Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in December 2018
Start Preparing Now for the Post-Quantum Future
Commentary  |  12/28/2018  | 
Quantum computing will break most of the encryption schemes on which we rely today. These five tips will help you get ready.
Toxic Data: How 'Deepfakes' Threaten Cybersecurity
Commentary  |  12/27/2018  | 
The joining of 'deep learning' and 'fake news' makes it possible to create audio and video of real people saying words they never spoke or things they never did.
Healthcare Industry Still in Ransomware Crosshairs
Jeffrey Burt  |  12/27/2018  | 
A report by Kaspersky researchers has found that healthcare organizations in the US and Canada are still at heightened risk of ransomware attacks.
3 Steps for Cybersecurity Leaders to Bridge the Gender Equality Gap
Commentary  |  12/26/2018  | 
By encouraging female participation through education and retaining this interest through an inclusive culture and visible role models, we can begin to close the skill and gender gap in cybersecurity.
SOP Story: Why Protecting Web Browsers Remains a Security Cornerstone
Larry Loeb  |  12/24/2018  | 
One of the oldest ways to protect content on the web is SOP. However, it's not always implemented in the same way on all browsers. This can complicate one of the main cornerstones of Internet security.
I Spy: Dark Reading Caption Contest Winners
Commentary  |  12/21/2018  | 
No shortage of political humor and inside security jokes in this batch of cartoon caption contenders. And the winners are ...
Huawei Routers Vulnerable to Simplified Credential Stuffing Attack
Larry Loeb  |  12/21/2018  | 
Security researchers at NewSky have found a vulnerability in Huawei's HG routers that leave these devices open to a brute force attack. The company has been notified, but it's not clear what, if any fix, has been applied.
How to Optimize Security Spending While Reducing Risk
Commentary  |  12/20/2018  | 
Risk scoring is a way of getting everyone on the same page with a consistent, reliable method of gathering and analyzing security data.
2018 In the Rearview Mirror
Commentary  |  12/20/2018  | 
Among this year's biggest news stories: epic hardware vulnerabilities, a more lethal form of DDoS attack, Olympic 'false flags,' hijacked home routers, fileless malware and a new world's record for data breaches.
Automating a DevOps-Friendly Security Policy
Commentary  |  12/20/2018  | 
There can be a clash of missions between security and IT Ops teams, but automation can help.
Cloud Backup: How It Can Protect Against Ransomware
Jeffrey Burt  |  12/20/2018  | 
For enterprises anxious to avoid being extorted by attackers using ransomware, backing up data to the cloud is an option to consider, though it's not the answer for everyone.
Email Spam: Don't Be a Chump or a Jerk
Alan Zeichick  |  12/20/2018  | 
For decades, spam emails have clogged up corporate email inboxes. However, there are some simple rules and guidelines IT pros, as well as marketers, can use to cut down on this, and make everyone more secure.
Privacy Futures: Fed-up Consumers Take Their Data Back
Commentary  |  12/19/2018  | 
In 2019, usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy.
Cybersecurity in 2019: From IoT & Struts to Gray Hats & Honeypots
Commentary  |  12/19/2018  | 
While you prepare your defenses against the next big thing, also pay attention to the longstanding threats that the industry still hasn't put to rest.
Jenkins Flaw Can Allow Attackers to Log In as Admins
Larry Loeb  |  12/19/2018  | 
New research from CyberArk finds a critical flaw in Jenkins servers that can allow an attacker to log in as an administrator, which can lead to any number of compromises and malicious activity.
Many Enterprises Still Blind to Security Risk, Study Finds
Jeffrey Burt  |  12/19/2018  | 
Even as organizations continue to get hit with cyber attacks, they're struggling to accurately measure the costs of such events to their operations, a report by Tenable and the Ponemon Institute found.
Cryptographic Erasure: Moving Beyond Hard Drive Destruction
Commentary  |  12/18/2018  | 
In the good old days, incinerating backup tapes or shredding a few hard drives would have solved the problem. Today, we have a bigger challenge.
How to Engage Your Cyber Enemies
Commentary  |  12/18/2018  | 
Having the right mix of tools, automation, and intelligence is key to staying ahead of new threats and protecting your organization.
Shhhhh! The Secret to Secrets Management
Commentary  |  12/17/2018  | 
Companies need to take a centralized approach to protecting confidential data and assets. Here are 12 ways to get a handle on the problem.
Russian-Backed Sofacy Group Used New Cannon Trojan in Recent Attacks
Larry Loeb  |  12/17/2018  | 
Palo Alto Networks' Unit 42 has documented two months of attacks from the Sofacy group, which also goes by Fancy Bear and APT28. Researchers found the attackers deployed a new Trojan called Cannon.
SQLite Vulnerability Could Put Thousands of Apps at Risk
Larry Loeb  |  12/17/2018  | 
A significant bug in SQLite could allow for remote code execution, leaks of memory and program crashes within thousands of apps, according to new research.
Retailers: Avoid the Hackable Holidaze
Commentary  |  12/14/2018  | 
The most wonderful time of the year? Sure, but not if your business and customers are getting robbed.
Phishing Emails, Trojans Continued to Proliferate in Q3 Report
Larry Loeb  |  12/14/2018  | 
Researchers at Comodo Cybersecurity found that phishing emails continued to proliferate in the third quarter of this year, with PayPal as a major target. Malware, such as Trojans, also remain a top security issue.
Setting the Table for Effective Cybersecurity: 20 Culinary Questions
Commentary  |  12/13/2018  | 
Even the best chefs will produce an inferior product if they begin with the wrong ingredients.
The Economics Fueling IoT (In)security
Commentary  |  12/13/2018  | 
Attackers understand the profits that lie in the current lack of security. That must change.
IoT Botnets Shifting to Exploit Vulnerabilities
Jeffrey Burt  |  12/13/2018  | 
A report from NetScout's ASERT Team finds that IoT devices are vulnerable to exploits for long periods of time and can be attacked within minutes after coming online.
Deception: Honey vs. Real Environments
Commentary  |  12/12/2018  | 
A primer on choosing deception technology that will provide maximum efficacy without over-committing money, time and resources.
Forget Shifting Security Left; It's Time to Race Left
Commentary  |  12/12/2018  | 
Once DevOps teams decide to shift left, they can finally look forward instead of backward.
'Novidade' Exploit Changes DNS Settings in Home & Small Business Routers
Larry Loeb  |  12/12/2018  | 
Trend Micro has picked up on a new exploit dubbed 'Novidade,' which targets small business and home routers and changes their DNS settings to redirect the traffic as part of an attack.
The Grinch Bot Before Christmas: A Security Story for the Holidays
Commentary  |  12/11/2018  | 
Once upon a time, buyers purchased products from certified sellers. Today, hoarders use botnets to amass goods at significant markup for a new gray-market economy.
How Well Is Your Organization Investing Its Cybersecurity Dollars?
Commentary  |  12/11/2018  | 
The principles, methods, and tools for performing good risk measurement already exist and are being used successfully by organizations today. They take some effort -- and are totally worth it.
ESET Researchers Find 12 New Linux Malware Families
Larry Loeb  |  12/11/2018  | 
A report from ESET finds 12 new Linux backdoor malware families in the wild that had previously been undocumented.
M2M Protocols Expose IoT Data, Trend Micro Finds
Jeffrey Burt  |  12/11/2018  | 
The MQTT and CoAP protocols that are crucial to IoT and IIoT operations have significant vulnerabilities that puts devices at risk, according to analysis from Trend Micro.
6 Cloud Security Predictions for 2019
Commentary  |  12/10/2018  | 
How the fast pace of cloud computing adoption in 2018 will dramatically change the security landscape next year.
SD-WAN Security: Why Zero-Trust Authentication Is Key
Alan Zeichick  |  12/10/2018  | 
SD-WAN provides big benefits compared to traditional WAN connections between data centers and remote locations. However, authentication remains a concern. Here's why zero trust is a must.
APTs in 2018: A Mix of Old & New
Jeffrey Burt  |  12/10/2018  | 
Established threat groups and new players alike made for an active APTs scene this year, according to researchers with Kaspersky Lab.
Insider Threats & Insider Objections
Commentary  |  12/7/2018  | 
The tyranny of the urgent and three other reasons why its hard for CISOs to establish a robust insider threat prevention program.
Google Chrome 71: Bugs Squashed & New Ways to Block 'Abusive Experiences'
Larry Loeb  |  12/7/2018  | 
The latest version of the Google Chrome browser squashes numerous bugs and adds in a feature to help block what the company calls 'abusive experiences.'
Bringing Compliance into the SecDevOps Process
Commentary  |  12/6/2018  | 
Application security should be guided by its responsibility to maintain the confidentiality, integrity, and availability of systems and data. But often, compliance clouds the picture.
4 Lessons Die Hard Teaches About Combating Cyber Villains
Commentary  |  12/6/2018  | 
With proper planning, modern approaches, and tools, we can all be heroes in the epic battle against the cyber threat.
Boosting SOC IQ Levels with Knowledge Transfer
Commentary  |  12/6/2018  | 
Despite shortages of skills and staff, these six best practices can improve analysts' performance in a security operations center.
A Shift from Cybersecurity to Cyber Resilience: 6 Steps
Commentary  |  12/5/2018  | 
Getting to cyber resilience means federal agencies must think differently about how they build and implement their systems. Here's where to begin.
The Case for a Human Security Officer
Commentary  |  12/5/2018  | 
Wanted: a security exec responsible for identifying and mitigating the attack vectors and vulnerabilities specifically targeting and involving people.
IT & OT Convergence: a Potential Security Nightmare
Alan Zeichick  |  12/5/2018  | 
Industrial systems are rapidly connecting to the wider, public Internet. There are a host of security problems that comes with this convergence, however, and combing IT and OT is not the cure. Here's why.
Kubernetes Vulnerability Can Turn Containers Into Zombies
Larry Loeb  |  12/4/2018  | 
For years, Kubernetes was considered secure. However, a newly published vulnerability can turn enterprise containers into zombies without proper patching.
5 Emerging Trends in Cybercrime
Commentary  |  12/4/2018  | 
Organizations can start today to protect against 2019's threats. Look out for crooks using AI "fuzzing" techniques, machine learning, and swarms.
Marriott's Due Diligence Failure Led to Massive Data Breach
Larry Loeb  |  12/4/2018  | 
After acquiring Starwood, Marriott failed to conduct a proper review of the company's security issues. This lack of due diligence led directly to 500 million records being compromised in a data breach.
Filling the Cybersecurity Jobs Gap Now and in the Future
Commentary  |  12/3/2018  | 
Employers must start broadening their search for experienced security professionals to include people with the right traits rather than the right skills.
GDPR Fines: Some Bark, Little Bite
Joe Stanganelli  |  12/3/2018  | 
As Security Now says 'Happy Halfiversary' to GDPR, we take a look at what few GDPR fines and other DPA orders and guidance have been made public over the past six months.
Cybercriminal Underground Will Continue to Consolidate in 2019
Jeffrey Burt  |  12/3/2018  | 
There will be fewer malware-as-a-service families, but they will be bigger, stronger and more sophisticated, according to a report from McAfee.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.