#dataexposure — Public Fediverse posts

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

LAPD lets contract with surveillance giant Flock expire, citing ‘serious concerns’ over civil liberties and privacy

The Los Angeles Police Department (LAPD) is reportedly ending its deal with Flock Safety, a surveillance company that…
#NewsBeep #News #Headlines #cybersecurity #dataexposure #Flock #LAPD #Privacy #surveillance #UnitedStates #Us #USA
https://www.newsbeep.com/642022/

🟡 Cyber Incident | 7/10
🇺🇸

Data exposure at Peter Thiel-linked Dialog network
A misconfigured website exposed personal details and login tokens of 222 registrants, including a senior White House intelligence official and an active-duty Tier 1 intelligence officer. The Pentagon is investigating the breach.

#OSINT #NewsGroup #CyberIncident #DataExposure #Pentagon #US

✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.

Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.

Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure

✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.

Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.

Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure

CEO's File Share Mishap Exposes Workplace Security Lapses

Imagine being called in to help a CEO recover deleted files, only to discover a shocking secret: a treasure trove of explicit content stored on a company file share that's accessible to anyone. The awkward moment that followed will leave you cringing - and wondering how something so sensitive could be so carelessly exposed.

https://osintsights.com/ceos-file-share-mishap-exposes-workplace-security-lapses?utm_source=mastodon&utm_medium=social

#DataExposure #WorkplaceSecurity #FileShare #InsiderThreats #Ceo

Trump Mobile Website Exposed Thousands of User Records

A shocking security lapse has been uncovered on the Trump Mobile website, allegedly exposing thousands of users' sensitive information, according to a report by The Register. The breach claim, made by a techie, raises serious concerns about the website's data protection measures.

https://osintsights.com/trump-mobile-website-exposed-thousands-of-user-records?utm_source=mastodon&utm_medium=social

#DataExposure #TrumpMobile #EmergingThreats #UserDataLeak #WebsiteSecurity

UK Water Supplier Fined $1.3M for Data Exposure Lapse

A UK water supplier has been slapped with a $1.3 million fine after a devastating cyber attack exposed the personal data of nearly 664,000 customers and employees, with sensitive information even being published on the dark web. The hefty penalty was reduced by 40% after the company admitted liability and cooperated with investigators.

https://osintsights.com/uk-water-supplier-fined-13m-for-data-exposure-lapse?utm_source=mastodon&utm_medium=social

#DataExposure #Uk #WaterSector #EmergingThreats #InformationCommissionersOffice

Defense Contractor Exposes Military Training Data Through API Flaw

A defense contractor's careless API flaw left sensitive military training data vulnerable, sparking a 152-day saga between the contractor and the open-source security project Strix that ultimately led to the exposure being patched. The breach was caused by a low-privilege account having broad access to user records and…

https://osintsights.com/defense-contractor-exposes-military-training-data-through-api-flaw?utm_source=mastodon&utm_medium=social

#ApiSecurity #MilitaryTraining #DefenseContractor #DataExposure #EmergingThreats

Voter Data Exposes Personal Info to Potential Abuse

Your voter data is at risk of being exposed and used against you, with publicly available registration files potentially revealing sensitive information about you and your family. Even redacted files can be easily linked to other public datasets, making it simple for employers, fraud rings, or others to access your personal info.

https://osintsights.com/voter-data-exposes-personal-info-to-potential-abuse?utm_source=mastodon&utm_medium=social

#VoterDataSecurity #DataExposure #IdentityDisclosure #PublicRecords #Reidentification

AI Agents Fuel Cybersecurity Breaches at Most Firms

As AI agents increasingly power business operations, they're also fueling cybersecurity breaches at most firms, leading to data exposure, operational disruption, and financial losses. The rapid rise of AI is sparking a pressing dilemma: how can organizations balance innovation with control?

https://osintsights.com/ai-agents-fuel-cybersecurity-breaches-at-most-firms?utm_source=mastodon&utm_medium=social

#CloudSecurity #AiAgents #CybersecurityBreaches #DataExposure #OperationalDisruption

Incident summary:
Target: PayPal - Working Capital (PPWC) loan app
Root cause: Software code error
Exposure window: July 1- Dec 13, 2025
Discovery: Dec 12, 2025
Scope: ~100 users

Data exposed:
• SSN
• DOB
• Contact & business details

No core system compromise reported.
Unauthorized transactions observed in limited cases.

