News & Commentary

Latest Content tagged with Application Security
Page 1 / 2   >   >>
Businesses Manage 9.7PB of Data but Struggle to Protect It
News  |  3/21/2019  | 
What's more, their attempts to secure it may be putting information at risk, a new report finds.
Facebook Employees for Years Could See Millions of User Passwords in Plain Text
Quick Hits  |  3/21/2019  | 
2,000 Facebook engineers or developers reportedly made some nine million internal queries for data elements with plain text passwords.
Google Photos Bug Let Criminals Query Friends, Location
News  |  3/20/2019  | 
The vulnerability, now patched, let attackers query where, when, and with whom victims' photos were taken.
'Critical' Denial-of-Service Bug Patched in Facebook Fizz
Quick Hits  |  3/20/2019  | 
Researchers report a now-patched DoS vulnerability in Facebook Fizz, its open source implementation of the TLS protocol.
6 Ways Mature DevOps Teams Are Killing It in Security
Slideshows  |  3/19/2019  | 
New survey shows where "elite" DevOps organizations are better able to incorporate security into application security.
7 Low-Cost Security Tools
Slideshows  |  3/15/2019  | 
Security hardware doesn't have to be expensive or complex to do the job. Here are seven examples of low-cost hardware that could fill a need in your security operations.
US Prosecutors Investigate Facebook's Data-Sharing Deals
Quick Hits  |  3/14/2019  | 
The news follows a long, tumultuous period of scandal around Facebook and its privacy practices.
'SimBad': Android Adware Hits 210 Apps with 150M Downloads
Quick Hits  |  3/13/2019  | 
Google has removed infected applications from the Google Play store after a form of adware potentially affected millions of users.
The Case for Transparency in End-User License Agreements
Commentary  |  3/13/2019  | 
Why it behooves technology companies to consider EULAs as an opportunity to accurately inform customers about privacy issues and other important information.
There May Be a Ceiling on Vulnerability Remediation
News  |  3/12/2019  | 
Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.
Citrix Breach Underscores Password Perils
News  |  3/12/2019  | 
Attackers used a short list of passwords to knock on every digital door to find vulnerable systems in the vendor's network.
Microsoft Patch Tuesday: 64 Vulnerabilities Patched, 2 Under Attack
News  |  3/12/2019  | 
Seventeen vulnerabilities patches today are rated critical, four are publicly known, and two have been exploited in the wild.
How the Best DevSecOps Teams Make Risk Visible to Developers
News  |  3/12/2019  | 
DevOps-minded CISOs say enterprise security teams need to do a better job scoring and visualizing risk for developers and business executives.
5 Essentials for Securing and Managing Windows 10
Commentary  |  3/12/2019  | 
It's possible to intelligently deploy and utilize Windows 10's many security enhancements while avoiding common and costly migration pitfalls.
763M Email Addresses Exposed in Latest Database Misconfiguration Episode
News  |  3/11/2019  | 
MongoDB once again used by database admin who opens unencrypted database to the whole world.
Hackers Break into System That Houses College Application Data
Quick Hits  |  3/11/2019  | 
More than 900 colleges and universities use Slate, owned by Technolutions, to collect and manage information on applicants.
Citrix Hacked by 'International Cybercriminals'
Quick Hits  |  3/8/2019  | 
FBI informed Citrix this week of a data breach that appears to have begun with a 'password spraying' attack to steal weak credentials to access the company's network.
Debunking 5 Myths About Zero Trust Security
Commentary  |  3/7/2019  | 
Rather than "trust but verify," a zero trust model assumes that attackers will inevitably get in if they aren't already. However, several misconceptions are impeding its adoption.
4 Ways At-Work Apps Are Vulnerable to Attack
Commentary  |  3/7/2019  | 
Collaboration applications make users and IT teams more efficient. But they come with an added cost: security.
Code42: Data Loss Protection is the New DLP
Code42: Data Loss Protection is the New DLP
Dark Reading Videos  |  3/7/2019  | 
Data loss protection helps companies get more proactive than data loss prevention and will help customers in an era of Big Data, says Vijay Ramanathan of Code 42. Data loss protection helps with both time to awareness and time to response; its reliance on automation also means greater volumes of data can be managed.
Lockpath Advocates Benefits of Continuous Security Management
Lockpath Advocates Benefits of Continuous Security Management
Dark Reading Videos  |  3/6/2019  | 
Risk management and compliance technologies emerge from the intersection of technology, security, and regulation; continuous security management helps professionals from multiple departments and disciplines access the info they need, when they need it, according to Sam Abadir of Lockpath.
NTT Security Confirms WhiteHat Acquisition
Quick Hits  |  3/6/2019  | 
WhiteHat Security will continue to operate as an independent subsidiary of NTT Security following the deal.
Consumers Care About Privacy, but Not Enough to Act on It
News  |  3/5/2019  | 
People claim to value data privacy and don't trust businesses to protect them but most fail to protect themselves.
Trust, or Lack of It, Is a Key Theme on RSAC Keynote Stage
News  |  3/5/2019  | 
Neither machines nor humans might be entirely trustworthy, but the cooperation of the two might be the answer to issues of misinformation, deep fake videos, and other issues of trust, say security leaders.
