Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content
<<   <   Page 2 / 2
281 Arrested in International BEC Takedown
News  |  9/11/2019  | 
Conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, the Department of Justice reports.
Firmware: A New Attack Vector Requiring Industry Leadership
Commentary  |  9/11/2019  | 
It's time for cybersecurity manufacturers and solution providers to step up and show leadership in addressing firmware security. Read why and how.
Third-Party Features Leave Websites More Vulnerable to Attack
Quick Hits  |  9/10/2019  | 
A new report points out the dangers to customer data of website reliance on multiple third parties.
Two Zero-Days Fixed in Microsoft Patch Rollout
News  |  9/10/2019  | 
September's Patch Tuesday addressed 80 vulnerabilities, two of which have already been exploited in the wild.
New Privacy Features in iOS 13 Let Users Limit Location Tracking
News  |  9/10/2019  | 
Apple will introduce other features that allow more secure use of iPhones in workplace settings as well.
Data Is the New Copper
Commentary  |  9/10/2019  | 
Data breaches fuel a complex cybercriminal ecosystem, similar to copper thefts after the financial crisis.
US Power Grid Cyberattack Due to Unpatched Firewall: NERC
Quick Hits  |  9/10/2019  | 
A firewall vulnerability enabled attackers to repeatedly reboot the victim entity's firewalls, causing unexpected outages.
AI Is Everywhere, but Don't Ignore the Basics
Commentary  |  9/10/2019  | 
Artificial intelligence is no substitute for common sense, and it works best in combination with conventional cybersecurity technology. Here are the basic requirements and best practices you need to know.
More Than 99% of Cyberattacks Need Victims' Help
News  |  9/9/2019  | 
Research highlights how most criminals exploit human curiosity and trust to click, download, install, open, and send money or information.
New Release Brings BlueKeep to Metasploit
Quick Hits  |  9/9/2019  | 
All organizations with Windows infrastructures should make sure their systems are patched to current versions, Rapid7 suggests.
Public Exposure Does Little to Slow China-Based Thrip APT
News  |  9/9/2019  | 
Over the past year, the cyber-espionage group has attacked at least 12 other companies in the military, telecom, and satellite sectors, Symantec says.
Texas Refuses to Pay $2.5M in Massive Ransomware Attack
Quick Hits  |  9/9/2019  | 
The ransomware campaign affected 22 local governments, none of which have paid the attackers' $2.5 million ransom demand.
From Spyware to Ninja Cable
Commentary  |  9/9/2019  | 
Attackers don't need sophisticated James Bondian hardware to break into your company. Sometimes a $99 device will do.
Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool
News  |  9/6/2019  | 
APT3 quietly monitored an NSA attack on its systems and used the information to build a weapon of its own.
Mail System Vulnerability Delivers Root Privileges
Quick Hits  |  9/6/2019  | 
The vulnerability in Exim could allow an attacker to remotely execute code with root privileges.
Job-Seeker Data Exposed in Monster File Leak
Quick Hits  |  9/6/2019  | 
The job website says it cannot notify users since the exposure occurred on a third-party organization's servers.
Why Businesses Fail to Address DNS Security Exposures
Commentary  |  9/6/2019  | 
Increasing awareness about the critical importance of DNS security is the first step in improving the risk of being attacked. It's time to get proactive.
Security Pros and 'Black Hats' Agree on Most Tempting Targets
Quick Hits  |  9/5/2019  | 
Malicious actors look for accounts that are springboards to other systems, according to nearly 300 attendees of Black Hat USA.
New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims
News  |  9/5/2019  | 
Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes.
Attackers Hit Ceiling in Ransomware Demands
News  |  9/5/2019  | 
New Bedford, Massachusetts' refusal to pay a $5.3 million ransom highlights how victim towns and cities may be hitting the limit to what they're willing to spend to speed recovery.
Automation: Friend of the SOC Analyst
Commentary  |  9/5/2019  | 
Faced by increasingly sophisticated threats, organizations are realizing the benefits of automation in their cybersecurity programs.
Crimeware: How Criminals Built a Business to Target Businesses
News  |  9/5/2019  | 
A new report investigates the evolution of crimeware, how businesses underestimate the threat, and why they should be concerned.
419M Facebook User Phone Numbers Publicly Exposed
Quick Hits  |  9/5/2019  | 
It's still unclear who owned the server storing hundreds of millions of records online without a password.
It's Not Healthy to Confuse Compliance with Security
Commentary  |  9/5/2019  | 
Healthcare organizations should be alarmed by the frequency and severity of cyberattacks. Don't assume you're safe from them just because you're compliant with regulations.
5G Standard to Get New Security Specifications
News  |  9/4/2019  | 
Researchers had recently demonstrated how attackers could intercept device capability information and use it against 5G mobile subscribers.
Phishing Campaign Uses SharePoint to Slip Past Defenses
News  |  9/4/2019  | 
Cybercriminals targeting financial institutions in the UK bypassed Symantec email gateway and other perimeter technologies.
Android Phone Flaw Allows Attackers to Divert Email
News  |  9/4/2019  | 
Researchers find that a spoofing a service message from the phone carrier is simple and effective on some brands of Android smartphones.
