Questions tagged [breach]
The breach tag has no usage guidance.
51
questions
105
votes
7
answers
146k
views
Is it safe to give my email address to a service like haveibeenpwned in light of the publication of "Collection #1"?
There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.
...
- 931
74
votes
5
answers
27k
views
How can I be pwned if I'm not registered on the compromised site?
I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on).
I have no memory of signing up for that service.
When I go to recover ...
- 1,925
48
votes
10
answers
20k
views
Global variables and information security
I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
user123574
11
votes
1
answer
899
views
Why are water treatment facilities or similar connected to the internet? [closed]
I have a (sensitive) background in security, in short, I believe that the infrastructures MUST NOT connect to the internet. If you connect to the internet, it is a matter of time before it is breached....
- 5,569
11
votes
1
answer
610
views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
- 379
9
votes
3
answers
56k
views
I woke up and my email has been signed up to hundreds of online services. How can I fix this?
I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
9
votes
3
answers
1k
views
Is there a benefit to using a different email for every online account?
I have a domain email address which in addition to being able to create multiple mail accounts allows the creation of aliases for each inbox.
Is there any benefit to security in using a different ...
- 91
8
votes
2
answers
12k
views
Why is breach-detection site "Have I Been Pwned" considered safe?
Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe?
Wouldn't the data of you, ...
8
votes
2
answers
2k
views
Does cloudflare protect against BREACH attacks?
I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good.
Then we implemented ...
- 1,462
8
votes
2
answers
2k
views
GMail Hack with 2-Factor Auth enabled
I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
- 81
5
votes
2
answers
4k
views
How are websites actually mititating BREACH? (HTTPS + compression)
After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
- 15.9k
4
votes
2
answers
1k
views
Does TLS 1.3 mitigate the BREACH vulnerability?
Section 5.4 of the TLS 1.3 specification describes record padding.
One of the mitigations for BREACH is to add random padding.
Therefore, I'm wondering:
Does TLS 1.3 require random record padding? I'...
- 141
4
votes
1
answer
183
views
Repercussions on Google account used to access a compromised service
Suppose the following scenario:
A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed.
The attacker has sufficient ...
- 475
3
votes
2
answers
868
views
Does replacing the SIM card mitigate any threats after a serious data breach?
I recently heard that a telephone company (a mobile network operator) was hacked and lots of data was stolen, maybe affecting up to a million customers. It sounds like the leaked data is already ...
- 15.9k
3
votes
4
answers
1k
views
How to investigate an IP address that was involved a security breach?
I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach?
The specific situation is this - recently two of our servers were hacked into ...
- 8,185
3
votes
0
answers
141
views
Any data on how many users change passwords after a breach notifcation?
Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
- 708
2
votes
4
answers
1k
views
HTTPs compression, CSRF and mobile apps
I have a backend for a mobile application that has to serve large JSON responses from time to time, the transfer would be greatly helped by enabling compression, especially when the user has bad ...
- 123
2
votes
3
answers
1k
views
Effective ways to hash phone numbers?
Suppose a company wants to implement 2FA for it's users using phone number OTP system, but does not really want to store their phone numbers as it could get breached and phone numbers are considered ...
2
votes
1
answer
824
views
How to check if a user's password has appeared in a breach?
The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden.
What are some relatively straightforward steps that a ...
- 34.6k
2
votes
3
answers
621
views
What is the difference between a data leak and a data breach?
What is the difference between data leak and data breach? Could you give an example of what the insider threat would be for a data leak and a data breach?
Reading the section "Who Causes Data ...
- 141
2
votes
1
answer
225
views
Receiving Junk Email that is related to Skype conversations
My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft).
This account is not linked to my phone (Android).
I don't use this account for Email (...
- 215
1
vote
3
answers
389
views
Why are data breaches like the one at Quora considered so bad?
Today, I read this article that said that some hacker stole personal information of 100 million users of Quora — which allegedly is half of the total user base of Quora. This is kind of like when ...
- 193
1
vote
1
answer
290
views
We were hacked and have no idea how [closed]
Last Friday, 7 of our employees' office365 email accounts were hacked simultaneously. We saw successful logins from random US addresses. The virus went through emails and basically does a reply-all ...
- 11
1
vote
1
answer
410
views
Data breach for my router in chrome
I have just logged into my router in Chrome, Win 10.
I got this warning.
I immediately changed the password.
But I have several questions.
Is the message reliable, in the sense that the breach ...
1
vote
1
answer
4k
views
Got "Security alert" e-mail from Google about a sign-in from an unknown device I'd like to track down [closed]
How can I investigate a potential security breach on my Google account that was perpetrated via an unknown device that I do not own?
I just got a horrifying e-mail from Google that seemed to indicate ...
