Connect with us

Technology

BTR: Understanding the Critical 2FA Vulnerability in QR Code Enrollment Processes Uncovered by Silent Sector – Lauro Chavez

Published

2 years ago

on

SILVER SPRING, Md., Oct. 1, 2024 /PRNewswire/ — Silent Sector, a leading cybersecurity firm specializing in protecting mid-market businesses, has discovered a major flaw in the two-factor authentication (2FA) enrollment process that could leave millions of organizations vulnerable to cyberattacks. The vulnerability lies in the use of QR codes for 2FA, a common security practice across industries, and poses an urgent threat to the security of organizations that rely on this method to protect sensitive accounts.

The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google Authenticator or Microsoft Authenticator, to access their accounts, the secret key that allows this link never expires. This creates a critical security risk: if a QR code was sent via email, saved to a device, or stored in a repository, hackers could potentially access that code, re-enroll in the 2FA process, and bypass account security measures.

“Many organizations trust QR codes as part of their authentication systems, but this discovery shows a significant gap in security,” said Lauro Chavez, Partner and Head of Research at Silent Sector. “The issue is that these QR codes, and the secret keys they contain, can be reused indefinitely. That’s a massive risk if they fall into the wrong hands.”

The Scale of the Threat

Two-factor authentication, or 2FA, is widely used by businesses and individuals to add an extra layer of security to account logins. The process typically requires users to enter not just a password but also a one-time passcode (OTP), which is generated by an authentication app on a user’s phone. This is typically performed after enrolling in the multi-factor authentication process. This process is frequently enabled by scanning a QR code during the initial setup.

Indeed, for the better part of a decade, QR code-based 2FA has been considered a highly secure method because it was believed that the secret key embedded in the code expired after the initial setup. However, Silent Sector’s discovery reveals that this is not the case. The secret key embedded in the QR code remains valid indefinitely, allowing a malicious actor to use it to re-enroll and gain access to accounts even if the original user is unaware.

“This vulnerability has the potential to impact millions of businesses worldwide, especially those in the mid-market, which may not have the resources or expertise to deal with such sophisticated threats,” Chavez explained. “The ability to reuse these codes without expiration is particularly concerning, as many organizations may not even realize the risk.”

To read the remainder of the interview, please visit:
https://bit.ly/3zEuqTs

Contact:
***@biztechreports.com

Photo(s):
https://www.prlog.org/13041242

Press release distributed by PRLog

View original content:https://www.prnewswire.com/news-releases/btr-understanding-the-critical-2fa-vulnerability-in-qr-code-enrollment-processes-uncovered-by-silent-sector–lauro-chavez-302264722.html

SOURCE Silent Sector

Related Topics:
Continue Reading

Technology

Trimble for Government Achieves ‘Initial Implementation’ Status for FedRAMP Class C (Moderate) Certification

Published

28 minutes ago

on

October 20, 2026

By

Milestone accelerates secure cloud adoption for federal, state and local entities managing infrastructure, spatial data and capital assets 

WESTMINSTER, Colo., Oct. 20, 2026 /PRNewswire/ — Trimble today announced that Trimble for Government is listed as ‘Initial Implementation’ status for Federal Risk and Authorization Management Program (FedRAMP®) Class C (Moderate) certification and is now listed on the FedRAMP Marketplace. In conjunction with seeking FedRAMP certification, Trimble is also pursuing GovRAMP authorization to support state, local and education (SLED) customers with reciprocal cybersecurity compliance standards.

This dual milestone marks a critical step forward in delivering a software as a service (SaaS) cloud environment built within a secure Government Community Cloud. Designed specifically for U.S. Federal Government departments, state and local agencies, and defense and civilian contractors, Trimble for Government provides a unified ecosystem for managing infrastructure, spatial data, capital projects, permitting and facility assets across their entire lifecycle.

Achieving FedRAMP Class C (Moderate) and GovRAMP alignment will enable public sector entities and Department of Defense (DoD) contractors to comply with stringent security mandates — including Cybersecurity Maturity Model Certification (CMMC) alignment — while modernizing digital engineering and asset management.

“Federal, state and local agencies face the dual challenge of modernizing critical infrastructure while maintaining uncompromising cybersecurity standards,” said Mark Schwartz, group president, AECO at Trimble. “Achieving ‘Initial Assessment’ status reflects our commitment to delivering mission-critical spatial, capital project and asset management capabilities inside a secure, audit-ready cloud boundary across all levels of government.”

Integrated cloud solutions built for government operations

The in-scope environment brings together Trimble’s proven field execution, asset, project and permitting software into four modular packages designed to support specific public sector outcomes:

Trimble® Field Collaboration: Delivers field data services using foundational spatial database infrastructure and GIS integration to support high-security field operations, map assets, and enable seamless field-to-cloud workflows across Trimble’s core Field Systems portfolio.Trimble Project Management powered by Trimble ProjectSight® software: Connects design-to-build workflows in the field, providing precision data layout, project tracking, collaboration and quality assurance across construction projects.Trimble Asset Management powered by Trimble Unity™ Maintain software: Serves as a centralized facilities data core for federal, state, and local government agencies, military installations, and public infrastructure — such as public buildings, utilities, and transportation networks — to optimize maintenance and long-term capital planning.Trimble Permit Management powered by Trimble Unity Permit software: Streamlines end-to-end management of permitting, licensing, land use and infrastructure rights-of-way in a fully compliant cloud environment.

The unifying in-scope element across all four packages is the Trimble Connect® platform, providing collaboration and a common data environment (CDE) across the Trimble for Government platform.

With assessment processes underway, Trimble continues to advance toward full FedRAMP and GovRAMP authorizations to ensure public sector customers can innovate with confidence.

About Trimble
Trimble is a global technology company that connects the physical and digital worlds, transforming the ways work gets done. With relentless innovation in precise positioning, modeling and data analytics, Trimble enables essential industries including construction, geospatial and transportation. Whether it’s helping customers build and maintain infrastructure, design and construct buildings, optimize global supply chains or map the world, Trimble is at the forefront, driving productivity and progress. For more information about Trimble, visit: www.trimble.com.

GTRMB

View original content to download multimedia:https://www.prnewswire.com/news-releases/trimble-for-government-achieves-initial-implementation-status-for-fedramp-class-c-moderate-certification-302913499.html

SOURCE Trimble

Continue Reading

Technology

Trimble for Government Achieves ‘Initial Implementation’ Status for FedRAMP Class C (Moderate) Certification

Published

28 minutes ago

on

October 20, 2026

By

Milestone accelerates secure cloud adoption for federal, state and local entities managing infrastructure, spatial data and capital assets 

WESTMINSTER, Colo., Oct. 20, 2026 /PRNewswire/ — Trimble today announced that Trimble for Government is listed as ‘Initial Implementation’ status for Federal Risk and Authorization Management Program (FedRAMP®) Class C (Moderate) certification and is now listed on the FedRAMP Marketplace. In conjunction with seeking FedRAMP certification, Trimble is also pursuing GovRAMP authorization to support state, local and education (SLED) customers with reciprocal cybersecurity compliance standards.

This dual milestone marks a critical step forward in delivering a software as a service (SaaS) cloud environment built within a secure Government Community Cloud. Designed specifically for U.S. Federal Government departments, state and local agencies, and defense and civilian contractors, Trimble for Government provides a unified ecosystem for managing infrastructure, spatial data, capital projects, permitting and facility assets across their entire lifecycle.

Achieving FedRAMP Class C (Moderate) and GovRAMP alignment will enable public sector entities and Department of Defense (DoD) contractors to comply with stringent security mandates — including Cybersecurity Maturity Model Certification (CMMC) alignment — while modernizing digital engineering and asset management.

“Federal, state and local agencies face the dual challenge of modernizing critical infrastructure while maintaining uncompromising cybersecurity standards,” said Mark Schwartz, group president, AECO at Trimble. “Achieving ‘Initial Assessment’ status reflects our commitment to delivering mission-critical spatial, capital project and asset management capabilities inside a secure, audit-ready cloud boundary across all levels of government.”

Integrated cloud solutions built for government operations

The in-scope environment brings together Trimble’s proven field execution, asset, project and permitting software into four modular packages designed to support specific public sector outcomes:

Trimble® Field Collaboration: Delivers field data services using foundational spatial database infrastructure and GIS integration to support high-security field operations, map assets, and enable seamless field-to-cloud workflows across Trimble’s core Field Systems portfolio.Trimble Project Management powered by Trimble ProjectSight® software: Connects design-to-build workflows in the field, providing precision data layout, project tracking, collaboration and quality assurance across construction projects.Trimble Asset Management powered by Trimble Unity™ Maintain software: Serves as a centralized facilities data core for federal, state, and local government agencies, military installations, and public infrastructure — such as public buildings, utilities, and transportation networks — to optimize maintenance and long-term capital planning.Trimble Permit Management powered by Trimble Unity Permit software: Streamlines end-to-end management of permitting, licensing, land use and infrastructure rights-of-way in a fully compliant cloud environment.

The unifying in-scope element across all four packages is the Trimble Connect® platform, providing collaboration and a common data environment (CDE) across the Trimble for Government platform.

With assessment processes underway, Trimble continues to advance toward full FedRAMP and GovRAMP authorizations to ensure public sector customers can innovate with confidence.

About Trimble
Trimble is a global technology company that connects the physical and digital worlds, transforming the ways work gets done. With relentless innovation in precise positioning, modeling and data analytics, Trimble enables essential industries including construction, geospatial and transportation. Whether it’s helping customers build and maintain infrastructure, design and construct buildings, optimize global supply chains or map the world, Trimble is at the forefront, driving productivity and progress. For more information about Trimble, visit: www.trimble.com.

