Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in January 2020
<<   <   Page 2 / 3   >   >>
Microsoft, DHS Warn of Zero-Day Attack Targeting IE Users
News  |  1/21/2020  | 
Software firm is "aware of limited targeted attacks" exploiting a scripting issue vulnerability in Internet Explorer 9, 10, and 11 that previously has not been disclosed.
New Ransomware Tactic Shows How Windows EFS Can Aid Attackers
News  |  1/21/2020  | 
Researchers have discovered how ransomware can take advantage of the Windows Encrypting File System, prompting security vendors to release patches.
FireEye Buys Cloudvisory
Quick Hits  |  1/21/2020  | 
The purchase is intended to bring new cloud capabilities to the FireEye Helix security platform.
Avoid That Billion-Dollar Fine: Blurring the Lines Between Security and Privacy
Commentary  |  1/21/2020  | 
While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously. That means security and data privacy teams must work more closely.
Ransomware Upgrades with Credential-Stealing Tricks
Quick Hits  |  1/21/2020  | 
The latest version of the FTCode ransomware can steal credentials from five popular browsers and email clients.
Nearly 75% of SD-WAN Owners Lack Confidence Post-Digital Transformation
Quick Hits  |  1/21/2020  | 
More businesses think SD-WAN will reduce WAN costs, but only 37% think SD-WANs will help defend against malware and other threats.
Data Awareness Is Key to Data Security
Commentary  |  1/21/2020  | 
Traditional data-leak prevention is not enough for businesses facing today's dynamic threat landscape.
Elaborate Honeypot 'Factory' Network Hit with Ransomware, RAT, and Cryptojacking
News  |  1/21/2020  | 
A fictitious industrial company with phony employees personas, website, and PLCs sitting on a simulated factory network fooled malicious hackers - and raised alarms for at least one white-hat researcher who stumbled upon it.
7 Tips for Infosec Pros Considering a Lateral Career Move
Slideshows  |  1/21/2020  | 
Looking to switch things up but not sure how to do it? Security experts share their advice for switching career paths in the industry.
China-Based Cyber Espionage Group Reportedly Behind Breach at Mitsubishi Electric
News  |  1/21/2020  | 
Personal data on over 8,100 individuals and confidential business information likely exposed in June 2019 incident.
Are We Secure Yet? How to Build a 'Post-Breach' Culture
Commentary  |  1/20/2020  | 
There are many ways to improve your organization's cybersecurity practices, but the most important principle is to start from the top.
Mobile Banking Malware Up 50% in First Half of 2019
News  |  1/17/2020  | 
A new report from Check Point recaps the cybercrime trends, statistics, and vulnerabilities that defined the security landscape in 2019.
FBI Seizes Domain That Sold Info Stolen in Data Breaches
Quick Hits  |  1/17/2020  | 
The website, WeLeakData.com, claimed to have more than 12 billion records gathered from over 10,000 breaches.
7 Ways to Get the Most Out of a Penetration Test
Slideshows  |  1/17/2020  | 
You'll get the best results when youre clear on what you want to accomplish from a pen test.
ADP Users Hit with Phishing Scam Ahead of Tax Season
Quick Hits  |  1/17/2020  | 
Fraudulent emails tell recipients their W-2 forms are ready and prompt them to click malicious links.
Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws
News  |  1/17/2020  | 
Following a year that saw the fewest number of vulnerabilities reported since 2015, Oracle's latest quarterly patch fixes nearly 200 new vulnerabilities.
New Attack Campaigns Suggest Emotet Threat Is Far From Over
News  |  1/16/2020  | 
Malware described by the DHS as among the worst ever continues to evolve and grow, researchers from Cisco Talos, Cofense, and Check Point Software say.
Phishing Today, Deepfakes Tomorrow: Training Employees to Spot This Emerging Threat
Commentary  |  1/16/2020  | 
Cybercriminals are evolving their tactics, and the security community anticipates voice and video fraud to play a role in one of the next big data breaches -- so start protecting your business now.
CISO Resigns From Pete Buttigieg Presidential Campaign
Quick Hits  |  1/16/2020  | 
The only Democratic campaign known to have a CISO loses Mick Baccio due to a "fundamental philosophical difference with campaign management."
NY Fed Reveals Implications of Cyberattack on US Financial System
Quick Hits  |  1/16/2020  | 
A "pre-mortem analysis" sheds light on the potential destruction of a cyberattack against major US banks.
Active Directory Needs an Update: Here's Why
Commentary  |  1/16/2020  | 
AD is still the single point of authentication for most companies that use Windows. But it has some shortcomings that should be addressed.
2017 Data Breach Will Cost Equifax at Least $1.38 Billion
News  |  1/15/2020  | 
Company agrees to set aside a minimum of $380.5 million as breach compensation and spend another $1 billion on transforming its information security over the next five years. The 147 million US consumers affected by the breach have one week from today to file a claim.
Google Lets iPhone Users Turn Device into Security Key
News  |  1/15/2020  | 
The iPhone can now be used in lieu of a physical security key as a means of protecting Google accounts.
Why Firewalls Aren't Going Anywhere
Commentary  |  1/15/2020  | 
Written off multiple times as obsolete, firewalls continue to elude demise by adding features and ensuring that VPNs keep humming.
New Report Spotlights Changes in Phishing Techniques
News  |  1/15/2020  | 
Common and evolving strategies include the use of zero-font attacks, homograph attacks, and new tactics for fake attachments.
ISACs Join Forces to Secure the Travel Industry
Quick Hits  |  1/15/2020  | 
Together, the Travel & Hospitality ISAC and the Retail & Hospitality ISAC intend to improve communications and collaboration about the evolving threat landscape.
How SD-WAN Helps Achieve Data Security and Threat Protection
Commentary  |  1/15/2020  | 
Enterprises currently consider the technology a best practice because of its flexibility, scalability, performance, and agility.
Microsoft Patches Windows Vuln Discovered by the NSA
News  |  1/14/2020  | 
The National Security Agency is publicly acknowledged for its finding and reporting of CVE-2020-0601, marking the start of what it says is a new approach to security.
Cloud Adoption & Technology Change Create Gaps in Enterprise Security
News  |  1/14/2020  | 
Many companies are struggling to get a handle on risk exposure because of visibility issues, Radware survey shows.
'Fancy Bear' Targets Ukrainian Oil Firm Burisma in Phishing Attack
Quick Hits  |  1/14/2020  | 
The oil & gas company is at the heart of the ongoing US presidential impeachment case.
Google: Chrome Will Remove Third-Party Cookies and Tracking
Quick Hits  |  1/14/2020  | 
It's "not about blocking" but removing them altogether, the company said.
Attackers Increasingly Focus on Business Disruption
News  |  1/14/2020  | 
Network intruders are staying undetected for an average of 95 days, enabling them to target critical systems and more completely disrupt business.
Global Predictions for Energy Cyber Resilience in 2020
Commentary  |  1/14/2020  | 
How prepared is the energy sector for an escalating attack surface in the operating technology environment? Here are five trends to watch.
Consumer Reports Calls for IoT Manufacturers to Raise Security Standards
Quick Hits  |  1/14/2020  | 
A letter to 25 companies says Consumer Reports will change ratings to reflect stronger security and privacy standards.
Dustman Attack Underscores Iran's Cyber Capabilities
News  |  1/14/2020  | 
For nearly six months, an attack group linked to Iran reportedly had access to the network of Bahrain's national oil company, Bapco, before it executed a destructive payload.
Processor Vulnerabilities Put Virtual Workloads at Risk
Commentary  |  1/14/2020  | 
Meltdown, Spectre exploits will likely lead to customers making tradeoffs between performance and security of applications, especially virtual and cloud-based apps
Industrial Control System Features at Risk
News  |  1/14/2020  | 
How some ICS product functions can be weaponized by altering their configurations.
Microsoft to Officially End Support for Windows 7, Server 2008
News  |  1/13/2020  | 
Windows 7 and Server 2008 will continue to work after Jan. 14, 2020, but will no longer receive security updates.
Website Collecting Australian Fire Donations Hit by Magecart
Quick Hits  |  1/13/2020  | 
The attack may have compromised donors' payment information.
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
News  |  1/13/2020  | 
Organizations need to apply mitigations for vulnerability in Citrix Application Delivery Controller and Citrix Gateway ASAP, security researchers say.
Texas School District Loses $2.3M to Phishing Attack
Quick Hits  |  1/13/2020  | 
The Manor Independent School District is investigating a phishing email scam that led to three separate fraudulent transactions.
Will This Be the Year of the Branded Cybercriminal?
Commentary  |  1/13/2020  | 
Threat actors will continue to grow enterprise-style businesses that evolve just like their legitimate counterparts.
Synopsys Buys Tinfoil
Quick Hits  |  1/10/2020  | 
Tinfoil Security's dynamic application and API security testing capabilities will be added to Synopsys Software Integrity Group.
Major Brazilian Bank Tests Homomorphic Encryption on Financial Data
News  |  1/10/2020  | 
The approach allowed researchers to use machine learning on encrypted data without first decrypting it.
Indian National Pleads Guilty to Multimillion-Dollar Call Center Scam
Quick Hits  |  1/10/2020  | 
The India-based call centers scammed US victims out of millions of dollars between 2013 and 2016.
5 Tips on How to Build a Strong Security Metrics Framework
Commentary  |  1/10/2020  | 
The carpentry maxim "measure twice, cut once" underscores the importance of timely, accurate, and regular metrics to inform security leaders' risk decisions.
Study Points to Lax Focus on Cybersecurity
News  |  1/10/2020  | 
Despite ranking at the top of respondents' concerns, organizations still show gaps in acting on cybersecurity, Society for Information Management (SIM) report finds.
Attackers Increase Focus on North American Electric Utilities: Report
News  |  1/9/2020  | 
Electric utilities continue to be a target of nation-state attackers, even before the latest tensions between Iran and the United States, says a critical-infrastructure security firm.
Chinese Malware Found Preinstalled on US Government-Funded Phones
News  |  1/9/2020  | 
Researchers found unremovable malware preinstalled in the Unimax U686CL, a budget Android device sold by Assurance Wireless.
TrickBot Group Adds New PowerShell-Based Backdoor to Arsenal
News  |  1/9/2020  | 
PowerTrick is sort of a custom-version of PowerShell Empire and can be used to download additional malware, SentinelOne says.
<<   <   Page 2 / 3   >   >>


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10696
PUBLISHED: 2020-03-31
A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
CVE-2020-5344
PUBLISHED: 2020-03-31
Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially cr...
CVE-2020-5292
PUBLISHED: 2020-03-31
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and admini...
CVE-2020-7009
PUBLISHED: 2020-03-31
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
CVE-2019-13495
PUBLISHED: 2020-03-31
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.