Artificial Intelligence: The Terminator of Malware
Commentary  |  3/5/2019  | 
Is it possible that the combination of AI, facial recognition, and the coalescence of global mass-hack data could lead us toward a Skynet-like future?
Startup Armor Scientific Launches Multifactor Identity System
News  |  3/4/2019  | 
Company aims to replace usernames and passwords by combining GPS location, biometrics, and keys issued through a blockchain-based network.
Security Pros Agree: Cloud Adoption Outpaces Security
News  |  3/1/2019  | 
Oftentimes, responsibility for securing the cloud falls to IT instead of the security organization, researchers report.
Data Leak Exposes Dow Jones Watchlist Database
Quick Hits  |  2/28/2019  | 
The Watchlist, which contained the identities of government officials, politicians, and people of political interest, is used to identify risk when researching someone.
Intel Focuses on Data Center, Firmware Security Ahead of RSAC
News  |  2/27/2019  | 
The new Intel SGX Card is intended to extend application memory security using Intel SGX in existing data center infrastructure.
Stay Ahead of the Curve by Using AI in Compliance
Commentary  |  2/27/2019  | 
Although human oversight is required, advanced technologies built on AI will become pivotal in building safer financial markets and a safer world.
Whose Line Is It? When Voice Phishing Attacks Get Sneaky
News  |  2/27/2019  | 
Researchers investigate malicious apps designed to intercept calls to legitimate numbers, making voice phishing attacks harder to detect.
Embracing DevSecOps: 5 Processes to Improve DevOps Security
Commentary  |  2/27/2019  | 
In the cyber threat climate of the 21st century, sticking with DevOps is no longer an option.
Researchers Build Framework for Browser-Based Botnets
News  |  2/26/2019  | 
HTML5 used to build persistent malware on victims' computers.
Kenna Security and Sonatype Partner for Open Source Vulnerability Intelligence
Quick Hits  |  2/26/2019  | 
The pairing brings Sonatype data on open source components to the Kenna Security platform.
Attackers Continue to Focus on Users, Well-Worn Techniques
News  |  2/26/2019  | 
From WannaCry and phishing to credential stuffing and cryptomining, attackers relied on many oldie-but-goodie attacks in 2018, according to a pair of new security threat reports.
New Arm Certification Aims to Secure IoT Devices
News  |  2/25/2019  | 
A three-tier certification regimen shows adherence to the Platform Security Architecture.
Russian Hacker Pleads Guilty to Bank Fraud
Quick Hits  |  2/25/2019  | 
The hacker ran a botnet that spread 'NeverQuest' malware for three years and collected millions of banking credentials.
Lessons From the War on Malicious Mobile Apps
News  |  2/22/2019  | 
Despite the openness of the Android platform, Google has managed to keep its Play store mainly free of malware and malicious apps. Outside of the marketplace is a different matter.
New Malware Campaign Targets Job Seekers
Quick Hits  |  2/22/2019  | 
LinkedIn profiles provide a persistent, patient threat actor with the information required to craft spear-phishing messages.
6 Tips for Getting the Most from Your VPN
Slideshows  |  2/22/2019  | 
VPNs are critical for information security. But simply having these cozy security tunnels in the toolkit isn't enough to keep an organization's data safe.
New Free Tool Scans for Chrome Extension Safety
Quick Hits  |  2/21/2019  | 
CRXcavator scans extensions in real time based on factors including permissions, external calls, and third-party libraries.
As Businesses Move Critical Data to Cloud, Security Risks Abound
News  |  2/20/2019  | 
Companies think their data is safer in the public cloud than in on-prem data centers, but the transition is driving security issues.
Mastercard, GCA Create Small Business Cybersecurity Toolkit
News  |  2/20/2019  | 
A new toolkit developed by the Global Cybersecurity Alliance aims to give small businesses a cookbook for better cybersecurity.
POS Vendor Announces January Data Breach
Quick Hits  |  2/20/2019  | 
More than 120 restaurants were affected by an incident that exposed customer credit card information.
The Anatomy of a Lazy Phish
Commentary  |  2/20/2019  | 
A security engineer breaks down how easy it is for unskilled attackers to trick an unsuspecting user to submit credentials to a phishing site.
Breach in Stanford System Exposes Student Records
Quick Hits  |  2/19/2019  | 
A wide variety of data was visible through the vulnerability.
Palo Alto Networks to Buy Demisto for $560M
Quick Hits  |  2/19/2019  | 
This marks Palo Alto Networks' latest acquisition and its first of 2019.
Hackers Found Phishing for Facebook Credentials
Quick Hits  |  2/15/2019  | 
A "very realistic-looking" login prompt is designed to capture users' Facebook credentials, researchers report.
Staffing Shortage Makes Vulnerabilities Worse
Quick Hits  |  2/15/2019  | 
Businesses don't have sufficient staff to find vulnerabilities or protect against their exploit, according to a new report by Ponemon Institute.
Post-Quantum Crypto Standards Arent All About the Math
News  |  2/15/2019  | 
The industry needs to keep in mind the realities of hardware limits and transitional growing pains, according to Microsoft, Utimaco researchers.
Page 1 / 2   >   >>


Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVE-2019-9977
PUBLISHED: 2019-03-24
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
CVE-2019-9962
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
CVE-2019-9963
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.
CVE-2019-9964
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey.