#Cybersecurity breaches

[tntra]

Cybersecurity breaches cost businesses monetary loss and mental stress. Learn data breach prevention tips and save your business from becoming another target.

Read more: https://www.tntra.io/blog/data-breach-prevention/

[destielmemenews]

"In their statement on Friday, NPD warned that the “the information that was suspected of being breached contained name, email address, phone number, social security number, and mailing address(es).” It recommended the public to take a number of steps to safeguard their identities, including freezing their credit and putting fraud alerts on their files at big credit bureaus.

The breach came to public awareness after a class-action lawsuit was filed August 1 in U.S. District Court in Florida, which was first reported by Bloomberg Law.

National Public Data did not share how many people were at risk, but hackers, who have been identified as part of the hacking group USDoD, have been offering, for sale, what they claimed were billions of NPD records since April, though the Washington Post reported that “security researchers who looked at the trove said some of the claims were exaggerated.”"

source 1

source 2

source 3

free database created by Pentester to see if your information has been leaked

[allthecanadianpolitics]

One of western Canada’s largest rental property companies is warning tenants about a cyber security breach it says was discovered earlier this year. In a letter to tenants on Aug. 19, also published on its website, Mainstreet Equity Corporation says on it discovered a third party had gained access to a portion of its IT infrastructure on May 21. “Upon discovering this, we immediately undertook countermeasures to prevent any further unauthorized activity,” the company said.

Continue Reading

Tagging: @newsfromstolenland

[nando161mando]

sorry for the ping, but since most of us deal with zip files here, I thought this was important.

PSA: If you use 7-zip, please check which version you are using.

24.07 and earlier are no longer secure and have a serious vulnerability so be sure to update to 24.08 (released 11-Aug-2024) if you have not updated or downloaded it recently.

Note that 7-zip does not auto-update, and should never be downloaded from anywhere except for from the Developers own website: https://7-zip.org/

https://cybersecuritynews.com/7-zip-vulnerability-arbitrary-code/,

[cytrusst]

ago

🔒 In today’s digital world, choosing the Best cybersecurity Company is essential – and that’s why businesses choose Cytrusst. ✅ Safeguard Your Most Critical Systems and Assets Protect what matters most with robust security designed to defend your essential systems and sensitive data. 🚀 Secure Digital Transformation with Our Unique Defensive Approach Accelerate your digital growth without compromising security. Our innovative defense strategies keep you secure every step of the way. 🔍 Compliance & Hacker Mindset We don’t just follow compliance standards; we think like hackers to stay one step ahead, identifying and mitigating vulnerabilities before they’re exploited. 🔒 Endless Solutions on a Single Platform From detection to prevention, access all the tools and resources you need in one seamless platform. 📊 Risk-Based Approach & Dedicated Client Focus We prioritize your unique risks with a tailored approach and a team dedicated to your security. With Cytrusst, you’re not just getting a provider; you’re gaining a proactive, reliable partner focused on keeping your business safe. Don’t settle for less regarding your security – choose the best. Stay One Step Ahead With Cytrusst - The Best Cybersecurity Company To Safeguard Your Digital Assets And Secure Your Future.

[pentesttestingcorp]

SQL Injection in RESTful APIs: Identify and Prevent Vulnerabilities

SQL Injection (SQLi) in RESTful APIs: What You Need to Know

RESTful APIs are crucial for modern applications, enabling seamless communication between systems. However, this convenience comes with risks, one of the most common being SQL Injection (SQLi). In this blog, we’ll explore what SQLi is, its impact on APIs, and how to prevent it, complete with a practical coding example to bolster your understanding.

What Is SQL Injection?

SQL Injection is a cyberattack where an attacker injects malicious SQL statements into input fields, exploiting vulnerabilities in an application's database query execution. When it comes to RESTful APIs, SQLi typically targets endpoints that interact with databases.

How Does SQL Injection Affect RESTful APIs?

RESTful APIs are often exposed to public networks, making them prime targets. Attackers exploit insecure endpoints to:

Access or manipulate sensitive data.

Delete or corrupt databases.

Bypass authentication mechanisms.

Example of a Vulnerable API Endpoint

Consider an API endpoint for retrieving user details based on their ID:

from flask import Flask, request import sqlite3

app = Flask(name)

@app.route('/user', methods=['GET']) def get_user(): user_id = request.args.get('id') conn = sqlite3.connect('database.db') cursor = conn.cursor() query = f"SELECT * FROM users WHERE id = {user_id}" # Vulnerable to SQLi cursor.execute(query) result = cursor.fetchone() return {'user': result}, 200

if name == 'main': app.run(debug=True)

Here, the endpoint directly embeds user input (user_id) into the SQL query without validation, making it vulnerable to SQL Injection.

Secure API Endpoint Against SQLi

To prevent SQLi, always use parameterized queries:

@app.route('/user', methods=['GET']) def get_user(): user_id = request.args.get('id') conn = sqlite3.connect('database.db') cursor = conn.cursor() query = "SELECT * FROM users WHERE id = ?" cursor.execute(query, (user_id,)) result = cursor.fetchone() return {'user': result}, 200

In this approach, the user input is sanitized, eliminating the risk of malicious SQL execution.