Credit monitoring via Equifax provided.
Key considerations:

– Secure SDLC gaps?
– Change management review failure?
– Logging & anomaly detection delay?
– Exposure vs intrusion classification challenges

Six months of unnoticed PII exposure highlights how application-layer misconfigurations can rival full breaches in impact.

How would you design detection controls to catch this earlier?

Engage below.
Follow @technadu for technical cybersecurity coverage.

Source: https://www.bleepingcomputer.com/news/security/paypal-discloses-data-breach-exposing-users-personal-information/

#ThreatAnalysis #SecureSDLC #FintechSecurity #ApplicationSecurity #DataExposure #CyberRisk #DFIR #Governance #Infosec

ShinyHunters has listed a 1.67 GB JSON dataset allegedly containing 600K+ customer records tied to Canada Goose.
Reported by BleepingComputer.

Dataset reportedly includes:
• checkout_id, cart_token schema indicators
• Shipping lines & order values
• IP telemetry
• Device/browser metadata
• Partial PAN (BIN + last four)
• Authorization metadata
No full card numbers observed in samples.

Canada Goose states no evidence of breach of its own systems; attackers claim third-party processor origin.
Security implications:
• BIN + last four enable targeted card fraud attempts
• Order value profiling identifies high-value targets
• IP/device metadata aids social engineering
• Historical datasets still carry active fraud potential
Is vendor risk management keeping pace with SaaS-based commerce stacks?

Source: https://www.bleepingcomputer.com/news/security/canada-goose-investigating-as-hackers-leak-600k-customer-records/

Engage below.
Follow @technadu for advanced threat analysis.

#ThreatIntel #DataLeak #VendorRisk #RetailSecurity #FraudPrevention #Infosec #CloudSecurity #DataExposure #ShinyHunters #CyberDefense #PrivacyEngineering

Substack has disclosed a security incident involving unauthorized access to limited user data, reportedly obtained through scraping activity described by the threat actor as “noisy.”

The company states that credentials and financial information were not affected, and that mitigations were implemented quickly after discovery. Users have been advised to remain cautious of potential phishing attempts.

From an infosec perspective, this incident underscores challenges around detection timing, data exposure via scraping, and post-incident communication.

How should platforms better monitor and respond to large-scale scraping risks?

Source: https://www.securityweek.com/substack-discloses-security-incident-after-hacker-leaks-data/

Engage in the discussion and follow @technadu for measured cybersecurity analysis.

#Infosec #DataExposure #Scraping #IncidentResponse #CyberRisk #TechNadu #SecurityOperations

SoundCloud’s December 2025 breach has been added to HIBP, confirming exposure of ~29.8M user accounts.

The incident stemmed from unauthorized access to an internal service dashboard that enabled correlation of email addresses with public profile data. No credentials or financial information were compromised, but the case highlights how internal tooling can expand the attack surface.

What practical controls help reduce correlation risk in large platforms?
Source: https://cyberinsider.com/soundcloud-breach-added-to-hibp-29-8-million-accounts-exposed/

Share insights and follow TechNadu for independent InfoSec coverage.

#InfoSec #SoundCloud #HIBP #DataExposure #PrivacyEngineering #CyberRisk #SecurityOperations

The reported BreachForums database exposure illustrates a recurring pattern in underground ecosystems: infrastructure weaknesses outweigh perceived anonymity.

Key considerations:
• Metadata remains a critical risk vector
• Forum resilience often masks fragile backends
• Legal and reputational fallout can be long-lasting

This incident reinforces why data minimization and secure configuration matter - regardless of intent or audience.

Source: https://cybersecuritynews.com/breachforums-hack/

Join the discussion and follow @technadu for fact-based cybersecurity reporting.

#InfoSec #ThreatIntel #DarkWeb #DataExposure #CyberRisk #OperationalSecurity

Researchers enumerated 3.5B WhatsApp phone numbers through the platform’s contact-discovery feature, revealing public profile photos and text for millions of users. Meta applied rate-limiting after the disclosure and says no non-public data was exposed.
This case raises important questions about phone numbers as identifiers and long-term privacy safeguards.
Share your insights & follow for more security-focused analysis.

