Hackers breached UPS data for SMS phish spree

Phishers have been defrauding customers after UPS leaked their details. The result was some convincing SMS messages that contained the private info.

Looks like a bug allowed a bad actor to manipulate URLs and extract data by brute force. Devs should avoid consecutive object references and add entropy.

Ops should detect brute force attacks and shut ’em down or tarpit them. In this week’s Secure Software Blogwatch, we ask what Brown can do for us?

Your humble blogwatcher curated …

actor bad breached brute bug customers data detect entropy extract hackers info leaked messages object phish private result sms sms messages ups urls