Vulnerabilities / Threats // Advanced Threats
News & Commentary
The Rise Of Social Media Botnets
James C. Foster, Founder & CEO, ZeroFOXCommentary
In the social Internet, building a legion of interconnected bots -- all accessible from a single computer -- is quicker and easier than ever before.
By James C. Foster Founder & CEO, ZeroFOX, 7/7/2015
Comment0 comments  |  Read  |  Post a Comment
FBI Offering $4.3 Million For Help Finding Cyber Most-Wanted
Sara Peters, Senior Editor at Dark ReadingQuick Hits
Big prize still going to whomever can help find Gameover ZeuS mastermind.
By Sara Peters Senior Editor at Dark Reading, 7/2/2015
Comment3 comments  |  Read  |  Post a Comment
4 Ways Cloud Usage Is Putting Health Data At Risk
Jai Vijayan, Freelance writerNews
A huge shadow IT problem is just one of the risks of uncontrolled cloud usage in healthcare organizations, new study shows.
By Jai Vijayan Freelance writer, 6/26/2015
Comment3 comments  |  Read  |  Post a Comment
Why China Wants Your Sensitive Data
Adam Meyers, VP of Intelligence, CrowdStrikeCommentary
Since May 2014, the Chinese government has been amassing a 'Facebook for human intelligence.' Here's what it's doing with the info.
By Adam Meyers VP of Intelligence, CrowdStrike, 6/24/2015
Comment17 comments  |  Read  |  Post a Comment
Child Exploitation & Assassins For Hire On The Deep Web
Sara Peters, Senior Editor at Dark ReadingNews
'Census report' of the unindexed parts of the Internet unearths everything from Bitcoin-laundering services to assassins for hire.
By Sara Peters Senior Editor at Dark Reading, 6/23/2015
Comment9 comments  |  Read  |  Post a Comment
Report: NSA, GCHQ Actively Targeted Kaspersky Lab, Other Security Vendors
Sara Peters, Senior Editor at Dark ReadingQuick Hits
Snowden documents reveal government intelligence agencies were working to subvert security software. Kaspersky Lab calls nation-states' targeting of security companies 'extremely worrying.'
By Sara Peters Senior Editor at Dark Reading, 6/22/2015
Comment0 comments  |  Read  |  Post a Comment
Is Your Security Operation Hooked On Malware?
Giora Engel, VP Product & Strategy, LightCyberCommentary
It may seem counterintuitive, but an overzealous focus on malware may be preventing you from detecting even bigger threats.
By Giora Engel VP Product & Strategy, LightCyber, 6/16/2015
Comment8 comments  |  Read  |  Post a Comment
OPM Breach Scope Widens, Employee Group Blasts Agency For Not Encrypting Data
Jai Vijayan, Freelance writerNews
Lack of encryption 'indefensible' and 'outrageous,' American Federation of Government Employees says.
By Jai Vijayan Freelance writer, 6/12/2015
Comment3 comments  |  Read  |  Post a Comment
Hospital Medical Devices Used As Weapons In Cyberattacks
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Security firm discovered malware-infected medical devices in three hospitals hit by data breaches.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 6/8/2015
Comment4 comments  |  Read  |  Post a Comment
Long Cons: The Next Age of Cyber Attacks
Ben Johnson, Chief Security Strategist, Bit9 + Carbon BlackCommentary
When hackers know that a big payday is coming they don’t mind waiting for months for the best moment to strike.
By Ben Johnson Chief Security Strategist, Bit9 + Carbon Black, 6/5/2015
Comment5 comments  |  Read  |  Post a Comment
Chinese ISP: China Is Victim Of Foreign State-Backed APT Group
Sara Peters, Senior Editor at Dark ReadingNews
Qihoo 360 says that OceanLotus has been stealing information from Chinese government agencies and maritime institutions since 2012.
By Sara Peters Senior Editor at Dark Reading, 6/4/2015
Comment0 comments  |  Read  |  Post a Comment
Report: NSA Secretly Expanded Warrantless Internet Surveillance To Find Hackers
Dark Reading Staff, Quick Hits
New York Times: Intelligence agency went looking not for criminal hackers on foreign and American soil.
By Dark Reading Staff , 6/4/2015
Comment0 comments  |  Read  |  Post a Comment
Home Routers Being Targeted in DNS Hijacking Attack, Trend Micro Says
Jai Vijayan, Freelance writerNews
Attackers attempting to steal sensitive data by diverting home router traffic to malicious domains, security firm says.
By Jai Vijayan Freelance writer, 5/29/2015
Comment2 comments  |  Read  |  Post a Comment
State-Sponsored Cybercrime: A Growing Business Threat
David Venable,  Director, Professional Services, Masergy CommunicationsCommentary
You don’t have to be the size of Sony -- or even mock North Korea -- to be a target.
By David Venable Director, Professional Services, Masergy Communications, 5/26/2015
Comment3 comments  |  Read  |  Post a Comment
Cyber Threat Analysis: A Call for Clarity
Michael McMahon, Director, Cyber Strategy & Analysis, Innovative Analytics & Training, LLCCommentary
The general public deserves less hyperbole and more straight talk
By Michael McMahon Director, Cyber Strategy & Analysis, Innovative Analytics & Training, LLC, 5/22/2015
Comment12 comments  |  Read  |  Post a Comment
1.1 Million Hit In Another BlueCross BlueShield Breach
Dark Reading Staff, Quick Hits
CareFirst BCBS announces breach, two months after Premera Blue Cross disclosed a breach of 11 million records.
By Dark Reading Staff , 5/20/2015
Comment0 comments  |  Read  |  Post a Comment
VENOM Zero-Day May Affect Thousands Of Cloud, Virtualization Products
Sara Peters, Senior Editor at Dark ReadingNews
Critical vulnerability in the open-source QEMU hypervisor lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host.
By Sara Peters Senior Editor at Dark Reading, 5/13/2015
Comment6 comments  |  Read  |  Post a Comment
Vulnerability Disclosure Deja Vu: Prosecute Crime Not Research
Katie Moussouris, Chief Policy Officer, HackerOneCommentary
There is a lesson to be learned from a locksmith living 150 years ago: Attackers and criminals are the only parties who benefit when security researchers fear the consequences for reporting issues.
By Katie Moussouris Chief Policy Officer, HackerOne, 5/12/2015
Comment10 comments  |  Read  |  Post a Comment
What Does China-Russia 'No Hack' Pact Mean For US?
Sara Peters, Senior Editor at Dark ReadingNews
It could be an Internet governance issue or a response to the U.S. DoD's new cyber strategy, but one thing is certain: it doesn't really mean China and Russia aren't spying on one another anymore.
By Sara Peters Senior Editor at Dark Reading, 5/11/2015
Comment2 comments  |  Read  |  Post a Comment
Law Enforcement Finding Few Allies On Encryption
Sara Peters, Senior Editor at Dark ReadingNews
Cloud providers, mobile device manufacturers, private citizens, and a bipartisan Congressional committee are lining up on the opposite side.
By Sara Peters Senior Editor at Dark Reading, 5/5/2015
Comment3 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by Blog Voyage
Current Conversations What an offer !
In reply to: Wow
Post Your Own Reply
More Conversations
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2849
Published: 2015-07-07
SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.

CVE-2015-2850
Published: 2015-07-07
Cross-site scripting (XSS) vulnerability in index-login.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

CVE-2015-3216
Published: 2015-07-07
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establi...

CVE-2014-3653
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVE-2014-5406
Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report