Vulnerabilities / Threats

1/10/2008
07:55 AM
50%
50%

Hacking and the Academy Awards

Fortify Software documentary illustrates impact of cybercrime on consumers, business

5:55 PM -- Is hacking becoming, well, telegenic? First we saw CourtTV's "Tiger Team" reality TV program (see The Perfect Jewelry Heist and Pen Testing Goes Reality TV), and now the upcoming screening (yes, an actual screening) of a documentary called "The New Face of Cybercrime,” filmed by Academy Award-nominated filmmaker Frederic Golding.

Fortify Software, which hired Golding for the production, has released a trailer on YouTube of the approximately 30-minute film, which looks at cybercrime's impact on consumers and businesses.

Judging from the trailer, it's a slick production, with some impressive industry, government, and business personalities weighing in on the cybercrime evolution, including firewall pioneer Marcus Ranum; James Routh, CISO of The Depository Trust & Clearing Corp.; Air Force Col. Jeff Salyards, director of the Defense Computer Forensics Laboratory; and Mike Ullman, chairman and CEO of JC Penney.

Cigital CTO Gary McGraw is also interviewed in the film, and the trailer includes RSnake (aka Robert Hansen, founder of SecTheory) showing how he can inject "anything" he wants onto the domains.aol.com page due to a cross-site scripting flaw on it.

"It's amazing the number of folks we were able to get to open up about this [cybercrime] topic," says Clark Newby, vice president of marketing for Fortify. "The story had not been all told together and put in front of folks... so that people can really get an understanding of what's going on inside the hacker ecology."

Newby says no bad guys appear in the film, but he hinted that some may have served as off-camera sources. "They're not in the film. I'll just say that," he says.

(Neither is our telegenic site editor, Tim Wilson, who filmed a segment with Golding that apparently ended up on the cutting-room floor. Star quality is tough to define.)

There are no plans for a Hollywood premiere of "The New Face of Cybercrime." Fortify will post portions of the film on its Website, as well as provide copies to its customers and business partners.

"Our goal is to educate folks about the threat and challenges," Newby says. The invitation-only screenings will be held in San Francisco, New York, and London.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • Fortify Software Inc.
  • Cigital Inc.

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Threaded  |  Newest First  |  Oldest First
    Higher Education: 15 Books to Help Cybersecurity Pros Be Better
    Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
    'PowerSnitch' Hacks Androids via Power Banks
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
    6 CISO Resolutions for 2019
    Ericka Chickowski, Contributing Writer, Dark Reading,  12/10/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: When Harry Met Sally
    Current Issue
    10 Best Practices That Could Reshape Your IT Security Department
    This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
    Flash Poll
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-7690
    PUBLISHED: 2018-12-13
    A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
    CVE-2018-7691
    PUBLISHED: 2018-12-13
    A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
    CVE-2018-8033
    PUBLISHED: 2018-12-13
    The OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitati...
    CVE-2018-20127
    PUBLISHED: 2018-12-13
    An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
    CVE-2018-20128
    PUBLISHED: 2018-12-13
    An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.