Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in February 2011
Sophisticated Trojan Targets Some Banking Sites
Commentary  |  2/28/2011  | 
S21sec, a Spanish information security firm, claims to have spotted a new Trojan with advanced infiltration and attack techniques.
New Mac OS X Backdoor Trojan Surfaces
Commentary  |  2/27/2011  | 
Researchers at anti-virus firm Sophos say they've identified a new Trojan designed to infect Mac OS X users.
The Power Of Open-Source Security Tools
Commentary  |  2/25/2011  | 
Free, open-source tools like the Metasploit Framework and w3af exemplify the power of community involvement and support
The Downsides Of OpenFCoE
Commentary  |  2/25/2011  | 
A few weeks ago I wrote an entry about software based Fibre Channel over Ethernet (FCoE) called Open FCoE being offered by Intel. The immediate responses were questions asking if this is a sign of the end for the hardware based HBA providers? Open FCoE has a lot of promise but the downsides of OpenFCoE prove that it may not be for everyone.
DAM Market Observation
Commentary  |  2/24/2011  | 
Despite talk about the lack of innovation in the data security market, excellent technologies like DAM and DLP have been available for years before customers embraced them
FileMaker For Securing iPads At Work
Commentary  |  2/24/2011  | 
Rather than just saying "no" to the iPad at the office, consider this inexpensive way to secure these tablets
Security Departments Stretched Too Thin, Firefighting
Commentary  |  2/24/2011  | 
While application vulnerabilities, mobile computing, and malware top the list of IT security vulnerabilities and threats, a just released survey from ISC2 and Frost & Sullivan reveals an underlying, more systemic threat.
Clearing The Air On DAM
Commentary  |  2/23/2011  | 
There are two very important things to understand: First, a database firewall and a database activity monitor (DAM) are exactly the same things! Second, a database firewall can upset normal IT operations
Schwartz On Security: Security Pros' Top 2011 Threats
Commentary  |  2/23/2011  | 
While application vulnerabilities and mobile devices lead the list, perhaps it's also time to tackle security's impact on productivity.
Another Side Of B-Sides
Commentary  |  2/23/2011  | 
The "unconference" across the street from the RSA show in San Francisco last week was shaped, in part, by recent security events
Solving Scale Out Storage's Dark Side
Commentary  |  2/22/2011  | 
In a recent entry we discussed a concern with scale out storage, making sure the utilization of processing, power and resources remains efficient. The last thing you want is a storage system that, while it can scale to limitless capacity, also requires limitless power and data center floor space? The good news is that some vendors are aware of these concerns and have some solutions for you to consider.
Using HVAC To Set Up A Hack
Commentary  |  2/22/2011  | 
Social engineering caper begins with posing as heating ventilation and air conditioning repairmen
Researchers: SSD Drives Pose Data Sanitation Risk
Commentary  |  2/22/2011  | 
Researchers from the University of California, San Diego are warning that traditional methods to clear data from hard drives may not work as well on Solid State Disks.
Security Coming To Mobile And Embedded Devices
Commentary  |  2/21/2011  | 
Security firm McAfee expects 50 billion mobile and connected embedded devices by the year 2020. And guess who is promoting new tools promising to protect them. But is this a layer of protection we are going to need?
Hacks From China Strike Canadian Government
Commentary  |  2/20/2011  | 
CBC is reporting that attacks from IP addresses based in China have managed to successfully breach networks within the Finance and the Treasury Board of Canada, as well as Defence Research and Development Canada. The attack is the latest in a string of attacks aimed at high level government agencies.
RSA: The Saw Six Of Tradeshows
Commentary  |  2/18/2011  | 
Predictably scary, RSA offers a glimpse into the latest threats and security challenges. In this sequel, social engineering goes after social networking in a big way.
Cyberwar: Experts Have Hard Time Defining It, Let Alone Defending Against It
Commentary  |  2/17/2011  | 
Rather than wait for a catastrophic event, government and private industry should develop a framework for dealing with state sponsored attacks aimed at the critical infrastructure.
RSA: Microsoft vs. Google--Mobile vs. Cloud--Anonymous vs. HBGary Inc.
Commentary  |  2/17/2011  | 
RSA has turned out to be an historic event this year showcasing massive industry change from traditional platforms to mobile devices and cloud computing, Google’s replacement of Microsoft as the most targeted vendor, and the drift of the vigilante group Anonymous towards the dark side.
