News & Commentary

Latest Content tagged with Application Security
Page 1 / 2   >   >>
Why Size Doesn't Matter in DDoS Attacks
Commentary  |  9/21/2017  | 
Companies both large and small are targets. Never think "I'm not big enough for a hacker's attention."
Mobile Ransomware Hits Browsers with Old-School Techniques
News  |  9/20/2017  | 
Several types of malware sold on the dark Web advertise the ability to spy on Android smartphones, encrypt files, and demand payment.
Software Assurance: Thinking Back, Looking Forward
Commentary  |  9/20/2017  | 
Ten personal observations that aim to bolster state-of-the-art and state-of-practice in application security.
Get Serious about IoT Security
Commentary  |  9/20/2017  | 
These four best practices will help safeguard your organization in the Internet of Things.
Viacom's Secret Cloud Keys Exposed
Quick Hits  |  9/19/2017  | 
The entertainment giant is the latest company to misconfigure its Amazon Web Services S3 cloud storage bucket.
How Apple's New Facial Recognition Technology Will Change Enterprise Security
Commentary  |  9/19/2017  | 
Expect a trickle-down effect, as tech similar to Face ID becomes offered outside of Apple.
Avast CCleaner Compromised Amid Rise in Supply Chain Threats
News  |  9/18/2017  | 
Attackers somehow hacked the build system of Avast's CCleaner to deliver malware, potentially affecting millions of users.
To Be Ready for the Security Future, Pay Attention to the Security Past
Commentary  |  9/18/2017  | 
It's easy to just move on to the next problem, ignoring what's happened -- but that's a mistake.
Attacks on Android Soared 40% in Q2
News  |  9/15/2017  | 
Despite a rise in attacks, the average number of malicious variants remains surprisingly limited, according to a report from Avast.
Attacking Developers Using 'Shadow Containers'
Attacking Developers Using 'Shadow Containers'
Dark Reading Videos  |  9/15/2017  | 
Sagie Dulce describes why developers are such attractive targets and how the Docker API can be exploited to use one of developers' favorite tools against them in sneaky, obfuscated attacks.
Microsoft's Azure 'Confidential Computing' Encrypts Data in Use
News  |  9/14/2017  | 
Early Access program under way for new Azure cloud security feature.
'ExpensiveWall' Attacks More Than 1 Million Android Users
Quick Hits  |  9/14/2017  | 
New Android malware variant registers users for paid services without their permission and sends bogus premium SMS messages.
'Bashware' Undermines Windows 10 Security Via Linux Subsystem
News  |  9/13/2017  | 
New WSL feature in Windows 10 gives attackers a way to run malware without being detected by any current endpoint security tools, Check Point says.
Trump Orders Removal of Kaspersky Products from Federal Systems
Quick Hits  |  9/13/2017  | 
The president cites concern that the Russia-based company could be influenced by the Kremlin.
5 Problems That Keep CISOs Awake at Night
Commentary  |  9/13/2017  | 
The last few years have shown a big difference in the way cyber-risks are acknowledged, but progress still needs to be made.
China to Create Data Repository to Log Cyberattacks
Quick Hits  |  9/13/2017  | 
Telcos, government agencies, Internet companies, and domain-name organizations to file cybersecurity information.
Shopify Risk Director Talks Ecommerce, Bug Bounty Program
News  |  9/12/2017  | 
Andrew Dunbar shares his experience growing a retail-focused security team, and combating the many threats facing online merchants and their customers.
The 'Team of Teams' Model for Cybersecurity
Commentary  |  9/12/2017  | 
Security leaders can learn some valuable lessons from a real-life military model.
Tesla Hacks: The Good, The Bad, & The Ugly
Tesla Hacks: The Good, The Bad, & The Ugly
Dark Reading Videos  |  9/12/2017  | 
Keen Security Lab found multiple holes in the isolation layer Tesla uses to protect drive systems from infotainment systems, but were impressed by the auto company's security in other ways.
Credit Card Hacker Roman Seleznev Enters More Guilty Pleas
News  |  9/11/2017  | 
The Russian hacker already hit with a 27-year prison sentence for credit card hacking pleads guilty to two more charges.
Why Relaxing Our Password Policies Might Actually Bolster User Safety
Commentary  |  9/11/2017  | 
Recent guidance from NIST may seem counterintuitive.
New Android 'Toast' Vuln Makes Overlay Attacks Easier
News  |  9/8/2017  | 
The vast majority of Android devices are at risk of a 'Toast' overlay attack that builds on Cloak and Dagger exploits. The bug could lead to remote control of the device unless Google's latest security patch is applied.
7 Tips to Fight Gmail Phishing Attacks
Slideshows  |  9/8/2017  | 
Popular email platforms like Gmail are prime phishing targets. Admins can adopt these steps to keep attackers at bay.
If Blockchain Is the Answer, What Is the Security Question?
Commentary  |  9/8/2017  | 
Like any technology, blockchain has its strengths and weaknesses. But debunking three common myths can help you cut through the hype.
38% of Attorneys Fail to Disclose Cybersecurity Issues to Board
Quick Hits  |  9/8/2017  | 
Directors increasingly find themselves held accountable for cybersecurity breaches at their companies.
Is Public Sector Cybersecurity Adequate?
Commentary  |  9/7/2017  | 
Many governmental organizations are unstaffed, underfunded, and unprepared to fight common attacks, and they could learn a thing or two from the private sector.
10% of Ransomware Attacks on SMBs Targeted IoT Devices
News  |  9/7/2017  | 
IoT ransomware attacks are expected to ramp up in the coming years, a new survey shows.
Is Your Organization Merely PCI-Compliant or Is It Actually Secure?
Commentary  |  9/6/2017  | 
The Host Identity Protocol might be the answer to inadequate check-the-box security standards.
GDPR Confusion Persists Among Businesses, Survey Shows
Quick Hits  |  9/6/2017  | 
Top executives appear dismissive about the penalties they could face if failing to fulfill the EU's General Data Protection Regulation (GDPR) requirements.
72% of Educational Institutions Lack Designated InfoSec Staff
Quick Hits  |  9/5/2017  | 
Vast majority of IT specialists in this sector feel ill-prepared for cybersecurity risks, according to report.
Judge Rules that Yahoo Breach Victims Can Sue
Quick Hits  |  9/5/2017  | 
The 1 billion users who were victims in Yahoo's massive data breaches between 2013 to 2016 received court approval to move forward with their case.
3 Ways AI Could Help Resolve the Cybersecurity Talent Crisis
Commentary  |  9/5/2017  | 
There's no escaping the fact that there's a skills shortage, and companies aren't doing enough to cultivate talent. AI could relieve some of the pressure.
CISOs' Salaries Expected to Edge Above $240,000 in 2018
News  |  9/1/2017  | 
Other IT security professionals may garner six-figure salaries as well, new report shows.
How Effective Boards Drive Security Mandates
Commentary  |  9/1/2017  | 
The focus on cybersecurity policies must be prioritized from the top down.
Verizon Report: Businesses Hit with Payment Card Breaches Not Fully PCI-Compliant
News  |  8/31/2017  | 
Companies struggle to maintain PCI compliance within a year of meeting it, according to a new payment security report by Verizon.
International Firms Struggle to Adapt as China's Cybersecurity Law Takes Shape
Commentary  |  8/31/2017  | 
After the release of new guidelines on critical information infrastructure, international companies are still searching for clarity on how to comply with the country's new cyber regime.
Ransomware is Going More Corporate, Less Consumer
News  |  8/30/2017  | 
Cybercriminals on average charge $544 for ransom per device, signaling a new sweet spot for payouts.
Execs Underestimate Risks to Oracle EBS
News  |  8/30/2017  | 
It's another sign that ERP keeps getting short shrift on the security front.
How Hackers Hide Their Malware: Advanced Obfuscation
Commentary  |  8/30/2017  | 
Hackers continue to develop new ways to break into systems. Here are three of them, along with ways to fight back.
The Active Directory Botnet
The Active Directory Botnet
Dark Reading Videos  |  8/30/2017  | 
It's a nightmare of an implementation error with no easy fix. Ty Miller and Paul Kalinin explain how and why an attacker could build an entire botnet inside your organization.
Shellshock Still in the Crosshairs
News  |  8/29/2017  | 
Spike in scans for the flaw spotted en masse in Q2.
Dark Reading Now HTTPS
Commentary  |  8/29/2017  | 
Moving a site that's more than a decade old to HTTPS has been a journey, and we're almost there.
FBI/IRS-Themed Email Scam Spreads Ransomware
Quick Hits  |  8/29/2017  | 
Fake IRS and FBI emails are circulating on the Internet that attempt to lure victims into downloading malware that will ultimately hold their data hostage.
How Hackers Hide Their Malware: The Basics
Commentary  |  8/29/2017  | 
Malware depends on these four basic techniques to avoid detection.
US CERT Warns of Potential Hurricane Harvey Phishing Scams
Quick Hits  |  8/28/2017  | 
Be wary of malicious emails purportedly tied to the storm, officials say.
Forcepoint Snaps Up RedOwl
Quick Hits  |  8/28/2017  | 
The acquisition aims to bolster Forcepoint's behavioral analytics offerings.
10 Time-Consuming Tasks Security People Hate
Slideshows  |  8/28/2017  | 
Whether it is dealing with false positives, reporting to auditors, or patching software, here's the scut work security people dread.
New Targeted Ransomware Hits Healthcare, Manufacturing
Quick Hits  |  8/25/2017  | 
A new ransomware strain, Defray, that focuses on certain verticals in narrow and select attacks is making the rounds in the healthcare, education, manufacturing, and technology sectors.
Turning Sound Into Keystrokes: Skype & Type
Turning Sound Into Keystrokes: Skype & Type
Dark Reading Videos  |  8/25/2017  | 
Don't let your fingers do the talking in a Skype session. The callers on the other end could know what you're writing, researcher Daniele Lain explains.
Apple iOS Exploit Takes Complete Control of Kernel
News  |  8/24/2017  | 
Researcher demonstrates 'severe' ZIVA exploit at Hack in the Box.
Page 1 / 2   >   >>


1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The Dark Reading Security Spending Survey
The Dark Reading Security Spending Survey
Enterprises are spending an unprecedented amount of money on IT security where does it all go? In this survey, Dark Reading polled senior IT management on security budgets and spending plans, and their priorities for the coming year. Download the report and find out what they had to say.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.