News & Commentary

Content posted in March 2017
Page 1 / 4   >   >>
Trump Extends Obama's EO for Sanctioning Hackers
Quick Hits  |  3/31/2017  | 
EO ultimately led to sanctions against Russia for hacking and other attempts to tamper with the outcome of the US election.
'Sundown' Rises as New Threat in Depleted Exploit Kit Landscape
News  |  3/31/2017  | 
New exploits and obfuscation tactics have made once second-tier EK a potent threat, researchers from Cisco Talos say.
Customized Malware: Confronting an Invisible Threat
Commentary  |  3/31/2017  | 
Hackers are gaining entry to networks through a targeted approach. It takes a rigorous defense to keep them out.
Germany Creates Separate Military Wing for Cyber Command
Quick Hits  |  3/31/2017  | 
The new unit to tackle cyberattacks will be launched next week and be located in Bonn with staff of 260.
Romanian Man Pleads Guilty to ATM Skimming Scheme
Quick Hits  |  3/31/2017  | 
Radu Bogdan Marin allegedly used stolen account details and fake ATM cards to withdraw tens of thousands of dollars.
US Border Policy Shifts May Drive Changes in Laptop Security
News  |  3/31/2017  | 
In-cabin laptop ban and requirements to unlock devices for border patrol could have enterprises revisiting their on-device data policies.
The Business of Security: How your Organization Is Changing beneath You
Commentary  |  3/30/2017  | 
And why its your job to change with it and skate where the puck is headed.
Payment Card Industry Security Compliance: What You Need to Know
Commentary  |  3/30/2017  | 
A quick refresher on all the different PCI SSC security standards that are relevant for organizations that accept electronic payments.
Patch Unlikely for Widely Publicized Flaw in Microsoft IIS 6.0
Quick Hits  |  3/30/2017  | 
Microsoft recommends upgrade to latest operating system for more protection.
Internet's Security Woes are Not All Technical
News  |  3/30/2017  | 
Google engineer Halvar Flake told Black Hat Asia attendees that flaws in organizational structure and market power put enterprises at risk.
30% of Q4 Malware was New or Zero-Day
Quick Hits  |  3/30/2017  | 
WatchGuard quarterly report, based on Firebox Feed data, lists five key findings on Internet security threats.
Insider Threat Fear Greater Than Ever, Survey Shows
News  |  3/29/2017  | 
More than half of security pros say insider threat incidents have become more frequent in the past 12 months.
Privacy Babel: Making Sense of Global Privacy Regulations
Commentary  |  3/29/2017  | 
Countries around the world are making their own privacy laws. How can a global company possibly keep up?
Russian Man Pleads Guilty for his Role in Ebury Botnet
Quick Hits  |  3/29/2017  | 
Maxim Senakh, arrested by Finnish authorities and extradited to the US, will be sentenced this August.
Dutch Parliament Website Suffers Ransomware Attack
Quick Hits  |  3/29/2017  | 
Hackers, suspected to belong to Turkish groups, continue to target Dutch websites.
Millions of Stolen US University Email Credentials for Sale on the Dark Web
News  |  3/29/2017  | 
Researchers find booming underground market for stolen and fake email credentials from the 300 largest universities in the US.
To Gain Influence, CISOs Must Get Security's Human Element Right
Commentary  |  3/29/2017  | 
Focusing on certain elements of security in isolation can cause a false sense of security.
Cerber Ransomware Now Evades Machine Learning
News  |  3/29/2017  | 
New variant has been broken into separate harmless-looking components to fool ML-based detection systems, Trend Micro says.
Cloud Security: New Research Says IT Pros Still Skittish
News  |  3/29/2017  | 
Respondents complain in two studies that traditional security tools dont work in the cloud, and cant deliver visibility across multiple cloud environments.
Should Trump Tackle Air-Gapped Critical Infrastructure?
News  |  3/28/2017  | 
MIT experts issue recommendations to the president, urging him to take elements of the electric grid and gas pipeline offline - but other security experts say that ship has sailed.
Commercial IoT: Big Trouble in Small Devices
Commentary  |  3/28/2017  | 
There are endless scenarios where hackers could wreak havoc on the industrial Internet of Things. Theres also a readily available solution called HIP.
1.4 Billion Data Records Exposed in 2016 Breaches
Quick Hits  |  3/28/2017  | 
The number of data records breached soared in 2016 over the previous year, with the technology sector facing the brunt of the attacks.
Exploit Kits: Winter 2017 Review
Partner Perspectives  |  3/28/2017  | 
We take another look at the current EK scene by going over RIG, Sundown, Neutrino and Magnitude.
How Identity Deception Increases the Success of Ransomware
Commentary  |  3/28/2017  | 
As scammers hone their skills, their handiwork looks more credible to intended victims, making a successful ransomware scam more likely.
Jail Time Set for Two More Members of Global Telecom Fraud Scheme
Quick Hits  |  3/28/2017  | 
Ramon Batista and Farintong Calderon have been sentenced to 75 months and 36 months in prison, respectively.
Two Israeli Youths May Be Charged for vDOS Operation
Quick Hits  |  3/28/2017  | 
Israeli authorities prepare to accuse two 18-year-olds for the online attack service, which caused $1.65 million in losses.
Hacking the Business Email Compromise
News  |  3/27/2017  | 
BEC attacks are on the rise, but plain-old spoofing of business executives' email accounts remains more prevalent.
FBI: Attackers Targeting Anonymous FTP Servers in Healthcare
News  |  3/27/2017  | 
The FBI warns medical and dental organizations of cybercriminals targeting anonymous FTP servers to steal personal health data.
Symantec Seeks to Quell CA Customer Concerns over Google Warning
Quick Hits  |  3/27/2017  | 
Exec at Symantec spells out what company will do if Google follows through on its proposed plans to degrade trust in Symantec certs.
This Week On Dark Reading: Event Calendar
Commentary  |  3/27/2017  | 
Ransomware remediation and recovery this week, with clouds on the horizon.
Data Visualization: Keeping an Eye on Security
Commentary  |  3/27/2017  | 
Visualization can be one of the most powerful approaches a security team can use to make sense of vast quantities of data. So why does it end up as an afterthought?
40% of Discarded Digital Devices Contain Personal Data
Quick Hits  |  3/27/2017  | 
NAID study of 250 devices in resale markets found tablets contained the most recoverable personal information.
Cybercriminals Exploit March Madness Frenzy
Quick Hits  |  3/27/2017  | 
Users are clicking on dubious links to stream matches and exposing confidential data to hackers, says Zscaler.
Google Slams Symantec for 'Failures' in SSL/TLS Certificate Process
Quick Hits  |  3/24/2017  | 
Google Chrome engineers railed on Symantec for allegedly issuing thousands of security certificates that had not been properly validated.
Apple: Mac, iPhone Bugs That CIA Allegedly Exploited Were Fixed Years Ago
News  |  3/24/2017  | 
New WikiLeaks data dump describes "Sonic Screwdriver," other CIA exploits for Mac desktops and iPhones
Intro to Cyber Insurance: 7 Questions to Ask
Slideshows  |  3/24/2017  | 
Buying a cyber insurance policy can be complex and difficult. Make sure you're asking these questions as you navigate the process.
America's JobLink Suffers Security Breach
Quick Hits  |  3/24/2017  | 
A third-party hacker exploited a flaw in America's JobLink application code to access the information of job seekers from 10 states.
Sandia Testing New Intrusion Detection Tool That Mimics Human Brain
News  |  3/24/2017  | 
Neuromorphic Data Microscope can spot malicious patterns in network traffic 100 times faster than current tool, lab claims.
US Senate Overturns Obama Consumer Privacy Rule
Quick Hits  |  3/24/2017  | 
The FCC regulation, passed in October, was rejected in a 50-to-48 vote and is now in the House of Representatives.
Prioritizing Threats: Why Most Companies Get It Wrong
Commentary  |  3/24/2017  | 
To stay safer, focus on multiple-threat attack chains rather than on individual threats.
7 Steps to Transforming Yourself into a DevSecOps Rockstar
Slideshows  |  3/23/2017  | 
Security practitioners at one education software firm offer lessons learned from merging DevOps with security.
5 Ways CISOs Could Work Better with Their Cyber Insurers
Commentary  |  3/23/2017  | 
Risk management has become increasingly important, making it crucial companies have good relationships with their insurance company.
LastPass Fixes Serious Security Flaw in Chrome, Firefox Extensions
Quick Hits  |  3/23/2017  | 
Password manager LastPass creates a workaround for a serious vulnerability affecting browser extensions in Chrome, Firefox, and Microsoft Edge.
US May Charge North Korea in Bangladesh Bank Cybertheft
Quick Hits  |  3/23/2017  | 
The potential case accuses North Korea, and suspected Chinese middlemen, of spearheading an $81-million theft from Bangladesh Bank.
Russian Man Pleads Guilty for Role in Citadel Malware Attacks
Quick Hits  |  3/23/2017  | 
Russian national Mark Vartanyan pleads guilty in US federal court following his December 2016 extradition from Norway.
20 Million Mobile Devices at High Risk of Attack, Study Finds
News  |  3/23/2017  | 
Meanwhile, a separate report by Google says half of all Android devices didn't install a single security update in 2016.
Windows 'DoubleAgent' Attack Turns AV Tools into Malware
News  |  3/22/2017  | 
Zero-day attack exploits a legitimate process in Windows, according to Cybellum; AV vendors downplay threat.
Google, Jigsaw Offer Free Cyber Protection to Election Sites
Quick Hits  |  3/22/2017  | 
The Protect Your Election package from Google and Jigsaw includes password alert and two-step verification for candidates and campaigns.
New Yorkers See 60% Rise in Data Breaches in 2016
Quick Hits  |  3/22/2017  | 
Attorney General Eric Schneiderman announced his office received nearly 1,300 data breaches in 2016, a 60% increase over 2015.
Malware Explained: Packer, Crypter & Protector
Partner Perspectives  |  3/22/2017  | 
These three techniques can protect malware from analysis. Heres how they work.
Page 1 / 4   >   >>


Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Compliance and Risk Management Officer, AvePoint, Inc,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15601
PUBLISHED: 2018-08-21
apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CVE-2018-15603
PUBLISHED: 2018-08-21
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVE-2018-15598
PUBLISHED: 2018-08-21
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
CVE-2018-15599
PUBLISHED: 2018-08-21
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
CVE-2018-0501
PUBLISHED: 2018-08-21
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.