how did such a large piece of data was leaked publicly, whether it was accidentally placed there by Exactis, or was the result of a hack. Likewise, we aren’t sure if more of such data is available on any other servers. Yet, from what we know by now, the incident appears somewhat similar to the MyHeritage data breach that exposed 92 million records on external servers.

Read More

Ticketmaster Data Breach – Customer’s Payment Details May Have Been Leaked

Another hacking incident has put the masses at risk. The recent Ticketmaster data breach affected almost 5% of all its users. The ticketing service confirmed that the breached data might include customer’s payment details as well. (Once again, people lost their sensitive financial information to hackers in a data breach)

Ticketmaster Data Breach Sourced From A Chat Widget

As disclosed by the company on June 23, around 5% of all Ticketmaster UK users were affected in a cyber attack. The hackers may have accessed user data, including payment information. The affectees predominantly include people from the UK.

“UK customers who purchased, or attempted to purchase, tickets between February and June 23, 2018, may be affected as well as international customers who purchased, or attempted to purchase, tickets between September 2017 and June 23, 2018,” state Ticketmaster in their official notice. “Less than 5% of our global customer base has been affected by this incident. Customers in North America have not been affected.”

Reportedly, the hackers exploited their chat widget powered by Inbenta Technologies. After detecting the presence of malware on this third-party product, Ticketmaster disabled Inbenta chat for all its websites. However, they suspect that the unknown hackers may have extracted important customer details by then.

“As a result of Inbenta’s product running on Ticketmaster International websites, some of our customers’ personal or payment information may have been accessed by an unknown third-party. Information which may have been compromised includes name, address, email address, telephone number, payment details and Ticketmaster login details.”

Ticketmaster UK Has Taken Appropriate Security Measures

Ticketmaster informed their customers about the incident via email. They have asked them to update their login credentials and monitor their bank account statuses. They have also sent out emails to affected customers. Those who have not received such emails supposedly remain unaffected by the breach.

They have also began a forensic investigation to get to the bottom of the matter:

“Forensic teams and security experts are working around the clock to understand how the data was compromised. We are working with relevant authorities, as well as credit card companies and banks.”

Yet, they urge their customers to remain careful about their security.

“We recommend that you monitor your account statements for evidence of fraud or identity theft. If you are concerned or notice any suspicious activity on your account, you should contact your bank(s) and any credit card companies.”

As compensation, they are also offering a one-year identity monitoring service to affectees with a leading service provider. The victims of this Ticketmaster data breach living in UK, Australia, New Zealand, France, Germany, Spain, and Ireland can apply for this service by filling out an online form

Read More

더 이상 로그인 할 수 없을 때 내 Facebook 계정을 복구하는 방법

더 이상 로그인 할 수 없을 때 내 Facebook 계정을 복구하는 방법
더 이상 로그인 할 수 없을 때 내 Facebook 계정을 복구하는 방법

비밀번호를 잊어 버렸기 때문에 더 이상 로그인 할 수 없습니까? 또는 귀하의 계정이 해킹 당했습니까?

당신은 혼자가 아닙니다! 수백 명의 사람들이 매일 비슷한 질문을 던져 우리를 찾습니다. 다행히도 Facebook은 귀하의 계정을 되 찾을 수있는 몇 가지 자동화 된 방법을 제공합니다. 해커가 암호를 변경했기 때문에 암호를 잊어 버렸거나 더 이상 로그인 할 수없는 경우 몇 가지 옵션이 있습니다. 단계별로 Facebook 계정을 복구하는 방법을 알려 드리겠습니다.

참고 :이 기사에서는 Facebook 계정 복구에 대해 알고있는 모든 내용을 다룹니다. 이 기사를 읽고 의견을 읽고 질문이 있으면 자신의 의견을 남기고 최선을 다하겠습니다. 내가 아는 것도, 도와 줄 수있는 것도 없습니다.

1. 당신은 아직도 어딘가에 로그인되어 있습니까?
계정을 복구하기 전에 어느 기기에서나 Facebook에 아직 로그인되어 있는지 확인하십시오. 이 정보는 컴퓨터의 다른 브라우저 또는 브라우저 프로필, Facebook Android 또는 iOS 앱 또는 태블릿과 같은 모바일 브라우저 일 수 있습니다.