GTRMB

View original content to download multimedia:https://www.prnewswire.com/news-releases/trimble-for-government-achieves-initial-implementation-status-for-fedramp-class-c-moderate-certification-302913499.html

SOURCE Trimble

Continue Reading

Technology

Delta Development Team and The Good Drone Company Awarded U.S. Army Contract for Aerial Blood Delivery

Published

28 minutes ago

on

October 20, 2026

By

TUCSON, Ariz., Oct. 20, 2026 /PRNewswire/ — Delta Development Team (DDT), a leader in prehospital blood storage and cold chain technology, and The Good Drone Company (GDC) have been awarded a U.S. Army contract to develop a drone-based blood delivery capability for the Army Blood Link (ABL) program.

The program is part of the broader Armed Services Blood Program (ASBP), which supplies blood products to U.S. military forces worldwide. Army Blood Link is designed to support battlefield medical logistics through rapid, temperature-controlled delivery of lifesaving blood products to the field, providing an additional resupply option when traditional ground transportation is unavailable, delayed, or unsafe. Under the contract, The Good Drone Company will provide two U.S.-built prototypes of its hybrid vertical takeoff and landing (VTOL) cargo drone, each designed to transport up to six units of blood, while DDT will provide the temperature-controlled storage capability through its Delta ICE 2L Smart Blood Cooler.

The companies are combining commercial off-the-shelf (COTS) technologies to create a U.S.-sourced aerial blood delivery system capable of transporting blood directly to the point of need.

To meet ABL program requirements, DDT will supply six Delta ICE 2L Smart Blood Coolers, each designed to maintain two units of blood within the required temperature range for three hours of aerial delivery in high-humidity environments with ambient temperatures ranging from 15°F to 120°F. Built-in temperature monitoring and data recording, along with Bluetooth and cellular connectivity, support cold-chain oversight and blood accountability. The program extends DDT’s blood storage and monitoring capabilities into aerial delivery.

“Getting blood to the point of need is only part of the challenge. It must also remain within the required temperature range throughout the journey,” said Montgomery Leija, CEO of Delta Development Team. “This program brings DDT’s experience in blood storage and cold chain management into a new operational environment, taking the blood supply chain from the ground to the air.”

The prototype system is designed to deliver blood within 10 meters of a designated target during both day and night operations. It will feature a communications range of up to 30 miles and semi-autonomous waypoint navigation. It is intended for single-person operation with minimal training and is built on GDC’s existing commercial cargo drone technology to accelerate development and fielding while meeting U.S.-sourcing requirements.

“We have seen strong interest in middle-mile drones in emerging markets for some time, from both public and private sector customers spanning healthcare to third-party logistics,” said Jake Vander Ploeg, CEO of The Good Drone Company. “This program is a great example of how the military is adopting commercial technology like our cargo drones to quickly test new ideas in the field without starting a full aircraft development program.”

The collaboration combines GDC’s expertise in commercial drone platforms and aerial delivery with DDT’s temperature-controlled blood storage and transport capabilities to support:

Rapid resupply: Delivering blood when conventional ground transportation is unavailable or unsafe.Cold chain protection: Maintaining required blood temperatures during aerial transport.U.S.-sourced capability: Supporting domestic defense supply chain objectives.Accelerated development: Combining GDC’s existing commercial cargo drone technology with DDT’s established blood storage solutions.

The ABL effort addresses the challenge of delivering critical medical supplies in contested and austere environments. When terrain, damaged infrastructure, or tactical conditions prevent conventional resupply, aerial delivery combined with temperature-controlled storage can expand options for getting lifesaving blood products to service members when and where they are needed.

About Delta Development Team

Delta Development Team (DDT) is a U.S.-based medical technology company headquartered in Tucson, Arizona, specializing in blood storage, transport, monitoring, and logistics solutions for military and prehospital environments. DDT develops technology designed to keep blood available, traceable, and mission-ready from the blood bank to the point of injury. Its portfolio includes the APRU 6L, Delta ICE 2L, TBS 40L, and BloodCOMM® blood management platform.

Media Contact: info@deltadevteam.com | www.deltadevteam.com

About The Good Drone Company

The Good Drone Company (GDC) is an aerospace company headquartered in Tempe, Arizona, that designs and builds autonomous hybrid VTOL cargo drones for middle-mile logistics. GDC’s aircraft take off and land vertically without a runway, carry up to 55 lb (25 kg) of payload, and fly more than 300 miles (500 km) at speeds up to 93 mph (150 km/h). GDC is deploying in Kenya to close the middle-mile transportation gap for public and private sector customers, working closely with its local partner ThatcherX and the Kenyan government to change how goods move around the country.

Media Contact: info@thegooddronecompany.com | www.thegooddronecompany.com

View original content to download multimedia:https://www.prnewswire.com/news-releases/delta-development-team-and-the-good-drone-company-awarded-us-army-contract-for-aerial-blood-delivery-302913294.html

SOURCE Delta Development Team

Continue Reading

Trending