Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
In July 2020, a 17-year-old from Florida convinced Twitter employees to hand over internal credentials. Within hours, the accounts of Barack Obama, Elon Musk, Joe Biden, and Apple were all posting Bitcoin scam messages. The attacker didn't exploit a software vulnerability. He exploited people. These social engineering examples
In 2020, a teenager and two accomplices convinced a Twitter employee they were from the company's IT department. That single phone call gave them access to internal tools, which they used to hijack 130 high-profile accounts — including those of Barack Obama, Elon Musk, and Apple — netting over $100,
In July 2020, Twitter disclosed that attackers had compromised 130 high-profile accounts — including those of Barack Obama, Elon Musk, and Apple — through a social engineering attack targeting employees with access to internal tools. The breach didn't involve some exotic zero-day exploit. It started with phone calls to Twitter
A Single Stolen Password Cost One Company $3.86 Million That's the average cost of a data breach in 2020, according to IBM's Cost of a Data Breach Report. And in nearly every major data breach example from recent years, the root cause wasn't
The Breach That Started With a Single Reused Password In December 2020, the SolarWinds breach dominated every security headline on the planet. But while the world fixated on nation-state threat actors and supply chain attacks, I kept thinking about a detail that emerged early: a SolarWinds intern had reportedly set
In the 2020 Verizon Data Breach Investigations Report, over 80% of hacking-related breaches involved stolen or brute-forced credentials. Not sophisticated zero-day exploits. Not nation-state malware. Passwords. The single thing most people treat as an afterthought is the single thing that gets most organizations compromised. Knowing how to create a strong
In July 2020, a teenager orchestrated one of the most embarrassing breaches in social media history — compromising 130 high-profile Twitter accounts including Barack Obama, Elon Musk, and Apple. The attack vector? Social engineering employees and exploiting accounts that lacked robust internal authentication controls. It was a masterclass in what happens
In December 2020, SolarWinds disclosed one of the most devastating supply chain compromises in history. But buried in the early reporting was a detail that made every security professional wince: a critical password — "solarwinds123" — had been publicly accessible on GitHub. One weak, reused, laughably simple password contributed to
In December 2020, SolarWinds disclosed a supply chain compromise that shook the entire cybersecurity industry. But while the world was focused on nation-state threat actors, Verizon's 2020 Data Breach Investigations Report had already confirmed something far more common and just as devastating: over 80% of hacking-related breaches involved
The SolarWinds Hack Rewrote the Playbook — While We Were Still Reading It As I write this in December 2020, the cybersecurity world is reeling from the SolarWinds supply chain compromise — arguably the most sophisticated cyber espionage campaign ever discovered against the U.S. government and private sector. It's