어디서나 Facebook에 액세스 할 수 있다면 Facebook 계정이 해킹 당했을 때 수행 할 작업에 대한 기사의 1a 단계로 진행하십시오.

참고 : 이중 인증을 설정하고 코드 생성기에 액세스 할 수없는 경우 계정을 복구하는 방법은 다음과 같습니다.

2. 기본 계정 복구 옵션을 사용해 보셨습니까?
좋아, 그럼에도 페이스 북에 로그인 한 기기를 찾지 못했습니다. 그때 복구를 진행합시다. 가능한 경우 이전에 Facebook 계정에 로그인 한 네트워크 또는 컴퓨터를 사용하십시오.

먼저, 귀하의 계정을 식별해야합니다. Facebook 복구 페이지로 이동하여 이전에 Facebook 계정에 추가 한 이메일 주소 또는 전화 번호를 사용하십시오. 그렇게 말하지는 않지만, Facebook 사용자 이름을 사용할 수도 있습니다.

더 이상 로그인 할 수 없을 때 Facebook 계정을 복구하는 방법 Facebook 계정 찾기

계정을 성공적으로 관리하면 프로필 요약이 표시됩니다. 계속 진행하기 전에 이것이 정말로 귀하의 계정인지 여부와 나열된 이메일 주소 또는 휴대 전화 번호에 대한 액세스 권한이 있는지 여부를주의 깊게 확인하십시오.

페이스 북에서 더 이상 로그인 할 수 없을 때 Facebook 계정을 복구하는 방법

너는 더 이상 이것들에 접근 할 수 없어야합니까? 이 기사의 3 번 지점으로 진행하십시오.

그러나 Facebook에있는 연락처 정보가 모두 잘 나타난다면 계속을 클릭하십시오. Facebook에서 보안 코드를 보내드립니다. 그것을 가져 와서 그것을 입력하고, 계정을 복구 한 것을 기뻐하십시오.

더 이상 Facebook 보안 코드 1에 로그인 할 수 없을 때 Facebook 계정을 복구하는 방법

코드가 도착하지 않으면 코드를받지 못 했습니까?를 클릭하면 이전 암호 재설정 화면으로 돌아갑니다. 다시 시도하거나 어쩌면 계정에 액세스 할 수 없다는 것을 알게 될 것입니다.

귀하의 계정으로 돌아 가기
계정에 다시 액세스 할 수 있었고 계정이 해킹 당했다고 의심되는 경우 즉시 비밀번호를 변경하고 (강력한 비밀번호를 사용하십시오!) 연락처 정보를 업데이트하십시오. 이는 Facebook 계정을 보호하는 주요 단계입니다. 자신이 아니거나 더 이상 액세스 할 수없는 이메일 주소 나 전화 번호는 모두 삭제하십시오.

이중 인증을 사용하도록 권장하므로 다시는 발생하지 않습니다.

3. 연락처 정보가 변경 되었습니까?
위 옵션을 사용하여 계정을 복구 할 수없는 경우가 종종 있습니다. 프로필에 한 번 추가 한 이메일 주소 및 전화 번호에 더 이상 액세스 할 수없는 것일 수 있습니다. 또는 해커가이 정보를 변경했을 수도 있습니다. 이 경우 Facebook은 새로운 이메일 주소를 지정할 수 있습니다.이 이메일 주소는 귀하의 계정 복구에 관해 귀하에게 연락하는 데 사용됩니다.

이 프로세스를 시작하려면 더 이상 액세스 할 수없는 링크를 클릭하십시오. 왼쪽 하단의 비밀번호 재설정 페이지에서 복구 프로세스를 시작하십시오. 페이스 북은 새로운 이메일 주소 나 전화 번호를 물어볼 것입니다. 그래서 필요한 경우 연락을 취할 수 있습니다. 계속하려면 계속을 클릭하십시오.

Facebook Reach에 더 이상 로그인 할 수 없을 때 Facebook 계정을 복구하는 방법

신뢰할 수있는 연락처를 설정 한 경우 다음 단계에서이를 사용하여 계정을 복구 할 수 있습니다.

Facebook 신뢰할 수있는 연락처에서 더 이상 로그인 할 수 없을 때 Facebook 계정을 복구하는 방법

3 ~ 5 개의 신뢰할 수있는 연락처 중 하나 이상의 전체 이름을 기억해야합니다. 계정을 복구하는 데 3 개의 코드 만 있으면됩니다.