#InfoSec #CyberSecurity #Privacy #DataExposure #WhatsApp #SecurityResearch #DigitalIdentity #TechNadu

Two billion email addresses were exposed

https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/

#HackerNews #emailbreach #dataexposure #cybersecurity #privacy #awareness

Two billion email addresses were exposed

https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/

#HackerNews #emailbreach #dataexposure #cybersecurity #privacy #awareness

4TB and no client or personal data eh? 👏🏻

https://infosec.exchange/@technadu/115475109972392589 - A 4TB SQL Server backup tied to EY was exposed on Microsoft Azure, discovered by Neo Security during an asset mapping scan.

EY remediated promptly, confirming no client or personal data was affected.

#CyberSecurity #EY #DataExposure #Azure #Infosec #ThreatIntel #DataProtection #CloudSecurity

A 4TB SQL Server backup tied to EY was exposed on Microsoft Azure, discovered by Neo Security during an asset mapping scan.

The file’s naming pattern and metadata indicated it was a full unencrypted database dump - a critical visibility gap in cloud storage hygiene.

EY remediated promptly, confirming no client or personal data was affected.

As botnets continuously scan public cloud assets, how can enterprises proactively detect these exposures before attackers do?

💬 Join the discussion & follow @technadu for deeper security intelligence.

#CyberSecurity #EY #DataExposure #Azure #Infosec #ThreatIntel #DataProtection #CloudSecurity

A 4TB SQL Server backup tied to EY was exposed on Microsoft Azure, discovered by Neo Security during an asset mapping scan.

The file’s naming pattern and metadata indicated it was a full unencrypted database dump - a critical visibility gap in cloud storage hygiene.

EY remediated promptly, confirming no client or personal data was affected.

As botnets continuously scan public cloud assets, how can enterprises proactively detect these exposures before attackers do?

💬 Join the discussion & follow @technadu for deeper security intelligence.

#CyberSecurity #EY #DataExposure #Azure #Infosec #ThreatIntel #DataProtection #CloudSecurity

McDonald’s Data Exposed in Third-Party Partner Breach https://dailydarkweb.net/mcdonalds-data-exposed-in-third-party-partner-breach/ #supplychainattack #thirdpartybreach #CyberSecurity #DataBreaches #dataexposure #UnitedStates #McDonalds #dataleak #McD

McDonald’s Data Exposed in Third-Party Partner Breach https://dailydarkweb.net/mcdonalds-data-exposed-in-third-party-partner-breach/ #supplychainattack #thirdpartybreach #CyberSecurity #DataBreaches #dataexposure #UnitedStates #McDonalds #dataleak #McD

🚨 Security researcher finds 1,300+ exposed TeslaMate servers leaking
Tesla data — from trip locations to charging times.

⚡ “You’re unintentionally sharing your car’s movements with the world.” – Seyfullah Kiliç, SwordSec
💬 Who’s responsible — open-source devs or end-users?

🔎 Follow @technadu for more #infosec & #privacy insights.

#Tesla #CyberSecurity #DataExposure

🚨 Security researcher finds 1,300+ exposed TeslaMate servers leaking
Tesla data — from trip locations to charging times.

⚡ “You’re unintentionally sharing your car’s movements with the world.” – Seyfullah Kiliç, SwordSec
💬 Who’s responsible — open-source devs or end-users?

🔎 Follow @technadu for more #infosec & #privacy insights.

#Tesla #CyberSecurity #DataExposure

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data – Source: www.securityweek.com https://ciso2ciso.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #vulnerabilities #securityweekcom #Vulnerability #DataExposure #securityweek #Workhorse

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data – Source: www.securityweek.com https://ciso2ciso.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #vulnerabilities #securityweekcom #Vulnerability #DataExposure #securityweek #Workhorse

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data https://www.securityweek.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data/ #Vulnerabilities #vulnerability #DataExposure #Workhorse

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data https://www.securityweek.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data/ #Vulnerabilities #vulnerability #DataExposure #Workhorse

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data https://www.securityweek.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data/ #Vulnerabilities #vulnerability #DataExposure #Workhorse

Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data https://www.securityweek.com/flaws-in-software-used-by-hundreds-of-cities-and-towns-exposed-sensitive-data/ #Vulnerabilities #vulnerability #DataExposure #Workhorse

Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation https://www.securityweek.com/major-enterprise-ai-assistants-abused-for-data-theft-manipulation/ #ArtificialIntelligence #DataExposure #ChatGPT #Copilot #Cursor #Gemini #AI

Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation https://www.securityweek.com/major-enterprise-ai-assistants-abused-for-data-theft-manipulation/ #ArtificialIntelligence #DataExposure #ChatGPT #Copilot #Cursor #Gemini #AI

Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation https://www.securityweek.com/major-enterprise-ai-assistants-abused-for-data-theft-manipulation/ #ArtificialIntelligence #DataExposure #ChatGPT #Copilot #Cursor #Gemini #AI

Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation https://www.securityweek.com/major-enterprise-ai-assistants-abused-for-data-theft-manipulation/ #ArtificialIntelligence #DataExposure #ChatGPT #Copilot #Cursor #Gemini #AI

Alleged Data Exposure Hits Indonesian Supreme Court https://dailydarkweb.net/alleged-data-exposure-hits-indonesian-supreme-court/ #DarkWebNews&Services #MAHKAMAHAGUNGGOID #governmentdata #CyberSecurity #MAHKAMAHAGUNG #dataexposure #SupremeCourt #databreach #Indonesia

Alleged Data Exposure Hits Indonesian Supreme Court https://dailydarkweb.net/alleged-data-exposure-hits-indonesian-supreme-court/ #DarkWebNews&Services #MAHKAMAHAGUNGGOID #governmentdata #CyberSecurity #MAHKAMAHAGUNG #dataexposure #SupremeCourt #databreach #Indonesia

Alleged Breach of Everest Bank Customer Database https://dailydarkweb.net/alleged-breach-of-everest-bank-customer-database/ #PersonalInformation #BankingSecurity #CyberSecurity #DataBreaches #customerdata #dataexposure #EverestBank #databreach #India

Alleged Breach of Everest Bank Customer Database https://dailydarkweb.net/alleged-breach-of-everest-bank-customer-database/ #PersonalInformation #BankingSecurity #CyberSecurity #DataBreaches #customerdata #dataexposure #EverestBank #databreach #India

In a penetration test, automated tools find known vulnerabilities—but they don’t think like an attacker...
 
You can absolutely automate the 'vulnerability assessment' phase and information discovery.

It’s possible to automate some exploitation too, if you’re brave and don’t care about the stability of the customer’s network.
 
However, humans perform penetration testing.

Here's a story that illustrates why: https://www.pentestpartners.com/security-blog/a-tale-of-enumeration-and-why-pen-testing-cant-be-automated/

#CyberSecurity #PenTesting #EthicalHacking #OSINT #DataExposure #InfoSec #AutomatedTesting #InfrastructureSecurity

In a penetration test, automated tools find known vulnerabilities—but they don’t think like an attacker...
 
You can absolutely automate the 'vulnerability assessment' phase and information discovery.

It’s possible to automate some exploitation too, if you’re brave and don’t care about the stability of the customer’s network.
 
However, humans perform penetration testing.

Here's a story that illustrates why: https://www.pentestpartners.com/security-blog/a-tale-of-enumeration-and-why-pen-testing-cant-be-automated/

#CyberSecurity #PenTesting #EthicalHacking #OSINT #DataExposure #InfoSec #AutomatedTesting #InfrastructureSecurity

Hello everyone.

In today's article we are reviewing shodan for beginners.

I wish everyone good work and reading.

https://denizhalil.com/2025/01/06/shodan-search-engine-cybersecurity-guide/

#cybersecurity #shodan #penetrationtesting #shodancheatsheet #networksecurity #ethicalhacking #dataexposure

Over 600,000 Personal Records Exposed by Data Broker – Source: www.techrepublic.com https://ciso2ciso.com/over-600000-personal-records-exposed-by-data-broker-source-www-techrepublic-com/ #rssfeedpostgeneratorecho #SecurityonTechRepublic #SecurityTechRepublic #CyberSecurityNews #cybersecurity #Cybersecurity #DataExposure #Security

Signal under fire for storing encryption keys in plaintext

https://stackdiary.com/signal-under-fire-for-storing-encryption-keys-in-plaintext/

#Signal #Privacy #Encryption #Cybersecurity #Messaging #DataProtection #SecureComms #DesktopApp #Vulnerability #InfoSec #DigitalSecurity #EndToEnd #PlainText #KeyManagement #TechNews #PrivacyBreach #SecurityAlert #Cryptography #DataSafety #MobileApps #UserPrivacy #SecurityFlaw #EncryptionKeys #Tech #MessageSecurity #PrivacyRisk #SecureMessaging #CyberRisk #DataExposure

Azure Service Tags Vulnerability Controversy

Date: June 2024

CVE: N/A

Vulnerability Type: Security Misconfiguration

CWE: [[CWE-20]], [[CWE-287]]

Sources: Bleeping Computer

Synopsis

A security vulnerability in Azure Service Tags has been highlighted by Tenable, who identified a risk of data exposure due to how Service Tags handle firewall rules and access control. Microsoft, however, disputes this assessment, clarifying the intended use of Service Tags.

