News & Commentary
Content posted in February 2014
|
Today's Network Security Challenges: No Easy Answers
The BYOD trend and proliferation of mobile devices are making life hard for security teams, but solutions are elusive, panelists say at RSA Conference 2014
Fresh Target Breach Cards Hitting Black Market
A Bitcoin-powered marketplace is selling stolen card data in small batches, offering card validity guarantees, an RSA presentation reveals.
DDoS Attack! Is Regulation The Answer?
Four security experts weigh in on why there’s been little progress in combating DDoS attacks and how companies can start fighting back.
Boeing Unveils Self-Destructing Smartphone
Rugged and super-secure Boeing Black smartphone targets government agencies involved with defense and homeland security
Verizon Shares Glimpse Into Upcoming 2014 Data Breach Investigations Report
Breach data for upcoming Verizon report comes from some 50 contributing organizations from 95 nations, including Eastern European and Latin American CERTs
Big Data A Big Focus Of Security Analytics Products
At the RSA Conference this week, vendors pitched big the importance of properly leveraging big data to improve security
IBM Software Vulnerabilities Spiked In 2013
Most code flaws still involve non-Microsoft products, and overall patching speed has improved, study presented at RSA conference finds
5 Reasons Security Certifications Matter
There's a lot of buzz around how certs aren't important. I'm calling BS, and here's why
IBM Software Vulnerabilities Spiked In 2013
Most code flaws still involve non-Microsoft products, and overall patching speed has improved, study presented at RSA conference finds.
Bitcoin-Stealing Malware: Now In 100 Flavors
Specialized malware empties electronic wallets of digital currency, and antivirus often misses it, say researchers at RSA Conference.
More Than 100 Flavors Of Malware Are Stealing Bitcoins
Specialized form of malware empties electronic wallets of digital currency, and antivirus often misses it
Apple Patches Mavericks SSL Flaw: Update Now
Security update patches "goto fail" flaw that enables attackers to intercept communications, but won't help the 23% of Macs running older OS
RSA: Juniper Security Chief Blasts Apathy
In RSA keynote, Juniper Networks security exec Nawaf Bitar urges more innovation and active defense.
Compliance Is Not Hard
Compliance requires a new set of healthy habits and the self-discipline to make those habits stick
Juniper Security Chief Takes Swipe At Security Apathy
RSA keynote urges more innovation and active defense
Apple Patches Mavericks SSL Flaw: Update Now
Security update patches "goto fail" flaw that enables attackers to intercept communications, but won't help the 23% of Macs running older OS X.
RSA Chairman: NSA Work Is 'Public Record'
Art Coviello calls for global intelligence community reforms, says RSA's work with NSA was never secret.
Lessons Learned From The Target Breach
The time is ripe for organizations to take a long, hard look at how they manage employee access and secure sensitive data in cloud environments
Microsoft Beefs Up EMET
Early release of anti-exploit tool shuts down bypass methods created by Bromium Labs
Coviello: RSA Security's Work With NSA 'A Matter Of Public Record'
RSA chairman calls for global intelligence community reforms, spinning IAD off from NSA
Apple SSL Vulnerability: 6 Facts
SSL vulnerability that's been patched in iOS -- but not yet for OS X -- lets attackers intercept email and FaceTime communications, plus push malicious software updates
NSA Spying Scandal Darkens Cloud Discussions At RSA
From Europe's efforts to create regulations for data localization to worries over the security of the cloud, the leaks of the past eight months have cast a shadow over cloud providers
Apple SSL Vulnerability: 6 Facts
SSL vulnerability that's been patched in iOS -- but not yet for OS X -- lets attackers intercept email and FaceTime communications, plus push malicious software updates.
Cisco-Sourcefire Integration Takes Shape
Integration includes adding Sourcefire's AMP technology into its email and Web security appliances
Healthcare Devices: Security Researchers Sound Alarms
Default usernames, weak passwords, and widespread Windows XP Embedded systems are cause for concern, SANS Institute researchers say
How I Secure My Personal Cloud
As global cloud traffic grows exponentially, IT pros face the daunting task of securing their personal cloud, data, and workloads.
Researchers Bypass Protections In Microsoft's EMET Security Tool
Bromium Labs researchers create exploit that the Enhanced Mitigation Experience Toolkit (EMET) 4.1 can't detect
Is The Hypervisor Security's Goldilocks Zone?
RSA presentation to put virtualization forward as a tool to fix security's architectural problems
Solving The Security Workforce Shortage
To solve the skills shortage, the industry will need to attract a wider group of people and create an entirely new sort of security professional
Study: 96 Percent Of Applications Have Security Vulnerabilities
Nearly all applications tested have security flaws, Cenzic study says; information leakage is chief culprit
Vulnerability In Tinder Dating App Exposed Users' Location
Security flaw made it possible to pinpoint users of Tinder online dating app within 100 feet, researchers say
IT Pros Okay With Government's Role In Cybersecurity
Most U.S. IT pros see feds' involvement in security a positive, new Dell survey shows
Microsoft Issues Emergency Fix For Internet Explorer Zero-Day
'Fix-it' shipped in the wake of at least two targeted attack campaigns exploiting a newly found bug in IE10
Boutique Malware & Hackers For Hire
Heads up! Small groups of cyber-mercenaries are now conducting targeted hit-and-run attacks for anyone willing to pay the price.
Securing Data In 4 (Relatively) Easy Steps
The key to success in information security is finding the 'right' information in all the data you aim to protect.
Windows Crash Reports Reveal New APT, POS Attacks
Researchers discover zero-day attacks after studying the contents of various "Dr. Watson" error reports.
Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Researchers discover zero-day attacks after studying the contents of various "Dr. Watson" error reports
U.S. Running Out Of Allies On Cyber Battlefield
International cyber policy and enforcement, and ownership over the Internet are thorny topics that will be tackled at the 2014 RSA Conference next week
WebView Exploit Affects Most Android Phones
Critical bug affects devices running Jelly Bean (4.2) and earlier Android OSs, including fully updated versions of Google Glass, says Metasploit.
New Zeus Variant Targets Salesforce.com
New attack shows the adaptability of Zeus and the challenges of policing an ever-expanding network perimeter
'Connect': A Modern Approach To Mobile, Cloud Identity
A new protocol from the OpenID Foundation promises enterprises federated single sign-on that can scale.
5 Tactics To Help Triage Patching
Refine risk measurements to better prioritize the patching of vulnerabilities
Former Israeli Military Intel Agents Launch Security Startup
Cybereason focuses on attacker's activity, behavior
FBI, International Law Enforcement Officials Share Insights On Fighting Cybercrime
Officials from the FBI, Netherlands, Interpol, and other agencies on the fight to track and catch cybercriminals around the globe
Bye, Bitcoin: Criminals Seek Other Crypto Currency
Law enforcement crackdowns, hack attacks, and market volatility drive Russian fraudsters to mint their own virtual currency systems.
FIDO Alliance Releases Authentication Standards, Unveils Products
Proponents say the new specifications will pave the way for the replacement of passwords, which are frequently lost, stolen, or hacked.
FIDO Alliance Publishes Authentication Standards; First Products Unveiled
FIDO Alliance issues specs for "authentication plumbing;" Nok Nok ships first implementation
Abusing Cloud Services For Cybercrime
At the upcoming RSA conference, researchers will discuss how a lack of anti-automation protections allow attackers to take advantage of free cloud services
|
White Papers
Video
3 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I spy, you spy, we all spy...a spy...
Latest Comment: I spy, you spy, we all spy...a spy...
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-19367
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-19
From DHS/US-CERT's National Vulnerability Database CVE-2018-19367
PUBLISHED: 2018-11-20
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
CVE-2018-19335PUBLISHED: 2018-11-20
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-19334PUBLISHED: 2018-11-20
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-10099PUBLISHED: 2018-11-20
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-17906PUBLISHED: 2018-11-19
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This