Attacks/Breaches
News & Commentary
Attack Campaign Targets Facebook, Dropbox User Credentials
Brian Prince, Contributing Writer, Dark ReadingNews
The goal of the attackers is not fully clear but the credential theft could set up sophisticated targeted attackers.
By Brian Prince Contributing Writer, Dark Reading, 7/11/2014
Comment1 Comment  |  Read  |  Post a Comment
Strategic Security: Begin With The End In Mind
Jason Sachowski, Sr. Manager, Security R&D, ScotiabankCommentary
The trouble with traditional infosec methodology is that it doesn’t show us how to implement a strategic security plan in the real world.
By Jason Sachowski Sr. Manager, Security R&D, Scotiabank, 7/11/2014
Comment1 Comment  |  Read  |  Post a Comment
Global Law Enforcement, Security Firms Team Up, Take Down Shylock
Sara Peters, News
À la GOZeuS, an international, public-private collaboration seizes a banking Trojan's command and control servers.
By Sara Peters , 7/10/2014
Comment1 Comment  |  Read  |  Post a Comment
Cloud & The Fuzzy Math of Shadow IT
Krishna Narayanaswamy, Founder & Chief Scientist, NetskopeCommentary
Do you know how many cloud apps, on average, are running in your organization? The number is probably greater than you think.
By Krishna Narayanaswamy Founder & Chief Scientist, Netskope, 7/10/2014
Comment9 comments  |  Read  |  Post a Comment
Chinese Hackers Target Logistics & Shipping Firms With Poisoned Inventory Scanners
Kelly Jackson Higgins, Senior Editor, Dark ReadingNews
'ZombieZero' still actively pushing rigged handheld scanning devices, reviving concerns of doing business with Chinese tech companies.
By Kelly Jackson Higgins Senior Editor, Dark Reading, 7/10/2014
Comment5 comments  |  Read  |  Post a Comment
BrutPOS Botnet Targets Retail's Low-Hanging Fruit
Sara Peters, News
FireEye discovers a botnet that's going after point-of-sale systems showing bad passwords and other basic security no-nos.
By Sara Peters , 7/9/2014
Comment4 comments  |  Read  |  Post a Comment
6 Things That Stink About SSL
Sara Peters,
Users might not care to trust the very mechanism that's supposed to provide online trust.
By Sara Peters , 7/9/2014
Comment8 comments  |  Read  |  Post a Comment
Retro Macro Viruses: They're Baaack
Kevin Casey, Commentary
Malicious Virtual Basic for Applications (VBA) macros are back, this time using social engineering to trick users into opening infected attachments, says Sophos.
By Kevin Casey , 7/9/2014
Comment2 comments  |  Read  |  Post a Comment
Facebook Helps Cripple Greek Botnet
Kelly Jackson Higgins, Senior Editor, Dark ReadingNews
Arrests made in Lecpetex malware campaign that was spreading via Facebook, emails.
By Kelly Jackson Higgins Senior Editor, Dark Reading, 7/8/2014
Comment14 comments  |  Read  |  Post a Comment
Dark Reading Radio: The Changing Role Of The CSO
Marilyn Cohodas, Community Editor, Dark ReadingCommentary
Why does the CSO report to the CIO? Join us for a panel discussion. Showtime is today, Wednesday, 1:00 p.m., New York, 10 a.m., San Francisco.
By Marilyn Cohodas Community Editor, Dark Reading, 7/8/2014
Comment8 comments  |  Read  |  Post a Comment
Retail Breaches Change Customer Behavior, Attitudes, Studies Say
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Recent breaches of retail and credit card data are making customers think twice about where they shop and how they pay, researchers say
By Tim Wilson Editor in Chief, Dark Reading, 7/3/2014
Comment4 comments  |  Read  |  Post a Comment
CosmicDuke: Cosmu & MiniDuke Mash-Up
Sara Peters, News
F-Secure believes that the combo malware might have connections to the perpetrators of the miniDuke attacks.
By Sara Peters , 7/2/2014
Comment1 Comment  |  Read  |  Post a Comment
Hacker Movies We Love & Hate
Marilyn Cohodas, Community Editor, Dark Reading
Check out Dark Reading community members' favorite hacker movie hits and misses. Then add your picks in the comments section.
By Marilyn Cohodas Community Editor, Dark Reading, 7/1/2014
Comment3 comments  |  Read  |  Post a Comment
How Microsoft Cracks The BYOD Code: 3 Tips
Bret Arsenault, CISO, MicrosoftCommentary
Microsoft’s CISO shares best-practices for balancing employee autonomy and security in today’s bring-your-own world.
By Bret Arsenault CISO, Microsoft, 6/30/2014
Comment5 comments  |  Read  |  Post a Comment
3 Mobile Security Tips For SMBs
Vijay Basani, Co-Founder, President & CEO, EIQ NetworksCommentary
Everyone in an organization has to work together to combat intrusions and data loss, but this is especially true for small businesses.
By Vijay Basani Co-Founder, President & CEO, EIQ Networks, 6/27/2014
Comment5 comments  |  Read  |  Post a Comment
As Stuxnet Anniversary Approaches, New SCADA Attack Is Discovered
Sara Peters, News
F-Secure has unearthed a new attack against industrial control systems that goes after European targets, using rare infection vectors.
By Sara Peters , 6/26/2014
Comment4 comments  |  Read  |  Post a Comment
Why A Secured Network Is Like The Human Body
Dan Ross, CEO & President, PromisecCommentary
It’s time to throw away the analogies about building fortresses and perimeter defenses and start to approach InfoSec with the same standard of care we use for public health.
By Dan Ross CEO & President, Promisec, 6/26/2014
Comment11 comments  |  Read  |  Post a Comment
Montana Health Department Hacked
Alison Diana, Senior EditorCommentary
State of Montana notifies 1.3 million patients of breach to Department of Public Health and Human Services server.
By Alison Diana Senior Editor, 6/25/2014
Comment12 comments  |  Read  |  Post a Comment
Luuuk Stole Half-Million Euros in One Week
Sara Peters, News
A man-in-the-browser and a big team of money mules quickly, systematically robbed 190 account holders at a European bank.
By Sara Peters , 6/25/2014
Comment8 comments  |  Read  |  Post a Comment
Crowdsourcing & Cyber Security: Who Do You Trust?
Robert R. Ackerman Jr., Founder & Managing Director, Allegis CapitalCommentary
A collective security defense can definitely tip the balance in favor of the good guys. But challenges remain.
By Robert R. Ackerman Jr. Founder & Managing Director, Allegis Capital, 6/24/2014
Comment3 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by EffyE925
Current Conversations sent :D
In reply to: Re: :)
Post Your Own Reply
More Conversations
Security Insights
Microsoft, No-IP, And The Need For Clarity
Microsoft, No-IP, And The Need For Clarity
The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.
Comment0 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.