1
vote
1
answer
142
views
Are there services to detect data breaches?
There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them?
What about small data ...
- 3,942
1
vote
1
answer
146
views
Are there any known examples of companies who were successfully breached using POODLE, BEAST or SWEET32?
When this was first announced back in 2014, Brian Krebs reported on how much of a threat these kinds of birthday attacks were, but I have not been able to find a case study of a successful breach.
Is ...
- 11
1
vote
2
answers
3k
views
GDPR - Personal Data breaches for invoices
A short question and scenario.
Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...
- 11
1
vote
0
answers
178
views
What can somebody do with just name and passport number?
What is the risk if just full name and passport number were to be leaked? just those two pieces of information and nothing else.
- 11
1
vote
0
answers
165
views
WhatsApp spyware application through WhatsApp call [duplicate]
Probably everyone heard that there was high security vulnerability in WhatsApp this week
https://www.forbes.com/sites/zakdoffman/2019/05/14/whatsapps-cybersecurity-breach-phones-hit-with-israeli-...
0
votes
4
answers
268
views
Why can't you use the same password for every site, if they are hashed on the site?
I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
0
votes
3
answers
237
views
How are data breach lists sourced and distributed?
I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was ...
- 756
0
votes
2
answers
220
views
A website had a breach and isn't telling customers. What can I do?
A website recently had a bug where users could effortlessly inadvertently access and operate other users accounts - payment information and all.
This website has an official community forum where ...
0
votes
1
answer
143
views
CRIME like attack and locality of randomized data
I am not an information security expert (just a developer) and recently discovered this kind of vulnerability, and have a few questions (so sorry if I misinterpreted something about how the attack ...
- 103
0
votes
1
answer
161
views
How Were FireEye's Tools Exfiltrated?
What was the mechanism for exfiltrating FireEye's redhat tools in the recent SolarWinds hack? I understand it was via HTTP (small packets to many servers)? Are there any further details?
Is this a ...
- 173
0
votes
1
answer
144
views
Phishing emails and securing set up from compromise?
I'm a one-man company and I'm getting a lot of phishing emails very similar to the emails from companies I use.
Some of these companies and the emails we exchange are very unique. How would these ...
- 131
0
votes
1
answer
2k
views
My personal info was leaked on the dark web through my Gmail Account; is it still safe to continue using said Gmail Account?
I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram.
Google conducted a dark web scan and created a report of instances ...
- 1
0
votes
1
answer
235
views
CRIME and BREACH attacks, HTTP/2 and HTTP/3
I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them.
From what I understood, those attacks require TLS encryption over HTTP compression and HTTP ...
- 101
0
votes
1
answer
355
views
How to secure Laravel website against the ongoing massive exploitation
My website built upon Laravel is currently under attack.
Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
0
votes
1
answer
148
views
Database of breached websites
I run a website with a user database. I have an account with my email and I put it on a website like Have I Been Pwned, which does not reveal a breach. I also check the website's list of breaches to ...
- 113
0
votes
1
answer
123
views
How to monitor your user accounts for breached logins?
On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password.
This has ...
- 101
0
votes
1
answer
151
views
How do maintainers calculate x number of accounts compromised by hack? [closed]
I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
- 101
0
votes
0
answers
458
views
How to find out which data breach my password was in?
HIBP and my password manager both claim that a password that I am using has been seen in a data leak.
Neither of them provide information about which data leak exactly my password was seen in.
The ...
- 101
0
votes
0
answers
314
views
Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?
I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
- 101
0
votes
0
answers
232
views
Historical examples of breached TOTP secrets?
While reading about password breaches, it occurred to me; where are the TOTP shared secret breaches? Because TOTP relies on a shared secret (unlike say U2F) the server has a copy of the shared secret, ...
- 141
0
votes
0
answers
202
views
Has this PC been hacked? What's going on?
I'm reasonably technically competent, but I don't know how to interpret this PC issue. As its a real-world incident, there's some back-story.
I'm in the UK. The suspect PC runs Win8.1 up to date, ...
- 1,694
0
votes
1
answer
150
views
Database breach protection [duplicate]
I'm developing an API which requires an API key to use. These keys are assigned to users. To figure out which user the key belongs to, I have to store some information in that key. But I don't want it ...
0
votes
0
answers
152
views
What authentication systems have been involved in data breaches?
Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
- 51
0
votes
1
answer
646
views
Why would I 'have been pwned' on a website that I never had an account on? [duplicate]
I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
0
votes
0
answers
126
views
Network Breach - Possibility
Hypothetically, if someone had unauthorized access to my network, there are a lot of things that can happen, depending on the point of attack and how it accessed, I can assume that anything that is ...
- 125