How Our Free Tool Can Help

Our free Website Security Checker your web application for vulnerabilities, including SQL Injection risks. Below is a screenshot of the tool's homepage:

Upload your website details to receive a comprehensive vulnerability assessment report, as shown below:

These tools help identify potential weaknesses in your APIs and provide actionable insights to secure your system.

Preventing SQLi in RESTful APIs

Here are some tips to secure your APIs:

Use Prepared Statements: Always parameterize your queries.

Implement Input Validation: Sanitize and validate user input.

Regularly Test Your APIs: Use tools like ours to detect vulnerabilities.

Least Privilege Principle: Restrict database permissions to minimize potential damage.

Final Thoughts

SQL Injection is a pervasive threat, especially in RESTful APIs. By understanding the vulnerabilities and implementing best practices, you can significantly reduce the risks. Leverage tools like our free Website Security Checker to stay ahead of potential threats and secure your systems effectively.

Explore our tool now for a quick Website Security Check.

[mrsecurityalert]

[la-principessa-nuova]

Passkeys being supported so many places lately are the best thing to happen to authentication in the last 20 years.

If you have a good password manager and save passkeys to it, it’s finally as convenient to sign in as it was back when nothing had multifactor and you just typed your one memorized password into everything.

[century-solutions-group]

What is Zero Trust Architecture?

Zero Trust Architecture (ZTA) is a security model that operates on the principle "never trust, always verify." Unlike traditional security models that assume everything within a network is trustworthy, ZTA requires verification for every access request, regardless of whether it originates inside or outside the network.  

Why is it Important?  

In today's digital landscape, cyber threats are becoming increasingly sophisticated. Zero Trust Architecture helps mitigate risks by continuously verifying every user and device, ensuring that only authorized entities can access sensitive information.  

How Does It Protect You?  

1. Enhanced Security: By requiring strict verification, ZTA minimizes the risk of unauthorized access and data breaches.  

2. Reduced Attack Surface: Limiting access to only what is necessary decreases potential entry points for attackers.  

3. Real-time Monitoring: Continuous monitoring and verification help detect and respond to threats promptly.  

Adopt Zero Trust Architecture with Century Solutions Group to fortify your cybersecurity defenses and protect your business from evolving cyber threats! #ZeroTrust #CyberSecurity #CenturySolutionsGroup 

Learn More:https://centurygroup.net/cloud-computing/cyber-security/

[bunabyte]

According to my phone, the password I've used for hundreds of accounts across many websites, since the day I was born, has been leaked in a data breach. If my parents find out, I will probably never be allowed touch anything with an internet connection ever again (this is hardly even an exaggeration). I may be stupid...

[photo-roulette-wheel]

I know I don't usually talk about this sort of stuff especially since I am an account that posts random photos

However I regret to inform you that the mushroom bot has a deta beech and your data may be compromised

[waspsinyouryard]

I swear to god, every time I go on tumblr, you have reblogged a post that I JUST saw on Pinterest, what are you hiding, what are your secrets.

I installed malware on your computer and phone that monitors your activity on Pinterest and instantly reblogs anything that you see that is also on Tumblr

But probably what it is is that the people I follow tend to reblog already popular posts, and popular posts are a lot more likely to be reposted to other parts of the internet

[nando161mando]

Massive data breach, please check your email accounts and update your security details!

[sgrji]

A Comprehensive Guide to Background Verification (BGV) in Today's World

In our increasingly interconnected and digitized world, the importance of ensuring the trustworthiness and credibility of individuals and entities has never been greater. Background Verification (BGV) plays a pivotal role in this process. From employment screenings to tenant checks, and even in the realm of cybersecurity, BGV is a critical tool used to evaluate the history and reliability of…

[cybergeeksposts]

SIM Swap Saga: A Deep Dive into the Latest Cybersecurity Incident

On August 19, 2023, Kroll, a risk and financial advisory solutions provider, reported that an employee had fallen victim to a highly sophisticated SIM-swapping attack, targeting their T-Mobile account. T-Mobile transferred the employee's phone number to the attacker's phone without Kroll's knowledge or consent. This granted the threat actor access to files containing the personal information of bankruptcy claimants linked to BlockFi, FTX, and Genesis. SIM swapping, though often harmless, was exploited by the attacker to gain control of the victim's phone number, intercept SMS messages, and access MFA-related data for online accounts. Kroll secured the impacted accounts and informed those affected. No evidence of further breaches has been found, but investigations are ongoing.

The incident highlights the importance of safeguarding personal information and the vulnerabilities tied to relying solely on SMS-based multi-factor authentication (MFA). It underscores the need for individuals and organizations to adopt stronger authentication methods, raise awareness about social engineering threats, and prompt cellular carriers to enhance their customer identity verification processes to prevent such attacks. Kroll's prompt response, securing affected accounts, and initiating notifications demonstrate the significance of immediate action in mitigating potential data breaches.

[lyxthen]

Hey! Gentle reminder to change your passwords if you haven't done so in a while. Be safe :)