Back to School? 'Not So Fast,' Cybercriminals Say
Quick Hits  |  9/4/2019  | 
A New York State school district was forced to delay the start of its school year when ransomware struck.
An Inside Look at How CISOs Prioritize Budgets & Evaluate Vendors
Commentary  |  9/4/2019  | 
In-depth interviews with four market-leading CISOs reveal how they prioritize budgets, measure ROI on security investments, and evaluate new vendors.
Rising Fines Will Push Breach Costs Much Higher
News  |  9/4/2019  | 
The cost of breaches will rise by two-thirds over the next five years, exceeding an estimated $5 trillion in 2024, primarily driven by higher fines as more jurisdictions punish companies for lax security.
A Tale of Two Buzzwords: 'Automated' and 'Autonomous' Solutions Aren't the Same Thing
Commentary  |  9/4/2019  | 
Enterprises must learn the difference between the two and the appropriate use cases for each.
Splunk Buys Microservices Monitoring Firm Omnition
Quick Hits  |  9/4/2019  | 
The purchase is intended to boost Splunk's capabilities in microservices architectures.
Cybercriminals Impersonate Chief Exec's Voice with AI Software
Quick Hits  |  9/3/2019  | 
Scammers leveraged artificial intelligence software to mimic the voice of a chief executive and successfully request $243,000.
Multicloud Businesses Face Higher Breach Risk
News  |  9/3/2019  | 
A new report finds 52% of multicloud environments have suffered a breach within the past year, compared with 24% of hybrid cloud users.
Over 47K Supermicro Corporate Servers Vulnerable to Attack
News  |  9/3/2019  | 
Vulnerabilities in a remote-monitoring component give attackers a way to mount virtual USBs on systems, Eclypsium warns.
3 Promising Technologies Making an Impact on Cybersecurity
Commentary  |  9/3/2019  | 
The common thread: Each acts as a force multiplier, adding value to every other security technology around it.
Report: Iranian 'Mole' Carried Stuxnet to Iranian Nuclear Facility
Quick Hits  |  9/3/2019  | 
An engineer recruited by the Dutch intelligence agency AIVD helped bring to Iran's Natanz nuclear facility the malware via USB that ultimately infected systems there and sabotaged centrifuges, according to an exclusive report from Yahoo News.
Upping the Ante on Anti-Analysis
Commentary  |  9/3/2019  | 
Attackers are becoming more sophisticated in their obfuscation and anti-analysis practices to avoid detection.
7 Steps to Web App Security
Slideshows  |  9/3/2019  | 
Emerging technologies are introducing entirely new ways to reach, act, and interact with people. That makes app security more important than ever.
ISAC 101: Unlocking the Power of Information
Commentary  |  9/2/2019  | 
How information sharing and analysis centers provide contextual threat information by creating communities that helps security professionals and their organizations grow in maturity and capability.
@jack Got Hacked: Twitter CEO's Tweets Hijacked
Quick Hits  |  8/30/2019  | 
Twitter CEO Jack Dorsey's Twitter account was, apparently, hijacked for roughly 20 minutes and used for a racist rant.
New Credential-Theft Attack Weaponizes DNS
Quick Hits  |  8/30/2019  | 
The recently discovered campaign sends stolen data out of the network as part of a DNS query.
Google Uncovers Massive iPhone Attack Campaign
News  |  8/30/2019  | 
A group of hacked websites has been silently compromising fully patched iPhones for at least two years, Project Zero reports.
Overburdened SOC Analysts Shift Priorities
News  |  8/30/2019  | 
Many SOC analysts are starting to shut off high-alert features to keep pace with the volume, new study shows.
To Navigate a Sea of Cybersecurity Solutions, Learn How to Fish
Commentary  |  8/30/2019  | 
Three steps for relieving the pressure of picking the right tools.
7 Breaches & Hacks That Throw Shade on Biometric Security
Slideshows  |  8/30/2019  | 
Stolen fingerprints, fake hands, voice synthetization, and other nefarious techniques show biometrics has plenty of challenges.
Retadup Worm Squashed After Infecting 850K Machines
News  |  8/29/2019  | 
An operation involving French law enforcement, the FBI, and Avast forces Retadup to delete itself from victim machines.
Google Announces New, Expanded Bounty Programs
Quick Hits  |  8/29/2019  | 
The company is significantly expanding the bug-bounty program for Google Play and starting a program aimed at user data protection.
Bug Bounties Continue to Rise, but Market Has Its Own 1% Problem
News  |  8/29/2019  | 
The average payout for a critical vulnerability has almost reached $3,400, but only the top bug hunters of a field of 500,000 are truly profiting.
Google Cloud Releases Beta of Managed Service to Microsoft AD
Quick Hits  |  8/29/2019  | 
Managed Service for Microsoft Active Directory was built to help admins handle cloud-based workloads.
<<   <   Page 2 / 2


US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-9405
PUBLISHED: 2019-09-20
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
CVE-2015-9407
PUBLISHED: 2019-09-20
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
CVE-2015-9408
PUBLISHED: 2019-09-20
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
CVE-2019-16533
PUBLISHED: 2019-09-20
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.
CVE-2019-16534
PUBLISHED: 2019-09-20
On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.