신뢰할 수있는 연락처를 설정하지 않은 경우 보안 질문 중 하나에 대답하고 그 자리에서 비밀번호를 재설정 할 수있는 옵션이 제공 될 수 있습니다. 추가 예방 조치로 계정에 액세스하려면 24 시간 대기해야합니다.

그렇지 않으면 Facebook이 사용자의 신원을 확인하기 위해 연락 할 때까지 기다려야합니다. 인내심을 가져라!

4. 계정 해킹 및 스팸 메일 발송 중입니까?
계정이 해킹되어 스팸을 게시하는 경우

Read More

Hacker Reveals How to Hack Any Facebook Account(secure your account)

Hacker Reveals How to Hack Any Facebook Account

Hacking Facebook account is one of the major queries of the Internet user today. It's hard to find — how to hack Facebook account, but an Indian hacker just did it.

A security researcher discovered a 'simple vulnerability' in the social network that allowed him to easily hack into any Facebook account, view message conversations, post anything, view payment card details and do whatever the real account holder can.

Facebook bounty hunter Anand Prakash from India recently discovered a Password Reset Vulnerability, a simple yet critical vulnerability that could have given an attacker endless opportunities to brute force a 6-digit code and reset any account's password.

Here's How the Flaw Works

The vulnerability actually resides in the way Facebook's beta domains handle 'Forgot Password' requests.

Prakash has also provided a proof-of-concept (POC) video demonstration that shows the attack in work. You can watch the video given below that will walk you through the entire procedure:

Here's the culprit:

As Prakash explained, the vulnerable POST request in the beta pages is:

lsd=AVoywo13&n=XXXXX

Brute forcing the 'n' successfully allowed Prakash to launch a brute force attack into any Facebook account by setting a new password, taking complete control of any account.

Prakash (@sehacure) discovered the vulnerability in February and reported it to Facebook on February 22. The social network fixed the issue the next day and had paid him $15,000 as a reward considering the severity and impact of the vulnerability.

Read More

Your Old Phone Number Can Be Used To Hack Facebook Account

We all know that in most cases,Facebook users are required to submit their phone number while registering with the social network. This is how they can link their phone with the profile so that when a user forgets the password, they can prove his authenticity and receive a new password on their smartphone.

However, in case the user stops using the phone number linked to their Facebook profile and changes it to another one, there are chances that the previous number can be assigned to someone else. This is where the problem begins.

According to the research conducted by a computer programmer James Martindale, Facebook accounts can be easily hacked using your old phone number. Because if the new owner of your previous number performs password reset while attempting to logging in to Facebook, it is very much possible to gain full control of your account.

The account recovery system of Facebook is to be blamed for this mishap. When a user forgets his/her password, it becomes the responsibility of Facebook’s account recovery system to help the user access the account by sending an SMS message on their phone number containing a unique code. This code allows the user to regain access to the account and set a new password. So, when your old number is acquired by someone else, using the unique code the new owner of your previous phone number can hijack the Facebook account. It does not require any social engineering skills to perform the hack.

Martindale himself tried this trick by buying a new SIM and was surprised to receive a message from Facebook as soon as he inserted the SIM into his phone. He shared his findings in a blog post on Medium, where he wrote:

“I was curious. I knew Facebook by default lets people find your account with your phone number, so I typed the number into the search bar and see what came up.”

To receive the password recovery option, he typed in a password and then received a code on his newly bought phone number to login to the account. As per the analysis of Martindale, this trick is fairly simple, but its consequences are quite drastic since hackers can use Facebook accounts for spreading various kinds of scams or may sell the accounts on the black market. They can also blackmail the original user for money in exchange of profile.

This also poses a threat to other contacts of the hacked account as every friend of the user can be threatened, specifically extorted for money. Another startling revelation made by Martindale was that FreedomPop VoIP carrier that he uses allows him to modify his phone number by showing him a list of available number for just $5. All you have to do is to try all the numbers to log in to Facebook and once a match is found the hacker can hijack a Facebook account, explained Martindale.

What’s even more troubling is that Facebook, despite considering it a real threat, did not include this issue in its bug bounty program. “Facebook doesn’t have control over telecom providers who reissue phone numbers or with users having a phone number linked to their Facebook account that is no longer registered to them” is the excuse provided by their website.

