Application Security
News & Commentary
Credential-Stuffing Attacks Take Enterprise Systems By Storm
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Automated credential-stuffing attempts makes up 90% of enterprise login traffic.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/17/2017
Comment0 comments  |  Read  |  Post a Comment
Ransomware: How A Security Inconvenience Became The Industry's Most-Feared Vulnerability
Gur Shatz, CTO and co-founder, Cato NetworksCommentary
There are all sorts of ways to curb ransomware, so why has it spread so successfully?
By Gur Shatz CTO and co-founder, Cato Networks, 1/16/2017
Comment0 comments  |  Read  |  Post a Comment
Free IoT Vulnerability Scanner Hunts Enterprise Threats
Kelly Sheridan, Associate Editor, InformationWeekQuick Hits
A free IoT scanner from BeyondTrust looks for at-risk devices so organizations can pinpoint and address vulnerabilities.
By Kelly Sheridan Associate Editor, InformationWeek, 1/12/2017
Comment0 comments  |  Read  |  Post a Comment
Record Number of Vulns For Adobe, Microsoft, Apple In '16, Says ZDI
Terry Sweeney, Contributing EditorNews
Advantech makes surprise debut on vulnerability list at number two, right behind Adobe
By Terry Sweeney Contributing Editor, 1/10/2017
Comment0 comments  |  Read  |  Post a Comment
'Zero Trust': The Way Forward in Cybersecurity
John Kindervag, Vice President & Principal Analyst, ForresterCommentary
This approach to network design can cut the chance of a breach.
By John Kindervag Vice President & Principal Analyst, Forrester, 1/10/2017
Comment5 comments  |  Read  |  Post a Comment
MongoDB Attack Shows Off Cyber Extortionists' New Tricks
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Ransomware operators are diversifying their cyber-extortion toolkit and expanding their range of targets.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/10/2017
Comment1 Comment  |  Read  |  Post a Comment
Naughty & Nice: Dark Reading Caption Contest Winners
John Klossner, CartoonistCommentary
It was a tough job choosing among our strongest field yet, with more than 100 submissions. And the winners are
By John Klossner Cartoonist, 1/7/2017
Comment4 comments  |  Read  |  Post a Comment
Why Ransomware Is Only Going To Get Worse
Rick Orloff, VP, Chief Security Officer, and Chief Privacy Officer at Code42Commentary
The meteoric rise of the problem stems from a lack of preparedness and simple economics.
By Rick Orloff VP, Chief Security Officer, and Chief Privacy Officer at Code42, 1/5/2017
Comment0 comments  |  Read  |  Post a Comment
Non-Web App Vulnerabilities Outpace Web App Flaws
Ericka Chickowski, Contributing Writer, Dark ReadingNews
On back of IoT and other growing application spaces, the gap between vulns found in Web apps compared to all other apps widens in 2016.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/5/2017
Comment0 comments  |  Read  |  Post a Comment
A Look Inside Responsible Vulnerability Disclosure
Marc Laliberte, Information Security Threat Analyst, WatchGuard TechnologiesCommentary
It's time for security researchers and vendors to agree on a standard responsible disclosure timeline.
By Marc Laliberte Information Security Threat Analyst, WatchGuard Technologies, 1/5/2017
Comment1 Comment  |  Read  |  Post a Comment
Ransomware Has Evolved, And Its Name Is Doxware
Chris Ensey, COO of Dunbar Security SolutionsCommentary
The latest form of malware holds computers hostage and compromises the privacy of conversations, photos, and sensitive files.
By Chris Ensey COO of Dunbar Security Solutions, 1/4/2017
Comment3 comments  |  Read  |  Post a Comment
The Bug Bounty Model: 21 Years & Counting
Jason Haddix, Head of Trust & Security, BugcrowdCommentary
A look back on the beginnings of crowdsourced vulnerability assessment and how its robust history is paving the way for the future.
By Jason Haddix Head of Trust & Security, Bugcrowd, 12/29/2016
Comment2 comments  |  Read  |  Post a Comment
Chinas Cybersecurity Law Seeks Scrutiny Of Technology
Dark Reading Staff, Quick Hits
Countrys top internet regulator releases framework for stricter cyberspace laws, including review of local and foreign technology.
By Dark Reading Staff , 12/28/2016
Comment0 comments  |  Read  |  Post a Comment
8 Boldest Security Predictions For 2017
Ericka Chickowski, Contributing Writer, Dark Reading
Scary, funny and maybe even a little outlandish, these industry predictions come from prognosticators who didn't mince words.
By Ericka Chickowski Contributing Writer, Dark Reading, 12/27/2016
Comment5 comments  |  Read  |  Post a Comment
Year 2016 Sees Record Deployment Of HTTPS By Firefox, Chrome
Dark Reading Staff, Quick Hits
More than half of Web pages loaded by the browsers guarantee protection to visitors.
By Dark Reading Staff , 12/27/2016
Comment1 Comment  |  Read  |  Post a Comment
More Than 50% Of Biggest Holiday Retailers May Not Be PCI-Compliant
Steve Zurier, Freelance WriterNews
SecurityScorecard warns while the industry has made progress, many are still not covering the basics of security.
By Steve Zurier Freelance Writer, 12/22/2016
Comment20 comments  |  Read  |  Post a Comment
Security Analytics: Don't Let Your Data Lake Turn Into A Data Swamp
Nik Whitfield, Computer Scientist & Security Technology EntrepreneurCommentary
It's easy to get bogged down when looking for insights from data using Hadoop. But that doesn't have to happen, and these tips can help.
By Nik Whitfield Computer Scientist & Security Technology Entrepreneur, 12/21/2016
Comment0 comments  |  Read  |  Post a Comment
Application Security Still Slows Developer Work
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Cooperation among DevOps teams might be growing, but security testing still seen as a road block to continuous delivery.
By Ericka Chickowski Contributing Writer, Dark Reading, 12/20/2016
Comment2 comments  |  Read  |  Post a Comment
Microsoft To Block Flash In Edge Browser For Security, Speed
Kelly Sheridan, Associate Editor, InformationWeekNews
Microsoft will block Adobe Flash by default in its Edge browser, following similar announcements from Google, Apple, and Mozilla.
By Kelly Sheridan Associate Editor, InformationWeek, 12/16/2016
Comment1 Comment  |  Read  |  Post a Comment
The Internet Of Things: When Bigger Is Not Better
Paul Vixie, Chairman & CEO, Farsight Security, Inc.Commentary
What happens when 10,000 companies add programmability and connectivity to their products, and we increase the Internets attack surface by a million times or more?
By Paul Vixie Chairman & CEO, Farsight Security, Inc., 12/13/2016
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by Shantaram
Current Conversations Cool! i like it!
In reply to: 192.168.0.1">Re: 192.168.0.1
Post Your Own Reply
More Conversations
PR Newswire
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
Secure Application Development - New Best Practices
Secure Application Development - New Best Practices
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.