Posts Tagged: flaw
Security flaw in Florida tax website exposed filers’ sensitive data
Some Florida residents may be keeping a close eye on their finances after a security incident. Researcher Kamran Mohsin tellsTechCrunch that Florida’s Department of Revenue website had a flaw that exposed hundreds of filers’ bank account and Social Security numbers. Anyone who logged in to the state business tax registration site could see, modify and even delete personal data just by modifying the web address pointing to a taxpayer’s application number — you just needed to change the digits in the link.
There were over 713,000 applications in the Department’s pipeline at the time of the discovery, Mohsin said. Mohsin warned the Department about the flaw on October 27th.
Department representative Bethany Wester said in a statement that the government fixed the flaw within four days of the report, and that two unnamed firms have deemed the site secure. She added there was “no sign” attackers abused the flaw, but didn’t say how officials might have spotted any misuse. The agency contacted every affected taxpayers by phone or writing within four days of learning about the issue, and has offered a year of free credit monitoring.
Bugs like these, known as insecure direct object references, are relatively easy to fix. The damage might also be limited compared to other tax-related breaches, such as a Healthcare.gov intrusion that compromised about 75,000 people in 2018. However, the incident underscores the potential harm from weak security — even a small-scale exposure like this could be used to commit tax fraud and steal refunds.
Google needs to fix this fatal flaw before I consider a Pixel 7
The Google Pixel 7 is shaping up to be a great phone. But only if Tensor 2 addresses a major issue.
Android | Digital Trends
Millions of WordPress sites receive forced patch for critical plugin flaw
Millions of WordPress sites have received a forced patch over the past few days, Ars Technica has reported. The reason is a vulnerability in UpdraftPlus, a popular plugin that allows users to create and restore website backups. UpdraftPlus developers requested the mandatory patch, as the vulnerability would allow anyone with an account to download a website's entire database.
The bug was discovered by Jetpack security researcher Marc Montpas during a security audit of the plugin. "This bug is pretty easy to exploit, with some very bad outcomes if it does get exploited," he told Ars Technica. "It made it possible for low-privilege users to download a site's backups, which include raw database backups."
He told UpdraftPlus developers about the bug on Tuesday last week, they fixed it a day later and started force-installing the patch shortly after that. 1.7 million sites had received it as of Thursday, out of 3 million-plus users.
The main flaw was that UpdraftPlus didn't correctly implement WordPress's "hearbeat' function by properly checking to see if users had administrative privileges. Another issue was a variable used to validate admins that could be modified by untrusted users. Jetpack provided more details about how a hack could work in a blog post.
WordPress was previously breached earlier this year, but it was done indirectly via a GoDaddy hack that exposed 1.2 million accounts. If you're running WordPress with the UpdraftPlus plugin, you should definitely confirm that the plugin updated automatically to 1.22.4 or later on the free version, or 2.22.4 and up on the premium app.
Grindr flaw allowed hijacking accounts with just an email address
A Grindr vulnerability allowed anyone who knows a user’s email address to easily reset their password and hijack their account. All a bad actor needed to do was type in a user’s email address in the password reset page and then pop open the dev tools…
Engadget RSS Feed
‘Sign in with Apple’ flaw let attackers take over accounts
‘Sign in with Apple’ is potentially more private than other login options, but it apparently included a serious security flaw. Researcher Bhavuk Jain recently received a $ 100,000 bug bounty for discovering (via Hacker News) a flaw in the sign-in serv…
Engadget RSS Feed
Samsung explains the massive fingerprint security flaw in the Galaxy S10/Note 10
Samsung has been in hot water lately over some pretty shoddy fingerprint scanning on the Galaxy S10 and Galaxy Note 10. Apparently there’s a pretty easy way to get into someone’s secured phone, regardless of whose fingerprint you use. That’s, uh, pretty bad, no matter how you look at it. The good news is that […]
Come comment on this article: Samsung explains the massive fingerprint security flaw in the Galaxy S10/Note 10
Boeing may use two computers to fix 737 Max’s latest flaw
Engadget RSS Feed
First American security flaw leaked 885 million real estate documents
Engadget RSS Feed
Internet Explorer security flaw allows hackers to steal files
Engadget RSS Feed
Google discloses ‘high severity’ Mac security flaw ahead of patch
Engadget RSS Feed
Samsung admits there’s a flaw with the Galaxy Note 8’s battery
Samsung’s Galaxy Note line is no stranger to battery problems, and unfortunately, the Galaxy Note 8 is still running into issues. Don’t get too alarmed, though, since these batteries are simply failing, not exploding. The long and short of the situation is that sometimes when a Galaxy Note 8 fully discharges its battery, it won’t […]
Come comment on this article: Samsung admits there’s a flaw with the Galaxy Note 8’s battery
New Android ‘Quadrooter’ flaw affects more than 900 million devices
A new Android vulnerability dubbed “Quadrooter” is perhaps the broadest ever. It affects more than 900 million devices containing widely distributed hardware by chipmaker Qualcomm.
The post New Android ‘Quadrooter’ flaw affects more than 900 million devices appeared first on Digital Trends.
Weekly Rewind: Stainless clothing, an Instagram flaw, the Stones vs. Trump
In the tech world, a lot happens in a week. So much news goes on, in fact, that it’s almost impossible for mere mortals with real lives to keep track of everything. That’s why we’ve compiled a quick and dirty list of the top 10 tech stories.
The post Weekly Rewind: Stainless clothing, an Instagram flaw, the Stones vs. Trump appeared first on Digital Trends.
Facebook pays 10-year-old $10,000 for finding Instagram security flaw
A 10-year-old from Finland recently found a security flaw on Instagram that allowed him to delete any comment on the site. His reward for reporting the flaw? A cool $ 10,000. Ironically, the youngster isn’t old enough to have an Instagram account.
The post Facebook pays 10-year-old $ 10,000 for finding Instagram security flaw appeared first on Digital Trends.
A two-year-old security flaw could give hijackers root access to your Android phone
A security flaw discovered two years ago in the Linus kernel could give hackers root access to Android devices. Google already issued a patch, but it’s unknown when most of the device will receive the update.
The post A two-year-old security flaw could give hijackers root access to your Android phone appeared first on Digital Trends.