Information Technology Security

By Bill Toulas,  Bleeping Computer The Ukrainian cyber police, in collaboration with investigators from the national police (ГУНП), have arrested three individuals who are accused of hijacking over 100 million emails and Instagram accounts worldwide. The three suspects, aged between 20 and 40, used specialized software to brute-force account passwords and then steal them. Brute force is the means of guessing account passwords through an automated trial-and-error process that has computers try many possible combinations until the correct one is found. This method's success relies on the available computational power in relation to the password length and complexity of the targeted account. The arrested cybercriminals monetized their illicit activities by selling access to compromised accounts to various fraud groups on the darknet. The buyers then used their access to these accounts to message the victims' contacts, requesting them to transfer money under false pretenses. The po...

By Rich DeMuro, Nexstar Media Wire Ever wonder how hackers get your password and gain access to your account? Recent research has identified several major ways: Password theft Password guessing Unauthorized password resetting or bypass “The biggest reason why people hate passwords is they’re all being told that they all need to be longer and longer and more complex,” started Roger Grimes, a Data-Driven Defense Evangelist at security awareness training company KnowBe4. He says phishing emails are a top way hackers get our passwords. You’ve seen them before — they say your Netflix account is about to be deactivated, your Facebook account has a copyright issue or something needs to be fixed with your Instagram. They trick us into handing over our information by making us log into a page that looks like the real thing but instantly sends our username and password to hackers, who immediately take over our accounts. Another way your password gets out into the wild: when a website is hack...

By Bill Toulas, Bleeping Computer Security researchers have revealed that hackers can hijack your online accounts before you even register them by exploiting flaws that have been already been fixed on popular websites, including Instagram, LinkedIn, Zoom, WordPress, and Dropbox. Andrew Paverd, a researcher at Microsoft Security Response Center, and Avinash Sudhodanan, an independent security researcher, analyzed 75 popular online services and found that at least 35 are vulnerable to account pre-hijacking attacks. These attacks vary in type and severity, but they all stem from poor security practices on the side of the websites themselves. As some vulnerable websites run bug bounty programs, it is surprising and worrying to see that such elementary attacks are still possible against their users.