Browser wars: Microsoft Edge just steamed past a major rival

Sources

• Source Link

Share

Other Blog

• Microsoft Azure launches new Nvidia A100-powered supercomputing instances

  New supercomputer cloud service is designed to handle the most laborious of AI and ML workloads.

  Read More

• Coinbase hack sees thousands of users accounts drained

  Coinbase has sent out breach notification letters to over 6000 users admitting they might have lost funds in a months-long campaign against the cryptocurrency exchange.

  In the letter, the company said attackers took advantage of a flaw in Coinbase’ two-factor authentication (2FA) mechanism to carry out several assaults between March and May 20, 2021.

  “As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process,” notes Coinbase in the notification letter.

  TechRadar needs you!

  We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

  >> Click here to start the survey in a new window

  • Take a look at these best password managers
  • We’ve also rounded up the best security keys
  • Here are the best business password managers

  Even as the exchange is investigating the incident, it has decided to reimburse all customers by depositing funds equal to the cryptos stolen from their accounts.

  Complex campaign

  Sharing more details, Coinbase said that attackers would have required certain information associated with the customers account, such as their phone numbers, and login credentials.

  The issue has been brewing for some time now. Unconfirmed reports of hackers accessing and draining the cryptocurrency wallets of Coinbase customers first surfaced in August. Then in September, the company had to reassure its users that the email they received about the change in their 2FA settings were sent erroneously.

  While the exchange has admitted that it is “not able to determine conclusively how these third parties gained access to this information,” if it were to guess it’d say the details were inadvertently leaked by the customers as part of an elaborative and affective phishing campaign.

  “Even with the information described above, additional authentication is required in order to access your Coinbase account. However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” explained Coinbase.

  In addition to reimbursing the funds, Coinbase will provide free credit monitoring service to customers, as it suggests users to use a different 2FA mechanism besides SMS-based one, and cycle the password of their Coinbase account, as well as of the associated email address.

  • Shield yourself with these best identity theft protection services

  Read More

• The iPad Air 4 price is now at a record low at Amazon

  iPad deals are offering big discounts on the iPad Air 4, but we don't know how long they will last.

  Read More

• Microsoft Teams might have a few serious security issues

  Security researchers have discovered four separate vulnerabilities in Microsoft Teams that could be exploited by an attacker to spoof link previews, leak IP addresses and even access the software giant's internal services.

  These discoveries were made by researchers at Positive Security who “stumbled upon” them while looking for a way to bypass the the Same-Origin Policy (SOP) in Teams and Electron according to a new blog post. For those unfamiliar, SOP is a security mechanism found in browsers that helps stop websites from attacking one another.

  During their investigation into the matter, the researchers found that they could bypass the SOP in Teams by abusing the link preview feature in Microsoft's video conferencing software by allowing the client to generate a link preview for the target page and then using either summary text or optical character recognition (OCR) on the preview image to extract information. 

  However, while doing this, Positive Security co-founder Fabian Bräunlein found other unrelated vulnerabilities in the feature's implementation.

  Microsoft Teams vulnerabilities

  Of the four bugs Bräunlein found in Teams, two can be used on any device and allow for server-side request forgery (SSRF) and spoofing while the other two only affect Android smartphones and can be exploited to leak IP addresses and achieve Denial of Service (DOS).

  By exploiting the SSRF vulnerability, the researchers were able to leak information from Microsoft's local network. Meanwhile the spoofing bug can be used to improve the effectiveness of phishing attacks or to hide malicious links.

  The DOS bug is particularly worrying as an attacker can send a user a message that includes a link preview with an invalid preview link target (for instance “boom” instead of “https://...”) to crash the Teams app for Android. Unfortunately, the app will continue to crash when trying to open the chat or channel with the malicious message.

  Positive Security responsibly disclosed its findings to Microsoft on March 10 through its bug bounty program. However, in the time since, the software giant has only patched the IP address leak vulnerability in Teams for Android. Now that Positive Security has publicly disclosed its findings, Microsoft may have to patch the remaining three vulnerabilities even though it told the researchers that they don't pose an immediate threat to its users.

  We've also rounded up the best identity theft protection, best firewall and best malware removal software

  Via Threatpost

  Read More