However, the trick can only work if your account is still linked to your old phone number. If you keep on updating your contact details, your account will remain protected. To keep your account safe, you need to remove any old phone number(s) and email IDs from your account and also use two-step login authorization feature.

Read More

New SamSam Ransomware Variant Requires Password from Hacker Before Execution

Researchers at Malwarebytes have found that a new variant to the SamSam ransomware has been hitting users wherein the attacker has to put in a password before the malware could be executed.

“In its time being active, SamSam has gone through a slight evolution, adding more features and alterations into the mix,” read the blog post by Malwarebytes Labs. “These changes do not necessarily make the ransomware more dangerous, but they are added to make it just a bit more tricky to detect or track as it is constantly changing.”

According to researchers, this variant does not go into effect without the password, even if the malware is already present in the system. This makes for a more “targeted” attack as the attackers can decide which computers to execute the ransomware on.

Aside from targeted attacks, it also means that only those who know the password can access the ransomware code or execute the attack, making it a tricky malware to understand.

“As analysts, without knowing the password, we cannot analyze the ransomware code. But what’s more important to note is that we can’t even execute the ransomware on a victim or test machine. This means that only the author (or someone who has intercepted the author’s password) can run this attack,” the blog post said on the issue.

“This is a major difference from the vast majority of ransomware, or even malware, out there,” the post went on to say. “SamSam is not the type of ransomware that spreads like wildfire. In fact, this ransomware quite literally cannot spread automatically and naturally.”

SamSam has been a part of several massive cyber attacks since early 2018 and has led to severe damages worldwide. This new variant has only made it more elusive, as the code is inaccessible even to security researchers, which might be another reason for the password requirement.

The ransomware has in the past targeted hospitals, state agencies, city councils, and other enterprises, and caused huge losses when it hit the IT network of Atlanta earlier this year.

Read More

Malware threat for Syscoin users

The hackers have no dearth of malwares to strike these days. A new malware, of late, has posed no less threat for the Syscoin developers and users alike forcing the cyber security experts to come out with a slew of care and caution to counter the threat.

The security experts who claimed to have detected the

Trojan:Win32/Feury.B!cl, said with the help of the malicious malware, the hackers, very recently got the details of the GitHub account of the Syscoin cryptocurrency. Then it was put in the replaced  official Windows client much to the major concern of the developers and users.

A detail study suggests a malware in the infected Syscoin Windows client which helps the hackers to steal passwords and wallet privacy forcing the velopers to keep the users on maximum alert. The security researchers have maintained that those who have downloaded the version from June 9 to June 13 this year, run the risk of the impending danger. The malware in question might infect the system at any moment.

The hackers have only targetted the Syscoin Windows client by tampering it and they are understood to have been trying to mint Syscoin cryptocurrency putting in place the  Syscoin clients which keeps running on an operating  system. The entire piece of system surfaced acting on the messages the Syscoin experts received from the users.

In a number of messages, the Syscoin team of experts got to know the disturbing facts that the Windows Defender SmartScreen which marked the download of the windows client was infected by a malware. Unless a slew of cautions and cares are maintained, the malware would leave millions of Syscoin users in high and dry.

An updated study by the Syscoin team suggests that the hackers managed to compromise a GitHub account belonging to the developers. Then the team was quick to keep aside the malware and prepared a slew of measures for the users to ensure that their devices and system are left untouched.

The team which deals in the revolutionary cryptocurrencies, has asked all users to ascertain the installation dates with right-click on syscoin-qt.exe in C:\Users[USERNAME]\AppData\Roaming\SyscoinCore. They, further, have the option  to flip through the list mode to modify the date in a note. Another option, the users can avail of: Starting from Settings->Apps and prepare the installation date in a note.

Those who installed or modified the mechanism from June 9 to June 13 this year, should have back up of the crucial data and wallets in a separate system before allowing an anti virus scanner to operate in the device. This, say the experts, the best possible way to keep the impending threat at bay.

The Syscoin users need to change the passwords entered from the moment the devices were left infected. The password needs to be changed from another device which would ensure safety of the system.

The Syscoin team, moreover, has asked the wallet holders to generate new wallets from another computing system if the wallets with funds  unencrypted remained unlocked in the infection period.  The Syscoin users who downloaded the client during this period in question need to delete these before downloading a uninfected version afresh.

Read More