Vulnerabilities / Threats

1/10/2008
07:55 AM
50%
50%

Hacking and the Academy Awards

Fortify Software documentary illustrates impact of cybercrime on consumers, business

5:55 PM -- Is hacking becoming, well, telegenic? First we saw CourtTV's "Tiger Team" reality TV program (see The Perfect Jewelry Heist and Pen Testing Goes Reality TV), and now the upcoming screening (yes, an actual screening) of a documentary called "The New Face of Cybercrime,” filmed by Academy Award-nominated filmmaker Frederic Golding.

Fortify Software, which hired Golding for the production, has released a trailer on YouTube of the approximately 30-minute film, which looks at cybercrime's impact on consumers and businesses.

Judging from the trailer, it's a slick production, with some impressive industry, government, and business personalities weighing in on the cybercrime evolution, including firewall pioneer Marcus Ranum; James Routh, CISO of The Depository Trust & Clearing Corp.; Air Force Col. Jeff Salyards, director of the Defense Computer Forensics Laboratory; and Mike Ullman, chairman and CEO of JC Penney.

Cigital CTO Gary McGraw is also interviewed in the film, and the trailer includes RSnake (aka Robert Hansen, founder of SecTheory) showing how he can inject "anything" he wants onto the domains.aol.com page due to a cross-site scripting flaw on it.

"It's amazing the number of folks we were able to get to open up about this [cybercrime] topic," says Clark Newby, vice president of marketing for Fortify. "The story had not been all told together and put in front of folks... so that people can really get an understanding of what's going on inside the hacker ecology."

Newby says no bad guys appear in the film, but he hinted that some may have served as off-camera sources. "They're not in the film. I'll just say that," he says.

(Neither is our telegenic site editor, Tim Wilson, who filmed a segment with Golding that apparently ended up on the cutting-room floor. Star quality is tough to define.)

There are no plans for a Hollywood premiere of "The New Face of Cybercrime." Fortify will post portions of the film on its Website, as well as provide copies to its customers and business partners.

"Our goal is to educate folks about the threat and challenges," Newby says. The invitation-only screenings will be held in San Francisco, New York, and London.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • Fortify Software Inc.
  • Cigital Inc.

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Threaded  |  Newest First  |  Oldest First
    New Free Tool Scans for Chrome Extension Safety
    Dark Reading Staff 2/21/2019
    Making the Case for a Cybersecurity Moon Shot
    Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    5 Emerging Cyber Threats to Watch for in 2019
    Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
    Flash Poll
    How Enterprises Are Attacking the Cybersecurity Problem
    How Enterprises Are Attacking the Cybersecurity Problem
    Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-6485
    PUBLISHED: 2019-02-22
    Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5...
    CVE-2019-9020
    PUBLISHED: 2019-02-22
    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc...
    CVE-2019-9021
    PUBLISHED: 2019-02-22
    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file...
    CVE-2019-9022
    PUBLISHED: 2019-02-22
    An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parser...
    CVE-2019-9023
    PUBLISHED: 2019-02-22
    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcom...