Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content
Page 1 / 2   >   >>
79% of Third-Party Libraries in Apps Are Never Updated
News  |  6/23/2021  | 
A lack of contextual information and concerns over application disruption among contributing factors.
VMs Help Ransomware Attackers Evade Detection, But It's Uncommon
News  |  6/23/2021  | 
Some ransomware attackers use virtual machines to bypass security detection, but adoption is slow for the complicated technique.
Microsoft Tracks New BazaCall Malware Campaign
Quick Hits  |  6/23/2021  | 
Attackers use emails to prompt victims to call a fraudulent call center, where attackers instruct them to download a malicious file.
New DNS Name Server Hijack Attack Exposes Businesses, Government Agencies
News  |  6/23/2021  | 
Researchers found a "novel" class of DNS vulnerabilities in AWS Route53 and other DNS-as-a-service offerings that leak sensitive information on corporate and government customers, with one simple registration step.
Survey Seeks to Learn How 2020 Changed Security
Quick Hits  |  6/23/2021  | 
Respondents to a new Dark Reading/Omdia survey will be entered into a drawing for a Black Hat Black Card.
When Will Cybersecurity Operations Adopt the Peter Parker Principle?
Commentary  |  6/23/2021  | 
Having a prevention mindset means setting our prevention capabilities to "prevent" instead of relying on detection and response.
Expecting the Unexpected: Tips for Effectively Mitigating Ransomware Attacks in 2021
Commentary  |  6/23/2021  | 
Cybercriminals continually innovate to thwart security protocols, but organizations can take steps to prevent and mitigate ransomware attacks.
Despite Heightened Cyber-Risks, Few Security Leaders Report to CEO
News  |  6/22/2021  | 
A new report suggests that top management at most companies still don't get security.
Transmit Security Announces $543M Series A Funding Round
Quick Hits  |  6/22/2021  | 
The passwordless technology provider says the funding will be used to increase its reach and expand primary business functions.
NSA Funds Development & Release of D3FEND Framework
Quick Hits  |  6/22/2021  | 
The framework, now available through MITRE, provides countermeasures to attacks.
Identity Eclipses Malware Detection at RSAC Startup Competition
Commentary  |  6/22/2021  | 
All 10 finalists in the Innovation Sandbox were focused on identity, rather than security's mainstay for the last 20 years: Malware detection.
Majority of Web Apps in 11 Industries Are Vulnerable All the Time
News  |  6/22/2021  | 
Serious vulnerabilities exist every day in certain industries, including utilities, public administration, and professional services, according to testing data.
Does Your Cyberattack Plan Include a Crisis Communications Strategy? 5 Tips to Get Started
Commentary  |  6/22/2021  | 
Don't overlook crisis communications in your cybersecurity incident response planning.
Did Companies Fail to Disclose Being Affected by SolarWinds Breach?
News  |  6/21/2021  | 
The SEC has sent out letters to some investment firms and publicly listed companies seeking information, Reuters says.
Software-Container Supply Chain Sees Spike in Attacks
News  |  6/21/2021  | 
Attackers target companies' container supply chain, driving a sixfold increase in a year, aiming to steal processing time for cryptomining and compromise cloud infrastructure.
Data Leaked in Fertility Clinic Ransomware Attack
Quick Hits  |  6/21/2021  | 
Reproductive Biology Associates says the data of 38,000 patients may have been compromised in the April cyberattack.
Baltimore County Public Schools' Ransomware Recovery Tops $8M
Quick Hits  |  6/21/2021  | 
The school district has spent seven months and a reported $8.1 million recovering from the November attack.
Are Ransomware Attacks the New Pandemic?
Commentary  |  6/21/2021  | 
Ransomware has been a problem for decades, so why is government just now beginning to address it?
Attackers Find New Way to Exploit Google Docs for Phishing
News  |  6/18/2021  | 
Tactic continues recent trend by attackers to use trusted cloud services to send and host malicious content.
Accidental Insider Leaks Prove Major Source of Risk
Quick Hits  |  6/18/2021  | 
Research reports highlight growing concerns around insider negligence that leads to data breaches.
This Week in Database Leaks: Cognyte, CVS, Wegmans
News  |  6/18/2021  | 
Billions of records were found exposed this week due to unprotected databases owned by major corporations and third-party providers.
4 Habits of Highly Effective Security Operators
Commentary  |  6/18/2021  | 
These good habits can make all the difference in advancing careers for cybersecurity operators who spend their days putting out fires large and small.
Data Breaches Surge in Food & Beverage, Other Industries
News  |  6/17/2021  | 
Six previously "under-attacked" vertical industries saw a surge in data breaches last year due to COVID-19 related disruptions and other factors, new data shows.
One in Five Manufacturing Firms Targeted by Cyberattacks
News  |  6/17/2021  | 
Information-stealing malware makes up about a third of attacks, a study finds, but companies worry most about ransomware shutting down production.
Carnival Cruise Line Reports Security Breach
Quick Hits  |  6/17/2021  | 
The cruise ship operator says the incident affected employee and guest data.
Google Launches SLSA, a New Framework for Supply Chain Integrity
Quick Hits  |  6/17/2021  | 
The "Supply chain Levels for Software Artifacts" aims to ensure the integrity of components throughout the software supply chain.
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Commentary  |  6/17/2021  | 
Consider four factors and behaviors that impact a particular employee's risk, and how security training should take them into account.
Mission Critical: What Really Matters in a Cybersecurity Incident
Commentary  |  6/17/2021  | 
The things you do before and during a cybersecurity incident can make or break the success of your response.
Ukraine Police Disrupt Cl0p Ransomware Operation
News  |  6/16/2021  | 
Growing list of similar actions in recent months may finally be scaring some operators into quitting, but threat is far from over, security experts say.
Ransomware Operators' Strategies Evolve as Attacks Rise
News  |  6/16/2021  | 
Security researchers find ransomware operators rely less on email and more on criminal groups for initial access into target networks.
Biden Tells Putin Critical Infrastructure Sectors 'Off Limits' to Russian Hacking
Quick Hits  |  6/16/2021  | 
President Joe Biden said he and Russian President Vladimir Putin agreed to discuss boundaries in cyber activity.
Security Flaw Discovered In Peloton Equipment
Quick Hits  |  6/16/2021  | 
The vulnerability could give attackers remote root access to the bike's tablet, researchers report.
Cars, Medicine, Electric Grids: Future Hackers Will Hit Much More Than Networks in an IT/OT Integrated World
Commentary  |  6/16/2021  | 
Intelligent systems must include the right cybersecurity protections to prevent physical threats to operational technology.
Russian National Convicted on Charges Related to Kelihos Botnet
Quick Hits  |  6/16/2021  | 
Oleg Koshkin was arrested in 2019 and faces a maximum penalty of 15 years in prison, the DoJ reports.
Keeping Your Organization Secure When Dealing With the Unexpected
Commentary  |  6/16/2021  | 
There's no way to anticipate every possible scenario, but the right approach to business continuity can help you respond effectively in any situation.
Don't Get Stymied by Security Indecision
Commentary  |  6/16/2021  | 
You might be increasing cyber-risk by not actively working to reduce it.
Thousands of VMware vCenter Servers Remain Open to Attack Over the Internet
News  |  6/15/2021  | 
Three weeks after company disclosed two critical vulnerabilities in the workload management utility, many organizations have not patched the technology yet, security vendor says.
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
News  |  6/15/2021  | 
Attackers had used the cloud-based infrastructure to target mailboxes and add forwarding rules to learn about financial transactions.
Security Experts Scrutinize Apple, Amazon IoT Networks
News  |  6/15/2021  | 
Both companies have done their due diligence in creating connected-device networks, but the pervasiveness of the devices worries some security researchers.
Andariel Group Targets South Korean Entities in New Campaign
Quick Hits  |  6/15/2021  | 
Andariel, designated as a sub-group of the Lazarus Group APT, has historically targeted South Korean organzations.
Deloitte Buys Terbium Labs to Expand Threat Intel Capabilities
Quick Hits  |  6/15/2021  | 
Terbium Labs' products and services will become part of Deloitte's Detect & Respond lineup, the company confirms.
What Industrial Control System Vulnerabilities Can Teach Us About Protecting the Supply Chain
Commentary  |  6/15/2021  | 
Older technologies used in industrial and critical infrastructure leave the sector highly vulnerable to attack, but organizations can take steps to better protect themselves.
How Does the Government Buy Its Cybersecurity?
Commentary  |  6/15/2021  | 
The federal government is emphasizing cybersecurity regulation, education, and defense strategies this year.
VPN Attacks Surged in First Quarter
News  |  6/14/2021  | 
But volume of malware, botnet, and other exploit activity declined because of the Emotet botnet takedown.
Cyber Analytics Database Exposed 5 Billion Records Online
Quick Hits  |  6/14/2021  | 
In an ironic twist, Cognyte's data alerts customers to third-party data exposures.
Google Workspace Adds Client-Side Encryption
Quick Hits  |  6/14/2021  | 
Users given control over encryption keys, Google says.
New Top 20 Secure-Coding List Positions PLCs as Plant 'Bodyguards'
News  |  6/14/2021  | 
Best practices guide encompasses integrity, hardening, resilience, and monitoring of PLCs in industrial networks.
Know Thy Enemy: Fighting Half-Blind Against Ransomware Won't Work
Commentary  |  6/14/2021  | 
We lack reliable, representative, actionable data about ransomware's actual scope, scale, and impact. The Ransom Incident Response Network could change that.
Name That Toon: Sight Unseen
Commentary  |  6/14/2021  | 
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
Colonial Pipeline Cyberattack Proves a Single Password Isn't Enough
Commentary  |  6/14/2021  | 
Since the attack, it's been revealed that it was down to a single password. Yes, ransomware needs to be on your radar -- but a focus on credentials is vital.
Page 1 / 2   >   >>


Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-2322
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
CVE-2021-20019
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
CVE-2021-21809
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
CVE-2021-34067
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
CVE-2021-34068
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.