Building Storage Proof Applications
Commentary  |  2/17/2011  | 
A storage system failure where more drives have failed then the RAID protection scheme will cover you from or where the storage software itself has crashed is a disaster. The amount of work required to return the system to service can be daunting and applications are likely to experience downtime, in some cases that time can be significant. We have to start working on building storage proof applications.
Schwartz On Security: Unraveling Night Dragon Attacks
Commentary  |  2/16/2011  | 
Attacks launched from China against oil and gas companies used simple hacking tools and even legitimate software.
Successful Security: It Is In The Details
Commentary  |  2/15/2011  | 
Security is both hard to do right, and easy to make the simple mistakes that could jeopardize the security of most any organization. It may be a mistake that comprises of being a single digit off. And that one number could be the difference between a secure network and one that is readily breached. That was the overriding message in a Security B-Sides Conference presentation given today by Mike Lloyd, chief scientist at security software maker Red Seal Systems.
Flip On Over To B-Sides
Commentary  |  2/14/2011  | 
With RSA kicking off on Tuesday, you may be asking yourself, What's to do on Monday in San Francisco?
3 Startups To See At RSA
Commentary  |  2/14/2011  | 
Over the past few months I've used my highly unscientific methods to identify new security startups I believe are worth watching over the next 12 months. These companies are solving problems for enterprises in various spaces. Each is worth reaching out to if you are attending RSA or BSides in San Francisco this week.
Think That iPhone Isn't A Corporate Security Risk?
Commentary  |  2/11/2011  | 
If so, you had better think again. Researchers have shown how the passwords on the iPhone can be revealed in less than six minutes.
Does Scale Out Storage Have A Dark Future?
Commentary  |  2/10/2011  | 
Scale Out Storage, also called Clustered Storage or Grid Storage, are storage systems that claim to achieve near limitless scale and performance by adding nodes to a storage platform when you need more performance or capacity. The storage industry, not necessarily the user community, is stumbling over itself to have a product offering in this space. There is a lot to like about the scale out storage model but it does have its downsides.
Securing Databases In The Cloud: Part 2
Commentary  |  2/10/2011  | 
Moving databases into the cloud can save you money and simplify administration, but always introduces new security challenges
Frequency Hopping Spread Spectrum, Project Ubertooth Detailed At ShmooCon
Commentary  |  2/10/2011  | 
Two new wireless security projects discussed at ShmooCon focus on bringing low-cost hardware to security researchers
Schwartz On Security: Big Bang Botnets Sometimes Self-Defeating
Commentary  |  2/9/2011  | 
Do crimeware toolkits, SCADA malware, and spam-spewing worms become too big not to fail?
What If FCoE Were Free?
Commentary  |  2/8/2011  | 
Intel recently announced Open FCoE, a software implementation of the Fibre Channel over Ethernet (FCoE) protocol that had only previously been available in expensive Converged Network Adapters (CNA) desinged to work on standard Ethernet hardware. Assuming that you use 10GbE LAN on Motherboard (LOM), which we discussed in our
Nasdaq Hack. Lots of Questions. Few Answers
Commentary  |  2/6/2011  | 
According to a news report this weekend, hackers breached web-based applications owned by the NASDAQ. How deep did the attacks go, and who was behind them?
Should You Be Paying For Data Services?
Commentary  |  2/4/2011  | 
In a recent entry I brought up the idea of free data services. What if you could get features like snapshots, replication or thin provisioning for free or almost free? The reality is that except for a few lawsuits most vendors that offer complete hardware and software solutions aren't showing a lot of concern. What they are doing is raising the bar to make their offerings more attractive than the softwar
Securing Databases In The Cloud
Commentary  |  2/2/2011  | 
Cloud services are comprised of pools of compute, network, information, and storage pools, so focus on securing the information rather than the database
10GbE Storage And The SME
Commentary  |  2/2/2011  | 
Most of the server vendors have announced that before the end of 2011 they will be providing servers with 10GbE built into the motherboard. This LAN on motherboard (LOM) approach is something that storage vendors, maybe more so than networking vendors, need to be paying attention to as it will provide high performance storage access to the masses.
ShmooCon Panel Discusses Ease, Speed Of Password Cracking
Commentary  |  2/1/2011  | 
Panel of security professionals discussed new tools and techniques to accelerate password cracking, highlighting need for multifactor authentication


News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3035
PUBLISHED: 2021-04-20
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
CVE-2021-3036
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to us...
CVE-2021-3037
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS conf...
CVE-2021-3038
PUBLISHED: 2021-04-20
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions...
CVE-2021-3506
PUBLISHED: 2021-04-19
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The hi...