Issue Summary

Tenable's security researchers claim that they discovered a high-severity vulnerability in Azure Service Tags that allows attackers to impersonate trusted Azure services and bypass firewall rules based on Azure Service Tags, and can access private data that way by crafting SSRF-like web requests. These tags, designed for routing and not security boundaries -as per Microsoft-, can be manipulated to impersonate trusted services and access sensitive data.

Technical Key findings

The vulnerability exploits the "availability test" feature within Azure's Application Insights Availability service. By manipulating custom headers and HTTP requests, attackers can bypass network controls that rely on Service Tags, thus accessing internal services and APIs hosted on common ports (80/443).

Vulnerable Products

• Azure DevOps
• Azure Machine Learning
• Azure Logic Apps
• Azure Container Registry
• Azure Load Testing
• Azure API Management
• Azure Data Factory
• Azure Action Group
• Azure AI Video Indexer
• Azure Chaos Studio

Impact Assessment

Exploitation of this vulnerability could lead to unauthorized access to sensitive data and internal APIs, potentially exposing internal services to malicious actors. This represents a significant risk, particularly for services relying solely on Service Tags for security.

Patches or Workaround

Microsoft has not issued a patch, asserting that Service Tags are not designed as a security boundary. They recommend adding authentication and authorization layers to enhance security. Azure customers should follow Microsoft's updated guidelines and review their network configurations to ensure robust security measures are in place.

Tags

#Azure #ServiceTags #Vulnerability #SSRF #DataExposure #CloudSecurity #Microsoft #FirewallBypass

Potential personal data exposure on LHDN’s payment portal #cybersecurity #databreach #dataexposure #dataprotection #digitallife #featured #inlandrevenueboard #irb #lhdn #news #security

https://soyacincau.com/2023/12/13/lhdn-irb-data-exposure-payment-portal-slip/

"🚨 Critical Flaws in Citrix NetScaler Expose Data & Enable DoS Attacks 🚨"

Citrix NetScaler has been hit with two critical vulnerabilities, CVE-2023-4966 and CVE-2023-4967, exposing sensitive data and enabling DoS attacks. The former, with a CVSS score of 9.4, allows remote exploitation without high-level access, while the latter, scoring 8.2, enables a Denial of Service attack on vulnerable devices. Citrix has rolled out security upgrades, urging customers to update to safeguard their systems. 🛡️🌐

CVE-2023-4966: This one's pretty severe and could allow unauthorized access to sensitive data without needing high-level access or user involvement.
CVE-2023-4967: Another biggie, this could enable a ‘Denial of Service attack’, basically shutting down our systems.

Source: GBHackers by Divya

Tags: #Citrix #NetScaler #Vulnerability #CyberSecurity #DataExposure #DoSAttack #CVE20234966 #CVE20234967 #CyberAttack #InfoSec

🔗 MITRE CVE-2023-4966
🔗 MITRE CVE-2023-4967

Look at the datasets available according to this article. They look ripe for abuse and bigotry. #23AndMe #UserData #DataExposure https://therecord.media/scraping-incident-genetic-testing-site

@douglevin They claim “no data or information was exposed or compromised during this event."

Diachenko had posted a redacted screenshot on X

(see https://twitter.com/MayhemDayOne/status/1694311872827208160/photo/1) showing that personal information was exposed, so the firm's denial of any exposure seems.... factually inaccurate, to say the least.

Similarly, their statement that "Our technical team promptly resolved this issue as soon as it came to our notice." does not explain why they didn't notice it sooner when Diachenko first reached out to them to alert them. He went public because they didn't "notice" or respond timely while personal information was reportedly exposed.

This company does not seem very credible in their claims with respect to this incident.

And they also seem to be in a lot of financial distress even prior to this incident: https://www.bbc.com/news/world-asia-india-66126095

#EdTech #Misconfiguration #DataExposure #IncidentResponse #EduSec