Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in October 2019
Page 1 / 4   >   >>
32,000+ WiFi Routers Potentially Exposed to New Gafgyt Variant
News  |  10/31/2019  | 
Researchers detect an updated Gafgyt variant that targets flaws in small office and home wireless routers from Zyxel, Huawei, and Realtek.
Slow Retreat from Python 2 Threatens Code Security
News  |  10/31/2019  | 
The end of life is near for Python 2, and there will be no rising from the grave this time. So why are some companies and developers risking a lack of security patches to stay with the old version of the programming language?
Chinese Cyber Espionage Group Steals SMS Messages via Telco Networks
News  |  10/31/2019  | 
APT41's new campaign is latest to highlight trend by Chinese threat groups to attack upstream service providers as a way to reach its intended targets, FireEye says.
Chinese-Linked APT41 Can Read Your Texts
Larry Loeb  |  10/31/2019  | 
New malware family is designed to have the ability to monitor as well as save SMS traffic from specific phone numbers, IMSI numbers and keywords for subsequent theft.
Coalfire CEO Wants Criminal Charges Against His Employees Dropped
Quick Hits  |  10/31/2019  | 
Felony charges against two employees tasked with testing the physical security of the Dallas County, Iowa, courthouse have been lessened, but that's not enough, CEO says.
Quantifying Security Results to Justify Costs
Commentary  |  10/31/2019  | 
The CISO job isn't to protect the entire business from all threats for any budget. It's to spell out what level of protection executives can expect for a given budget.
New Office 365 Phishing Scam Leaves A Voicemail
Quick Hits  |  10/31/2019  | 
A fake voice message lures victims to a fake Microsoft 365 login page that prompts them to enter credentials.
9 Ways Data Vampires Are Bleeding Your Sensitive Information
Commentary  |  10/31/2019  | 
Pull a Van Helsing on those sucking the lifeblood from your data and intellectual property.
As Phishing Kits Evolve, Their Lifespans Shorten
News  |  10/30/2019  | 
Most phishing kits last less than 20 days, a sign defenders are keeping up in the race against cybercrime.
Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion
News  |  10/30/2019  | 
Evidence suggests NSO Group used WhatsApps servers to distribute mobile spyware to targeted devices.
Ransomware Attack Hits Las Cruces, New Mexico Public Schools
Quick Hits  |  10/30/2019  | 
The attack early in the morning of October 29 has taken all of the school district's systems offline.
Security Pros Fear Insider Attacks Stem from Cloud Apps
Quick Hits  |  10/30/2019  | 
More than half of security practitioners surveyed say insider attack detection has grown more difficult since migrating to cloud.
Email Threats Poised to Haunt Security Pros into Next Decade
Commentary  |  10/30/2019  | 
Decentralized threat intel sharing, more public-private collaboration, and greater use of automated incident response are what's needed to combat phishing
8 Trends in Vulnerability and Patch Management
Slideshows  |  10/30/2019  | 
Unpatched flaws continue to be a major security issue for many organizations.
Xhelper Will Be Back Whether You Want It or Not
Larry Loeb  |  10/30/2019  | 
Researcher says that this Trojan dropper variant of the original Android malware has infected more than 45,000 Android devices over the last six months.
Hacking Phones: How Law Enforcement Is Saving Privacy
Commentary  |  10/30/2019  | 
It's no longer true that society must choose to either weaken everybody's privacy or let criminals run rampant.
Old RAT, New Moves: Adwind Hides in Java Commands to Target Windows
News  |  10/29/2019  | 
The Adwind remote access Trojan conceals malicious activity in Java commands to slip past threat intelligence tools and steal user data.
Endpoints Fail Predictably: Absolute
Larry Loeb  |  10/29/2019  | 
A security firm based in Vancouver, Canada, has issued a disturbing 2019 Endpoint Security Trends Report that finds security spending not worth the bucks.
Why Cloud-Native Applications Need Cloud-Native Security
Commentary  |  10/29/2019  | 
Today's developers and the enterprises they work for must prioritize security in order to reap the speed and feature benefits these applications and new architectures provide.
MSFT Floats an ARC
Larry Loeb  |  10/29/2019  | 
As far back as 2015, the group responsible for Domain-based Message Authentication, Reporting & Conformance specification realized that one implementation was not going to solve the problem of email spoofing.
Google Cloud Adds New Security Management Tools to G Suite
Quick Hits  |  10/29/2019  | 
Desktop devices that log into G Suite will have device management enabled by default, streamlining processes for IT admins.
Who Made the List Of 2019's Nastiest Malware?
Quick Hits  |  10/29/2019  | 
This year's compilation features well-known ransomware, botnet, and cryptomining software.
Cybersecurity Trumps Political, Reputational Concerns for Companies
News  |  10/29/2019  | 
The average company has seen its risk increase, with cybersecurity topping the list of business threats, followed by damage to reputation and financial risks, a report finds.
Why It's Imperative to Bridge the IT & OT Cultural Divide
Commentary  |  10/29/2019  | 
As industrial enterprises face the disruptive forces of an increasingly connected world, these two cultures must learn to coexist.
Fortinet Bolsters Endpoint Security with enSilo Acquisition
News  |  10/28/2019  | 
As companies reduce their vendor count, consolidation will likely continue to accelerate in the next year.
Pwn2Own Adds Industrial Control Systems to Hacking Contest
News  |  10/28/2019  | 
The Zero Day Initiative will bring its first ICS Pwn2Own competition to the S4x20 conference in January.
US Lawmakers Fear Chinese-Owned TikTok Poses Security Risk
Quick Hits  |  10/28/2019  | 
The popular video app has more than 110 million downloads in the United States and could give China access to users' personal data, they say.
Database Error Exposes 7.5 Million Adobe Customer Records
Quick Hits  |  10/28/2019  | 
The database was open for approximately one week before the problem was discovered.
5 Things the Hoodie & the Hard Hat Need to Know About Each Other
Commentary  |  10/28/2019  | 
Traditionally, the worlds of IT (the hoodie) and OT (the hard hat) have been separate. That must change.
Microsoft Office Bug Remains Top Malware Delivery Vector
News  |  10/25/2019  | 
CVE-2017-11882 has been attackers' favorite malware delivery mechanism throughout the second and third quarters of 2019.
Online Beauty Store Hit by Magecart Attack
Quick Hits  |  10/25/2019  | 
An e-skimmer placed on the Procter & Gambleowned First Aid Beauty site to steal payment card data went undetected for five months.
Second Ransomware Attack Strikes Johannesburg
Quick Hits  |  10/25/2019  | 
Attackers who broke into the city's network demand four Bitcoins in ransom or threaten to share stolen personal and financial data.
4 Security Lessons Federal IT Pros Can Teach the Private Sector
Commentary  |  10/25/2019  | 
With a little research and basic planning, small companies can make big strides against the cybersecurity threats they face. Here's how.
40% of Security Pros Job Hunting as Satisfaction Drops
News  |  10/24/2019  | 
Symptoms of job dissatisfaction creep into an industry already plagued with gaps in diversity and work-life balance.
FBI Expands Election Security Initiative
Quick Hits  |  10/24/2019  | 
The program offers resources and advice to help protect elections at every level within the US.
Apple Boots 17 Trojan-Laden Apps From Mobile Store
News  |  10/24/2019  | 
Malware was designed to carry out click-fraud, Wandera says.
It's Time to Improve Website Identity Indicators, Not Remove Them
Commentary  |  10/24/2019  | 
Why Google and Mozilla are wrong about the benefits of Extended Validation certificates that aim to prevent fraud and protect user privacy.
Beware the 'Raccoon Stealer' – It Ain't No Furry Friend
Larry Loeb  |  10/24/2019  | 
'Raccoon stealer' is one of the 2019's top ten most-mentioned pieces of malware in the underground economy.
Eight-Hour DDoS Attack Struck AWS Customers
Quick Hits  |  10/24/2019  | 
Google Cloud Platform suffered issues around the same time as Amazon Web Services but claims they were not caused by DDoS.
Mobile Users Targeted With Malware, Tracked by Advertisers
News  |  10/24/2019  | 
Cybercriminals continue to seed app stores with malicious apps, advanced attackers successfully compromise mobile devices, and advertisers continue to track users, new reports show.
Why Organizations Must Quantify Cyber-Risk in Business Terms
Commentary  |  10/24/2019  | 
The rising costs of breaches and regulatory fines are driving demand for better measurement and articulation of business impacts.
FTC Warns Consumers About Stalking Apps
Quick Hits  |  10/23/2019  | 
Agency offers tips on how to detect and eradicate the spyware.
IoTopia Framework Aims to Bring Security to Device Manufacturers
News  |  10/23/2019  | 
GlobalPlatform launches an initiative to help companies secure connected devices and services across markets.
Oracle Releases Free Tool for Monitoring Internet Routing Security
News  |  10/23/2019  | 
IXP Filter Check gives Internet Exchange Points a way to verify whether they are properly filtering out incorrect and malicious routes.
Planning a Zero-Trust Initiative? Here's How to Prioritize
Commentary  |  10/23/2019  | 
If you start by focusing on users, data, access, and managed devices, you will make major strides toward achieving better security.
10% of Small Businesses Breached Shut Down in 2019
Quick Hits  |  10/23/2019  | 
As a result of cybercrime, 69% of small organizations were forced offline for a limited time and 37% experienced financial loss.
Operational Technology Players Come Out of the Shadows
Larry Loeb  |  10/23/2019  | 
Operational technology (OT) has long been hiding in the factories and sites of industrial installations, but things are changing.
Report: 2020 Presidential Campaigns Still Vulnerable to Web Attacks
Commentary  |  10/23/2019  | 
Nine out of 12 Democratic candidates have yet to enable DNSSEC, a simple set of extensions that stops most targeted domain-based attacks.
8 Tips for More Secure Mobile Computing
Slideshows  |  10/23/2019  | 
Mobile devices are a huge part of enterprise IT. Here's what to advise their users to do to keep their devices and critical business data best protected.
About 50% of Apps Are Accruing Unaddressed Vulnerabilities
News  |  10/22/2019  | 
In rush to fix newly discovered security issues, developers are neglecting to address older ones, Veracode study finds.
Page 1 / 4   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41127
PUBLISHED: 2021-10-21
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot...
CVE-2021-41169
PUBLISHED: 2021-10-21
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
CVE-2021-27746
PUBLISHED: 2021-10-21
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
CVE-2021-36869
PUBLISHED: 2021-10-21
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
CVE-2021-39352
PUBLISHED: 2021-10-21
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrat...