28 ms·
Is someone compiling a list of these? I'd love a spot to review everything, especially summarizing key "trends" and common attack vectors.
by yRetsyM 8y ago
Is someone compiling a list of these? I'd love a spot to review everything, especially summarizing key "trends" and common attack vectors.
- fowl2 8y agowell there's https://haveibeenpwned.com/ https://haveibeenpwned.com/, but that only covers if the breach has also been leaked
- snowwolf 8y agoSome of the recent attack vectors I can remember: * An employee account was compromised - usually because they re-use their password and that password was exposed in an unrelated breach. And then failure to require 2 factor authentication for 'internal' accounts - (github organisations, aws, internal administration tools, etc.) - Timehop, Gentoo * Failure to patch known vulnerabilities - Experian * Running untrusted code client side (Webchat) - Ticketmaster (although unclear what the vulnerability was that allowed the compromised scripts to be uploaded to Inbenta) * Unsecured database backups - Typeform (although it's unclear yet what the original compromise entailed) * Data left 'accidentally' exposed publicly (no credentials required to access it) - Exactis