Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content
Page 1 / 2   >   >>
Bank of America Security Incident Affects PPP Applicants
Quick Hits  |  5/29/2020  | 
The incident occurred when Paycheck Protection Program applications were uploaded to a test platform and accidentally shared.
Abandoned Apps May Pose Security Risk to Mobile Devices
News  |  5/29/2020  | 
Mobile providers don't often update users when applications are not supported by developers, security firm says.
Cisco Announces Patches to SaltStack
Quick Hits  |  5/29/2020  | 
The patches came after Cisco was notified by the Salt Open Core team that the vulnerabilities and updates were available.
Digital Distancing with Microsegmentation
Commentary  |  5/29/2020  | 
Physical distancing has blunted a virus's impact; the same idea can be applied to computers and networks to minimize breaches, attacks, and infections.
Zscaler Buys Edge Networks
Quick Hits  |  5/29/2020  | 
The acquisition is Zscaler's second major buy this quarter.
A Rogues' Gallery of MacOS Malware
Slideshows  |  5/28/2020  | 
MacOS isn't immune from malware. Being prepared means understanding the nature of the worst threats a security team is likely to see attacking Macs in the enterprise.
GitHub Supply Chain Attack Uses Octopus Scanner Malware
News  |  5/28/2020  | 
Octopus Scanner is a new malware used to compromise 26 open source projects in a massive GitHub supply chain attack.
Researchers ID Hacktivist Who Defaced Nearly 5,000 Websites
News  |  5/28/2020  | 
Opsec mistakes lead a Check Point researcher to an individual in Brazil who was behind a longtime hacking campaign.
Valak Malware Retasked to Steal Data from US, German Firms
News  |  5/28/2020  | 
Once considered a loader for other malware, Valak regularly conducts reconnaissance and steals information and credentials, new analysis shows.
NSA Warns Russia's 'Sandworm' Group Is Targeting Email Servers
Quick Hits  |  5/28/2020  | 
The Russian military group has been exploiting a flaw in the Exim mail transfer agent since last August, the NSA reports.
3 SMB Cybersecurity Myths Debunked
Commentary  |  5/28/2020  | 
Small and midsize businesses are better at cyber resilience than you might think.
Vulnerability Disclosures Drop in Q1 for First Time in a Decade
News  |  5/28/2020  | 
Even with more security issues published on Patch Tuesdays, the total number of software flaws dropped for the first three months of 2020, according to one tally.
Google, Microsoft Brands Impersonated the Most in Form-Based Attacks
News  |  5/28/2020  | 
Attackers are preying on users' inclination to click on familiar-looking websites, but instead trick them into sharing usernames and passwords.
Data Loss Spikes Under COVID-19 Lockdowns
News  |  5/28/2020  | 
Two new reports suggest a massive gap between how organizations have prepared their cybersecurity defenses and the reality of their efficacy.
How Elite Protectors Operationalize Security Protection
Commentary  |  5/28/2020  | 
There is no silver bullet for cybersecurity. It takes the right people, with the right mindset, applying the right elements of good security from the data center to the SOC.
COVID-19: Latest Security News & Commentary
News  |  5/28/2020  | 
Check out Dark Reading's updated, exclusive news and commentary surrounding the coronavirus pandemic.
Netwalker Ransomware Tools Reveal Attacker Tactics and Techniques
News  |  5/27/2020  | 
Malware and related files show that ransomware operators don't need a cutting-edge arsenal to be effective.
Stay-at-Home Orders Coincide With Massive DNS Surge
News  |  5/27/2020  | 
A variety of sites saw as much as seven times the number of domain requests in late March and early April, suggesting attackers attempted massive denial-of-service attacks.
Cloud Security Architect Proves Hardest Infosec Role to Fill
Quick Hits  |  5/27/2020  | 
Nearly 70% of businesses struggle to recruit, hire, and retain cybersecurity talent, and many link security incidents to lack of skills.
HackerOne Bounties Hit $100M Milestone
Quick Hits  |  5/27/2020  | 
The bug-hunting platform has now paid more than $100 million in bounties since October 2013.
Standing Privilege: The Attacker's Advantage
Commentary  |  5/27/2020  | 
The credential is a commodity and will continue to be breached. As a result, focus and spending must shift toward the access that the credentials provide.
GDPR Enforcement Loosens Amid Pandemic
News  |  5/27/2020  | 
The European Union has given some organizations more breathing room to remedy violations, yet no one should think regulators are planning to abandon the privacy legislation in the face of COVID-19.
Microsoft Shares PonyFinal Threat Data, Warns of Delivery Tactics
News  |  5/27/2020  | 
PonyFinal is deployed in human-operated ransomware attacks, in which adversaries tailor their techniques based on knowledge of a target system.
What the World's Elite Protectors Teach Us about Cybersecurity
Commentary  |  5/27/2020  | 
How to protect anyone and anything, from the perspective of a career Secret Service agent and former special operations marine.
6 Steps Consumers Should Take Following a Hack
Slideshows  |  5/27/2020  | 
Without the luxury of an IT security team to help them after a breach or credit card compromise, consumers will want to keep these tips in mind.
StrandHogg 2.0 Emerges as 'Evil Twin' to Android Threat
News  |  5/26/2020  | 
The vulnerability, which exists in almost every version of Android, is both more dangerous and harder to detect than its predecessor.
Americans Care About Security But Don't Follow Through
Quick Hits  |  5/26/2020  | 
Most Americans say they're very concerned about online security but still behave in insecure ways, according to a new survey.
Turla Backdoor Adds Gmail Web Interface for Command-and-Control
News  |  5/26/2020  | 
The latest version of ComRAT is another sign of the threat actor's continued focus on targets in the government, military, and other sectors.
Benefits of a Cloud-Based, Automated Cyber Range
Commentary  |  5/26/2020  | 
A cyber range is an irreplaceable tool that allows cybersecurity professionals to improve their response capabilities as well as their ability to identify risks.
Q&A: Eugene Kaspersky on Tourism, the Pandemic, and Cybersecurity
News  |  5/26/2020  | 
The CEO and co-founder of eponymously named security vendor has launched a new travel accelerator program amid the COVID-19 crisis.
World Leaders Urge Action Against Healthcare Cyberattacks
Quick Hits  |  5/26/2020  | 
The global call to end cybercrime targeting healthcare facilities has been signed by government leaders and Nobel laureates.
The Problem with Artificial Intelligence in Security
Commentary  |  5/26/2020  | 
Any notion that AI is going to solve the cyber skills crisis is very wide of the mark. Here's why.
Content Delivery Networks Adding Checks for Magecart Attacks
News  |  5/26/2020  | 
Modern web applications make significant use of third-party code to drive innovation, but the software supply chain has also turned into a major source of threat. CDNs aim to change that.
Former Salesforce Execs Launch Data Protection Startup
News  |  5/22/2020  | 
Cloud-based API service stores and manages sensitive consumer data with a zero-trust, database-as-a service approach.
Security & Trust Ratings Proliferate: Is That a Good Thing?
News  |  5/22/2020  | 
Phishing ratings, security ratings, human-ness ratings -- we are looking at a future filled with grades of security and trustworthiness. But there is a downside.
10 iOS Security Tips to Lock Down Your iPhone
Slideshows  |  5/22/2020  | 
Mobile security experts share their go-to advice for protecting iPhones from hackers, thieves, and fraudsters.
Web Scrapers Have Bigger-Than-Perceived Impact on Digital Businesses
News  |  5/21/2020  | 
The economic impact of bot traffic can be unexpectedly substantial, a PerimeterX-commissioned study finds.
Telcos Become Richer Hacking Targets
News  |  5/21/2020  | 
The shift of moving telecommunications networks toward more commercial networking equipment and systems also expanded their attack surface.
Hackers Serve Up Stolen Credentials from Home Chef
Quick Hits  |  5/21/2020  | 
Some 8 million of the meal delivery company's customer records have been offered for sale on the Dark Web.
How an Industry Consortium Can Reinvent Security Solution Testing
Commentary  |  5/21/2020  | 
By committing to independent testing to determine value, vendors will ensure that their products do what they say they do.
The Need for Compliance in a Post-COVID-19 World
Commentary  |  5/21/2020  | 
With the current upheaval, business leaders may lose focus and push off implementing security measures, managing risk, and keeping up with compliance requirements. That's a big mistake.
Most Bluetooth Devices Vulnerable to Impersonation Attacks
News  |  5/21/2020  | 
Vulnerabilities in the Bluetooth authentication process give attackers a way to insert rogue devices between two securely paired devices, academic researchers find.
Centralized Contact Tracing Raises Concerns Among Privacy-Conscious Citizens
News  |  5/21/2020  | 
The long debate over whether encryption and anonymity shield too much criminal behavior also has staged a resurgence.
60% of Insider Threats Involve Employees Planning to Leave
News  |  5/20/2020  | 
Researchers shows most "flight-risk" employees planning to leave an organization tend to start stealing data two to eight weeks before they go.
Digital Transformation Risks in Front-end Code
Commentary  |  5/20/2020  | 
Why making every front-end developer a DevSecOps expert will lead to a more holistic approach to web and native application security.
Offers to Sell Enterprise Network Access Surge on Dark Web
Quick Hits  |  5/20/2020  | 
In contrast, Q1 2019 saw more interest in selling and buying access to individual servers.
Microsoft Warns of Vulnerability Affecting Windows DNS Server
Quick Hits  |  5/20/2020  | 
A new security advisory addresses a vulnerability that could be exploited to cause a denial-of-service attack.
Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say
News  |  5/20/2020  | 
As COVID-19-themed spam rises, phishingnot so much. An analysis of newly registered domains finds that only 2.4% are actually phishing sites aiming to steal credentials.
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Commentary  |  5/20/2020  | 
Enterprises need to recognize that remote access and other pandemic-related security challenges cannot be fixed with buzzwords or silver-bullet security tools.
Magecart Plants Card Skimmers via Old Magento Plugin Flaw
News  |  5/19/2020  | 
The FBI has warned ecommerce sites about attacks targeting a more than three-year-old flaw in the Magmi mass importer.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.