Questions tagged [breach]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
114 views

How to check if a user's password has appeared in a breach?

The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden. What are some relatively straightforward steps that a ...
4
votes
2answers
157 views

How are websites actually mititating BREACH? (HTTPS + compression)

After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
3
votes
0answers
63 views

Any data on how many users change passwords after a breach notifcation?

Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
8
votes
2answers
1k views

GMail Hack with 2-Factor Auth enabled

I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
7
votes
2answers
232 views

Does cloudflare protect against BREACH attacks?

I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good. Then we implemented ...
0
votes
0answers
83 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
47
votes
10answers
16k views

Global variables and information security

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
0
votes
1answer
287 views

Why would I 'have been pwned' on a website that I never had an account on? [duplicate]

I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
0
votes
1answer
70 views

Phishing emails and securing set up from compromise?

I'm a one-man company and I'm getting a lot of phishing emails very similar to the emails from companies I use. Some of these companies and the emails we exchange are very unique. How would these ...
2
votes
4answers
251 views

How to investigate an IP address that was involved a security breach?

I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach? The specific situation is this - recently two of our servers were hacked into ...
4
votes
1answer
113 views

Repercussions on Google account used to access a compromised service

Suppose the following scenario: A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed. The attacker has sufficient ...
1
vote
0answers
29 views

WhatsApp spyware application through WhatsApp call [duplicate]

Probably everyone heard that there was high security vulnerability in WhatsApp this week https://www.forbes.com/sites/zakdoffman/2019/05/14/whatsapps-cybersecurity-breach-phones-hit-with-israeli-...
0
votes
0answers
57 views

Network Breach - Possibility

Hypothetically, if someone had unauthorized access to my network, there are a lot of things that can happen, depending on the point of attack and how it accessed, I can assume that anything that is ...
-1
votes
2answers
106 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
1
vote
1answer
61 views

Are there any known examples of companies who were successfully breached using POODLE, BEAST or SWEET32?

When this was first announced back in 2014, Brian Krebs reported on how much of a threat these kinds of birthday attacks were, but I have not been able to find a case study of a successful breach. Is ...
2
votes
1answer
98 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
75
votes
5answers
23k views

How can I be pwned if I'm not registered on the compromised site?

I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on). I have no memory of signing up for that service. When I go to recover ...
0
votes
2answers
127 views

A website had a breach and isn't telling customers. What can I do?

A website recently had a bug where users could effortlessly inadvertently access and operate other users accounts - payment information and all. This website has an official community forum where ...
7
votes
2answers
3k views

Why is breach-detection site “Have I Been Pwned” considered safe?

Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe? Wouldn't the data of you, ...
100
votes
6answers
40k views

Is it safe to give my email address to a service like haveibeenpwned in light of the publication of “Collection #1”?

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned. ...
1
vote
3answers
265 views

Why are data breaches like the one at Quora considered so bad?

Today, I read this article that said that some hacker stole personal information of 100 million users of Quora — which allegedly is half of the total user base of Quora. This is kind of like when ...
0
votes
2answers
519 views

GDPR - Personal Data breaches for invoices

A short question and scenario. Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...