News & Commentary

Latest Content
<<   <   Page 2 / 2
Man Formerly on FBI Most Wanted List Pleads Guilty in 'Scareware' Hack
Quick Hits  |  2/7/2018  | 
Latvian man ran bulletproof Web hosting service that served cybercriminals.
Ticking Time Bombs in Your Data Center
Commentary  |  2/7/2018  | 
The biggest security problems inside your company may result from problems it inherited.
New Zero-Day Ransomware Evades Microsoft, Google Cloud Malware Detection
News  |  2/7/2018  | 
Shurl0ckr, a form of Gojdue ransomware, was not detected on SharePoint or Google Drive.
Top Cloud Security Misconceptions Plaguing Enterprises
Partner Perspectives  |  2/7/2018  | 
Contrary to popular opinion, there is no one single cloud. There are a wealth of cloud-based providers that own dedicated server space across the globe. Heres how to find the best fit for your company.
Uber's Response to 2016 Data Breach Was 'Legally Reprehensible,' Lawmaker Says
News  |  2/6/2018  | 
In Senate hearing, Uber CISO admits company messed up in not quickly disclosing breach that exposed data on 57 million people.
Security vs. Speed: The Risk of Rushing to the Cloud
News  |  2/6/2018  | 
Companies overlook critical security steps as they move to adopt the latest cloud applications and services.
Ukraine Power Distro Plans $20 Million Cyber Defense System
Quick Hits  |  2/6/2018  | 
After NotPetya and severe blackouts, Ukrenergo responds with an investment in cybersecurity.
Adobe Patches Flash Zero-Day Used in South Korean Attacks
Quick Hits  |  2/6/2018  | 
Critical flaw is one of two critical use-after-free vulnerabilities in Flash fixed today by the software firm.
AutoSploit: Mass Exploitation Just Got a Lot Easier
Commentary  |  2/6/2018  | 
But the response to the new hacking tool, now readily available to the masses of script kiddies, has been a mix of outrage, fear, some applause, and more than a few shrugs.
Microsoft Updates Payment, Criteria for Windows Bug Bounty
News  |  2/6/2018  | 
The Windows Insider Preview Bounty Program will award between $500 and $15,000 for eligible submissions.
2017 Smashed World's Records for Most Data Breaches, Exposed Information
News  |  2/6/2018  | 
Five mega-breaches last year accounted for more than 72% of all data records exposed in 2017.
Identity Fraud Hits All-Time High in 2017
News  |  2/6/2018  | 
Survey reports that the number of fraud victims topped 16 million consumers last year, and much of that crime has moved online.
Two Suspects Arrested in 'Jackpotting' Attack in Connecticut
Quick Hits  |  2/5/2018  | 
The men were charged in federal court for alleged bank fraud using malware that empties cash from ATM machines.
Abusing X.509 Digital Certificates for Covert Data Exchange
News  |  2/5/2018  | 
Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.
Over 12,000 Business Websites Leveraged for Cybercrime
News  |  2/5/2018  | 
Attackers exploit trust in popular websites to launch phishing campaigns and spread malware.
7 Ways to Maximize Your Security Dollars
Slideshows  |  2/5/2018  | 
Budget and resource constraints can make it hard for you to meet security requirements, but there are ways you can stretch your budget.
Apple, Cisco, Allianz, Aon Partner in Cyber Risk Management
Quick Hits  |  2/5/2018  | 
The four companies announced a tool for managing the cyber risk of ransomware and other malware-related threats.
Mastering Security in the Zettabyte Era
Commentary  |  2/5/2018  | 
Many businesses are ill-equipped to deal with potential risks posed by billions of connected devices, exponential data growth, and an unprecedented number of cyber threats. Here's how to prepare.
Russian National Arrested for Kelihos Botnet Sent to US
Quick Hits  |  2/2/2018  | 
Peter Levashov, among the world's most notorious email spammers, has been extradited to the US.
Cyberattack Impersonates FBI Internet Crime Complaint Center
Quick Hits  |  2/2/2018  | 
Threat actors trick victims into sharing personal information with fake IC3 messages laced with malware.
APIs Pose 'Mushrooming' Security Risk
News  |  2/2/2018  | 
As APIs grow in prominence, top security concerns include bots and authentication.
3 Ways Hackers Steal Your Company's Mobile Data
Commentary  |  2/2/2018  | 
The most effective data exfiltration prevention strategies are those that are as rigorous in vetting traffic entering the network as they are traffic leaving it.
Crypto-Mining Attacks Emerge as the New Big Threat to Enterprises
News  |  2/1/2018  | 
Attackers looking to hijack systems for illegally mining digital currencies have begun eyeing business systems, security vendors say.
Adobe to Patch Flash Zero-Day Discovered in South Korean Attacks
News  |  2/1/2018  | 
Critical use-after-free vulnerability being used in targeted attacks.
Poor Visibility, Weak Passwords Compromise Active Directory
News  |  2/1/2018  | 
Security experts highlight the biggest problems they see putting Microsoft Active Directory at risk.
Securing Cloud-Native Apps
Commentary  |  2/1/2018  | 
A useful approach for securing cloud-native platforms can be adapted for securing apps running on top of the platform as well.
'Ransomware' Added to Oxford English Dictionary
Quick Hits  |  2/1/2018  | 
The term is one of 1,100 new entries added to the Oxford English Dictionary this week.
Lieberman Software Acquired by Bomgar
Quick Hits  |  2/1/2018  | 
Deal combines privileged access management products, technologies.
Thinking about a Career Move in Cybersecurity?
Commentary  |  2/1/2018  | 
The numbers show career opportunities for cyber defenders.
Ramnit's Holiday Shopping Spree: Retailers & E-commerce
Partner Perspectives  |  2/1/2018  | 
This past season, the authors of a traditional banking Trojan focused on what people do between Thanksgiving and New Year's Day: shop, eat, check their bank account, and entertain.
Google Cloud Least-Privilege Function Goes Live
Quick Hits  |  1/31/2018  | 
Custom Roles for Cloud IAM now available in production from Google.
Lazarus Group, Fancy Bear Most Active Threat Groups in 2017
News  |  1/31/2018  | 
Lazarus, believed to operate out of North Korea, and Fancy Bear, believed to operate out of Russia, were most referenced threat actor groups in last year's cyberattacks.
Passwords: 4 Biometric Tokens and How They Can Be Beaten
Commentary  |  1/31/2018  | 
Authentication security methods are getting better all the time, but they are still not infallible.
K-12 Study Gives Schools Low Marks for Protecting Student Privacy Online
News  |  1/31/2018  | 
Survey says local school districts and education departments lack even the most basic security and privacy safeguards.
IoT Botnets by the Numbers
Slideshows  |  1/31/2018  | 
IoT devices are a botherder's dream attack-vector.
700,000 Bad Apps Deleted from Google Play in 2017
Quick Hits  |  1/31/2018  | 
Google rejected 99% of apps with abusive content before anyone could install them, according to a 2017 security recap.
5 Questions to Ask about Machine Learning
Commentary  |  1/31/2018  | 
Marketing hyperbole often exceeds reality. Here are questions you should ask before buying.
Data Encryption: 4 Common Pitfalls
Partner Perspectives  |  1/31/2018  | 
To maximize encryption effectiveness you must minimize adverse effects in network performance and complexity. Here's how.
Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers
News  |  1/30/2018  | 
For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.
Digital Extortion to Expand Beyond Ransomware
News  |  1/30/2018  | 
In the future of digital extortion, ransomware isn't the only weapon, and database files and servers won't be the only targets.
Breach-Proofing Your Data in a GDPR World
Commentary  |  1/30/2018  | 
Here are six key measures for enterprises to prioritize over the next few months.
Hack Costs Coincheck Cryptocurrency Exchange $530 Million
Quick Hits  |  1/30/2018  | 
Losses at Japanese exchange Coincheck surpass those of the Mt. Gox Bitcoin exchange hack in 2014, and may be largest-ever cryptocurrency theft.
DNS Hijacking: The Silent Threat That's Putting Your Network at Risk
Commentary  |  1/30/2018  | 
The technique is easy to carry out and can cause much damage. Here's what you need to know about fighting back.
Thieves Target ATMs In First US 'Jackpotting' Attacks
News  |  1/29/2018  | 
Attackers have been getting ATMs to illegally dispense cash by tampering with their internal electronics, US Secret Service warns.
Microsoft Issues Emergency Patch to Disable Intel's Broken Spectre Fix
News  |  1/29/2018  | 
Affected Windows systems can also be set to "disable" or "enable" the Intel microcode update for Spectre attacks.
RELX Group Agrees to Buy ThreatMetrix for 580M Cash
Quick Hits  |  1/29/2018  | 
Authentication firm ThreatMetrix will become part of Risk & Business Analytics under the LexisNexis Risk Solutions brand.
Strava Fitness App Shares Secret Army Base Locations
Quick Hits  |  1/29/2018  | 
The exercise tracker published a data visualization map containing exercise routes shared by soldiers on active duty.
An Action Plan to Fill the Information Security Workforce Gap
Commentary  |  1/29/2018  | 
Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data, and other ideas to entice women into a cyber career.
Former CIA CTO Talks Meltdown and Spectre Cost, Federal Threats
News  |  1/26/2018  | 
Gus Hunt, former technology leader for the CIA, explains the potential long-term cost of Meltdown and Spectre.
Dutch Intel Agency Reportedly Helped US Attribute DNC Hack to Russia
News  |  1/26/2018  | 
The General Intelligence and Security Service of the Netherlands broke into Cozy Bear's network in 2014 and spotted the group launching attacks, de Volkskrant says.
<<   <   Page 2 / 2


One in Three SOC Analysts Now Job-Hunting
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/12/2018
Encrypted Attacks Continue to Dog Perimeter Defenses
Ericka Chickowski, Contributing Writer, Dark Reading,  2/14/2018
Can Android for Work Redefine Enterprise Mobile Security?
Satish Shetty, CEO, Codeproof Technologies,  2/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: One agent too many was installed on Bob's desktop.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.