Attacks/Breaches
News & Commentary
'Energetic' Bear Under The Microscope
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Kaspersky Lab report finds more industries hit by the infamous cyber espionage campaign -- and evidence pointing to French and Swedish-speaking attackers as well as Eastern European ones.
By Kelly Jackson Higgins Senior Editor, Dark Reading, 7/31/2014
Comment0 comments  |  Read  |  Post a Comment
USB Hardware Easily Subverted, Researchers Claim
Thomas Claburn, Editor-at-LargeCommentary
Security researchers say they can reprogram USB controller chips to hijack USB devices and connected computers.
By Thomas Claburn Editor-at-Large, 7/31/2014
Comment10 comments  |  Read  |  Post a Comment
InfoSec’s Holy Grail: Data Sharing & Collaboration
Levi Gundert, Technical Lead, Cisco Threat Research, Analysis, and Communications (TRAC)Commentary
Despite all the best intentions, cooperation around Internet security is a still a work in progress. Case in point: Microsoft’s unilateral action against No-IP.
By Levi Gundert Technical Lead, Cisco Threat Research, Analysis, and Communications (TRAC), 7/31/2014
Comment0 comments  |  Read  |  Post a Comment
Phishing: What Once Was Old Is New Again
Dave Kearns, Analyst, Kuppinger-ColeCommentary
I used to think the heyday of phishing had passed. But as Symantec notes in its 2014 Internet Security Threat Report, I was wrong!
By Dave Kearns Analyst, Kuppinger-Cole, 7/30/2014
Comment10 comments  |  Read  |  Post a Comment
The Perfect InfoSec Mindset: Paranoia + Skepticism
Corey Nachreiner, Director, Security Strategy & Research, WatchGuard TechnologiesCommentary
A little skeptical paranoia will ensure that you have the impulse to react quickly to new threats while retaining the logic to separate fact from fiction.
By Corey Nachreiner Director, Security Strategy & Research, WatchGuard Technologies, 7/29/2014
Comment5 comments  |  Read  |  Post a Comment
Internet of Things: 4 Security Tips From The Military
Michael K. Daly, CTO, Cybersecurity & Special Missions, Raytheon Intelligence, Information & ServicesCommentary
The military has been connecting mobile command posts, unmanned vehicles, and wearable computers for decades. It’s time to take a page from their battle plan.
By Michael K. Daly CTO, Cybersecurity & Special Missions, Raytheon Intelligence, Information & Services, 7/25/2014
Comment13 comments  |  Read  |  Post a Comment
Cyber Attacks Happen: Build Resilient Systems
Rutrell Yasin, Freelance WriterCommentary
You can't stop all attacks or build the perfect defense system. The higher-level objective is resilience.
By Rutrell Yasin , 7/25/2014
Comment9 comments  |  Read  |  Post a Comment
Travel Agency Fined £150,000 For Violating Data Protection Act
Sara Peters, News
That'll teach them not to retain credit card data in perpetuity.
By Sara Peters , 7/24/2014
Comment1 Comment  |  Read  |  Post a Comment
Passwords Be Gone! Removing 4 Barriers To Strong Authentication
Phillip M. Dunkelberger, President & CEO, Nok Nok LabsCommentary
As biometric factors become more prevalent on mobile devices, FIDO Alliance standards will gain traction as an industry-wide authentication solution.
By Phillip M. Dunkelberger President & CEO, Nok Nok Labs, 7/24/2014
Comment9 comments  |  Read  |  Post a Comment
7 Arrested, 3 More Indicted For Roles In Cyber Fraud Ring That Stung StubHub
Sara Peters, News
Arrests made in New York state, London, Toronto, and Spain for money laundering, grand larceny, and using StubHub customers' credit cards to buy and sell 3,500 e-tickets to prime events.
By Sara Peters , 7/23/2014
Comment3 comments  |  Read  |  Post a Comment
RAM Scraper Malware: Why PCI DSS Can't Fix Retail
Brian Riley, Technical Director, Government Programs, Green Hills SoftwareCommentary
There is a gaping hole in the pre-eminent industry security standard aimed at protecting customers, credit card and personal data
By Brian Riley Technical Director, Government Programs, Green Hills Software, 7/23/2014
Comment8 comments  |  Read  |  Post a Comment
Dark Reading Radio: The Winners & Losers of Botnet Takedowns
Sara Peters, Commentary
Our guests are Cheri McGuire, VP of global government affairs and cyber security policy for Symantec, and Craig D. Spiezle, executive director and founder of the Online Trust Alliance.
By Sara Peters , 7/23/2014
Comment0 comments  |  Read  |  Post a Comment
Nigerian 419 Scammers Evolving Into Malware Pushers (But Not Very Good Ones)
Sara Peters, Quick Hits
"Silver Spaniel" attacks use commodity malware to damage others' security, but they aren't very good at protecting their own.
By Sara Peters , 7/22/2014
Comment10 comments  |  Read  |  Post a Comment
Hidden iOS Services Bypass Security
Thomas Claburn, Editor-at-LargeCommentary
A computer researcher asks why Apple allows undocumented services to bypass encryption and access user data.
By Thomas Claburn Editor-at-Large, 7/21/2014
Comment13 comments  |  Read  |  Post a Comment
Don't Overestimate EMV Protections, Underestimate Card Thief Sophistication
Ericka Chickowski, Contributing Writer, Dark ReadingNews
At Black Hat, an AccessData researcher will offer up a crash course in card payment tech and protections to root out security community misconceptions
By Ericka Chickowski Contributing Writer, Dark Reading, 7/21/2014
Comment2 comments  |  Read  |  Post a Comment
Internet of Things: Security For A World Of Ubiquitous Computing
Candace Worley, SVP & GM, Endpoint Security, McAfeeCommentary
Endpoint security is hardly dead, and claiming that it is oversimplifies the challenges corporations face now and in the not-very-distant future.
By Candace Worley SVP & GM, Endpoint Security, McAfee, 7/21/2014
Comment5 comments  |  Read  |  Post a Comment
CEO Report Card: Low Grades for Risk Management
Marilyn Cohodas, Community Editor, Dark ReadingCommentary
Dark Reading's latest community poll shows a stunning lack of confidence in chief execs' commitment to cyber security.
By Marilyn Cohodas Community Editor, Dark Reading, 7/18/2014
Comment12 comments  |  Read  |  Post a Comment
Government-Grade Stealth Malware In Hands Of Criminals
Sara Peters, News
"Gyges" can be bolted onto other malware to hide it from anti-virus, intrusion detection systems, and other security tools.
By Sara Peters , 7/17/2014
Comment13 comments  |  Read  |  Post a Comment
Website Hacks Dropped During World Cup Final
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Hackers apparently took time off to watch the Germany-Argentina title match of the 2014 FIFA World Cup.
By Kelly Jackson Higgins Senior Editor, Dark Reading, 7/17/2014
Comment15 comments  |  Read  |  Post a Comment
A New Age in Cyber Security: Public Cyberhealth
Brian Foster, CTO, DamballaCommentary
The cleanup aimed at disrupting GameOver Zeus and CryptoLocker offers an instructive template for managing mass cyber infections.
By Brian Foster CTO, Damballa, 7/17/2014
Comment5 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Security Insights
Microsoft, No-IP, And The Need For Clarity
Microsoft, No-IP, And The Need For Clarity
The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.
Comment0 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio