Page 12 - Ken Munro News Today : Breaking News, Live Updates & Top Stories | Vimarsana

BBC News By Jane Wakefield image captionModems need crucial software updates and secure passwords Millions of people could be using outdated routers that put them at risk of being hacked, Which? has warned. The consumer watchdog examined 13 models provided to customers by internet-service companies such as EE, Sky and Virgin Media and found more than two-thirds had flaws. It estimated about six million people could have a device not updated since 2018 or earlier. So, in some cases, they would not have received crucial security updates. Weak passwords weak default passwords cyber-criminals cou...

© Getty Images Recently patched vulnerabilities in Peloton’s bike software may have allowed unauthorized users to view sensitive user data, new security research published this week found. Pen Test Partners, a cybersecurity group, said that earlier this year it discovered vulnerabilities allowing unauthenticated users to exploit Peloton’s API, the software that facilitates communication between the bikes and company servers. The vulnerabilities could potentially allow an individual to view personal information on Peloton users, including their location, gender and age, as well as class a...

Have I Been Pwned founder’s keynote offered a sobering counterpoint to the well-meaning ‘World Password Day’ Imagine a parent’s terror when the geolocation of their child’s smart watch suddenly switches from tennis practice to the middle of the ocean. This was precisely the scenario simulated by Ken Munro of UK infosec firm Pen Test Partners via exploitation of an insecure direct object reference (IDOR) vulnerability in an IoT device, and with help from Troy Hunt, creator of data breach record index Have I Been Pwned, and his daughter. This was one of many eye-opening tales of shodd...

Among the data anyone on the internet could access: a Peloton user's age, birthdate, city, gender, weight and workout statistics, all of which can set to be private by a user but were still accessible.

Peloton’s leaky API let anyone grab riders’ private account data But the company won't say if it has evidence of malicious exploitation. Halfway through my Monday afternoon workout last week, I got a message from a security researcher with a screenshot of my Peloton account data. My Peloton profile is set to private and my friend’s list is deliberately zero, so nobody can view my profile, age, city, or workout history. But a bug allowed anyone to pull users’ private account data directly from Peloton’s servers, even with their profile set to private. Peloton, the at-home fitness bra...