News & Commentary

Content posted in December 2017
Page 1 / 3   >   >>
21st Century Oncology Faces $2.3M HIPAA Settlement Cost after Breach
Quick Hits  |  12/29/2017  | 
Company to pay US Department of Health and Human Services over potential HIPAA violations after patient medical data was stolen by cyberthieves.
China Shuts Down 13,000 Websites for Breaking Internet Laws
Quick Hits  |  12/29/2017  | 
The government says its rules are to protect security and stability, but some say they are repressive.
Avoiding Micro-Segmentation Pitfalls: A Phased Approach to Implementation
Commentary  |  12/29/2017  | 
Micro-segmentation is very achievable. While it can feel daunting, you can succeed by proactively being aware of and avoiding these roadblocks.
17 Things We Should Have Learned in 2017 But Probably Didn't
Commentary  |  12/29/2017  | 
The worm has returned and the Yahoos have all been exposed, but did 2017 teach us any genuinely new lessons we shouldn't already have known?
Jailed Hacker Claims Proof He Breached DNC on Russia's Orders
Quick Hits  |  12/28/2017  | 
A Russian national in jail for hacking the Democratic National Committee says a data signature proves he acted on the Kremlin's orders.
Mozilla Issues Critical Security Patch for Thunderbird Flaw
Quick Hits  |  12/28/2017  | 
Mozilla released five patches for Thunderbird security vulnerabilities, including one critical buffer overflow bug affecting Windows machines.
The Disconnect Between Cybersecurity & the C-Suite
Commentary  |  12/28/2017  | 
Most corporate boards are not taking tangible actions to shape their companies' security strategies or investment plans, a PwC study shows.
Rapid Growth in Security Market Raises Question: How to Pick a Startup
News  |  12/28/2017  | 
VCs weigh in with their advice on how to select a startup with staying power when purchasing security solutions and services.
Nissan Canada Finance Alerts 1.13 Million Customers of Data Breach
Quick Hits  |  12/27/2017  | 
Attackers gain access to personal information of Nissan Canada Finance and Infiniti Financial Services Canada customers.
Hacker Targeted Huawei Router 0-Day in Attempt to Create New Mirai Botnet
Quick Hits  |  12/27/2017  | 
Thousands of attempts have been made to exploit a zero-day vulnerability in the Huawei home router HG532.
The Financial Impact of Cyber Threats
Commentary  |  12/27/2017  | 
Determining the financial impact of specific IT vulnerabilities is a good way to prioritize remediation and prevent attacks.
The Coolest Hacks of 2017
News  |  12/27/2017  | 
Robots, voting machines, machine learning, and the wind were among the hacks security researchers pulled off this year.
6 Tips to Protect Against Technical Support Fraud
Slideshows  |  12/27/2017  | 
Just when youre having fun over the holidays and not paying attention, you can be hit with a tech support scam. Here's how to stay safe into the new year.
2017 Security Predictions through the Rear Window
Commentary  |  12/26/2017  | 
If you're going to forecast the future, go big.
Exposed File From Ancestry's RootsWeb.com Contains Data on 300,000 Users
Quick Hits  |  12/26/2017  | 
A file containing hundreds of thousands of RootsWeb users' email, login information, and passwords was found externally exposed, genealogy site says.
CISOs Play Rising Role In Business
News  |  12/26/2017  | 
CISO hiring trends show more external hires, longer tenures, and an increase in MBAs as tech pros are required to understand the business.
EtherDelta Hack Begins Rocky Weekend for Crypto
News  |  12/26/2017  | 
Popular cryptocurrency exchange EtherDelta announces a potential DNS attack and suspends service just days before Bitcoin hit a five-day drop.
Hit the Cyber Underground for the Hottest Travel Deals
News  |  12/22/2017  | 
You can get everything from inexpensive flights and hotels to fake passports in the cyber underground, says Trend Micro.
Network Printer & Scanner Spoofing Campaign Targets Millions
Quick Hits  |  12/22/2017  | 
Cybercriminals distribute malicious email attachments purportedly coming from three common brands of network printer-scanner devices.
Block Threats Faster: Pattern Recognition in Exploit Kits
Commentary  |  12/22/2017  | 
When analysts investigate an indicator of compromise, our primary goal is to determine if it is malicious as quickly as possible. Identifying attack patterns helps you mitigate quicker.
CISO Holiday Miracle Wish List
Slideshows  |  12/22/2017  | 
If CISOs could make a wish to solve a problem, these would be among the top choices.
Businesses Go on Pre-Holiday Cloud Acquisition Spree
News  |  12/21/2017  | 
VMware, McAfee, and Trend Micro announce a series of acquisitions that indicate a strong focus on cloud security.
Russia's Fancy Bear APT Group Gets More Dangerous
News  |  12/21/2017  | 
Encryption and code refreshes to group's main attack tool have made it stealthier and harder to stop, ESET says.
Digital Forensics & the Illusion of Privacy
Commentary  |  12/21/2017  | 
Forensic examiners don't work for bounties. They do what is required to catch criminals, pedophiles, or corporate embezzlers, and now their important security research is finally being acknowledged.
US Census Bureau: Data Exposed in Alteryx Leak Already Public
Quick Hits  |  12/21/2017  | 
The US Census Bureau says no personally identifiable information it collected was compromised in this week's Alteryx leak.
Fileless Malware Attacks Hit Milestone in 2017
News  |  12/21/2017  | 
Non-malware attacks account for the majority of all attacks this year, and ransomware grows to a $5 billion industry, new data shows.
Facebook Helps Users Detect Phishing Emails
Quick Hits  |  12/21/2017  | 
A new Facebook tool shares recent security-related emails so users can verify whether messages are legitimate.
Why Network Visibility Is Critical to Removing Security Blind Spots
Commentary  |  12/21/2017  | 
You can't secure what you can't see. Here are four ways to shine a light on the dark spaces of your corporate infrastructure.
Small,Targeted Ransomware Attacks Emerge
News  |  12/21/2017  | 
Cybercriminals narrow their focus on specific industries, geographies, or size for a better return on investment, security experts say.
Be a More Effective CISO by Aligning Security to the Business
Partner Perspectives  |  12/21/2017  | 
These five steps will you help marshal the internal resources you need to reduce risk, break down barriers, and thwart cyber attacks.
9 Banking Trojans & Trends Costing Businesses in 2017
Slideshows  |  12/20/2017  | 
New Trojans appeared, old ones resurfaced, and delivery methods evolved as cybercriminals set their sights on financial data.
Attack Attribution Tricky Say Some as US Blames North Korea for WannaCry
News  |  12/20/2017  | 
There's not enough evidence to conclusively tie the rogue regime to the ransomware attacks, some security experts say.
Five Arrested for Cerber, CTB-Locker Ransomware Spread
Quick Hits  |  12/20/2017  | 
Authorities arrest three Romanian suspects for spreading CTB-Locker malware and two for a ransomware case linked to the United States.
Security Worries? Let Policies Automate the Right Thing
Commentary  |  12/20/2017  | 
By programming 'good' cybersecurity practices, organizations can override bad behavior, reduce risk, and improve the bottom line.
Another Cyberattack Spotted Targeting Mideast Critical Infrastructure Organizations
News  |  12/19/2017  | 
Operation Copperfield appears focused on data theft and reconnaissance, Nyotron says.
Microsoft Office Docs New Vessel for Loki Malware
News  |  12/19/2017  | 
Loki malware, built to steal credentials, is distributed via Microsoft Excel and other Office applications rigged with malicious 'scriptlets' to evade detection.
New Database Botnet Leveraged for Bitcoin Mining
News  |  12/19/2017  | 
Attackers are quietly building an attack infrastructure using very sensitive machines.
Massive Cloud Leak Exposes Alteryx, Experian, US Census Bureau Data
Quick Hits  |  12/19/2017  | 
A misconfigured Amazon Web Services S3 storage bucket exposed sensitive data on consumers' financial histories, contact information, and mortgage ownership.
Trump Adviser: North Korea Waged WannaCry Attack
News  |  12/19/2017  | 
White House declares the North Korean government as perpetrators of the epic ransomware attack that spread around the globe in early May.
Comprehensive Endpoint Protection Requires the Right Cyber Threat Intelligence
Commentary  |  12/19/2017  | 
CTI falls into three main categories -- tactical, operational, and strategic -- and answers questions related to the "who, what, and why" of a cyber attack.
'Starwars' Debuts on List of Worst Passwords of 2017
News  |  12/19/2017  | 
Many of the old standbys made this year's list of the 25 stolen - and weakest - passwords found dumped online.
Telegram RAT Escapes Detection via Cloud Apps
Quick Hits  |  12/18/2017  | 
Netskope discovers a new RAT using Dropbox for its payload host and Telegram Messenger for command and control.
Kaspersky Lab Files Lawsuit Over DHS Ban of its Products
News  |  12/18/2017  | 
Security firm petitions US District Court to rescind decision to prohibit its products on US federal government systems.
Businesses Fail in Risk Modeling and Management: Report
News  |  12/18/2017  | 
Businesses struggle to quantify and manage risk, leading to wasted resources and oversight of major problems.
US Government Pays $10,650 Bug Bounty in 'Hack the Air Force' Event
Quick Hits  |  12/18/2017  | 
The bounty, split between two researchers, is the largest single reward by any government bug bounty program to date.
Top 8 Cybersecurity Skills IT Pros Need in 2018
Slideshows  |  12/18/2017  | 
Cloud security architecture skills to customer-service savvy are among the key IT security skills needed next year as CIOs ramp up hiring.
Advanced Deception: How It Works & Why Attackers Hate It
Commentary  |  12/18/2017  | 
While cyberattacks continue to grow, deception-based technology is providing accurate and scalable detection and response to in-network threats.
19 M California Voter Records Held for Ransom in MongoDB Attack
Quick Hits  |  12/15/2017  | 
The records were first exposed in an unsecured MongoDB database, continuing a cyber-extortion trend.
Lazarus Group Targets Bitcoin Company
Quick Hits  |  12/15/2017  | 
The cybercrime group blamed for attacks on the SWIFT financial network launches a spearphishing campaign to steal employee credentials at a London cryptocurrency company.
Mobile Device Makers Increasingly Embrace Bug Bounty Programs
News  |  12/15/2017  | 
Samsung is the latest to join a small group of smartphone makers to cast their net wide on catching vulnerabilities in their devices.
Page 1 / 3   >   >>


Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.