Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in March 2017
Page 1 / 4   >   >>
Trump Extends Obama's EO for Sanctioning Hackers
Quick Hits  |  3/31/2017  | 
EO ultimately led to sanctions against Russia for hacking and other attempts to tamper with the outcome of the US election.
'Sundown' Rises as New Threat in Depleted Exploit Kit Landscape
News  |  3/31/2017  | 
New exploits and obfuscation tactics have made once second-tier EK a potent threat, researchers from Cisco Talos say.
Customized Malware: Confronting an Invisible Threat
Commentary  |  3/31/2017  | 
Hackers are gaining entry to networks through a targeted approach. It takes a rigorous defense to keep them out.
Germany Creates Separate Military Wing for Cyber Command
Quick Hits  |  3/31/2017  | 
The new unit to tackle cyberattacks will be launched next week and be located in Bonn with staff of 260.
Romanian Man Pleads Guilty to ATM Skimming Scheme
Quick Hits  |  3/31/2017  | 
Radu Bogdan Marin allegedly used stolen account details and fake ATM cards to withdraw tens of thousands of dollars.
US Border Policy Shifts May Drive Changes in Laptop Security
News  |  3/31/2017  | 
In-cabin laptop ban and requirements to unlock devices for border patrol could have enterprises revisiting their on-device data policies.
The Business of Security: How your Organization Is Changing beneath You
Commentary  |  3/30/2017  | 
And why its your job to change with it and skate where the puck is headed.
Payment Card Industry Security Compliance: What You Need to Know
Commentary  |  3/30/2017  | 
A quick refresher on all the different PCI SSC security standards that are relevant for organizations that accept electronic payments.
Patch Unlikely for Widely Publicized Flaw in Microsoft IIS 6.0
Quick Hits  |  3/30/2017  | 
Microsoft recommends upgrade to latest operating system for more protection.
Internet's Security Woes are Not All Technical
News  |  3/30/2017  | 
Google engineer Halvar Flake told Black Hat Asia attendees that flaws in organizational structure and market power put enterprises at risk.
30% of Q4 Malware was New or Zero-Day
Quick Hits  |  3/30/2017  | 
WatchGuard quarterly report, based on Firebox Feed data, lists five key findings on Internet security threats.
Insider Threat Fear Greater Than Ever, Survey Shows
News  |  3/29/2017  | 
More than half of security pros say insider threat incidents have become more frequent in the past 12 months.
Privacy Babel: Making Sense of Global Privacy Regulations
Commentary  |  3/29/2017  | 
Countries around the world are making their own privacy laws. How can a global company possibly keep up?
Russian Man Pleads Guilty for his Role in Ebury Botnet
Quick Hits  |  3/29/2017  | 
Maxim Senakh, arrested by Finnish authorities and extradited to the US, will be sentenced this August.
Dutch Parliament Website Suffers Ransomware Attack
Quick Hits  |  3/29/2017  | 
Hackers, suspected to belong to Turkish groups, continue to target Dutch websites.
Millions of Stolen US University Email Credentials for Sale on the Dark Web
News  |  3/29/2017  | 
Researchers find booming underground market for stolen and fake email credentials from the 300 largest universities in the US.
To Gain Influence, CISOs Must Get Security's Human Element Right
Commentary  |  3/29/2017  | 
Focusing on certain elements of security in isolation can cause a false sense of security.
Cerber Ransomware Now Evades Machine Learning
News  |  3/29/2017  | 
New variant has been broken into separate harmless-looking components to fool ML-based detection systems, Trend Micro says.
Cloud Security: New Research Says IT Pros Still Skittish
News  |  3/29/2017  | 
Respondents complain in two studies that traditional security tools dont work in the cloud, and cant deliver visibility across multiple cloud environments.
Should Trump Tackle Air-Gapped Critical Infrastructure?
News  |  3/28/2017  | 
MIT experts issue recommendations to the president, urging him to take elements of the electric grid and gas pipeline offline - but other security experts say that ship has sailed.
Network Operations Filled With Unplanned Activity
Curt Franklin  |  3/28/2017  | 
Network operations spends vast amounts of time reacting to events. What does that mean for your organization and its people?
Commercial IoT: Big Trouble in Small Devices
Commentary  |  3/28/2017  | 
There are endless scenarios where hackers could wreak havoc on the industrial Internet of Things. Theres also a readily available solution called HIP.
1.4 Billion Data Records Exposed in 2016 Breaches
Quick Hits  |  3/28/2017  | 
The number of data records breached soared in 2016 over the previous year, with the technology sector facing the brunt of the attacks.
Exploit Kits: Winter 2017 Review
Partner Perspectives  |  3/28/2017  | 
We take another look at the current EK scene by going over RIG, Sundown, Neutrino and Magnitude.
How Identity Deception Increases the Success of Ransomware
Commentary  |  3/28/2017  | 
As scammers hone their skills, their handiwork looks more credible to intended victims, making a successful ransomware scam more likely.
Jail Time Set for Two More Members of Global Telecom Fraud Scheme
Quick Hits  |  3/28/2017  | 
Ramon Batista and Farintong Calderon have been sentenced to 75 months and 36 months in prison, respectively.
Two Israeli Youths May Be Charged for vDOS Operation
Quick Hits  |  3/28/2017  | 
Israeli authorities prepare to accuse two 18-year-olds for the online attack service, which caused $1.65 million in losses.
Hacking the Business Email Compromise
News  |  3/27/2017  | 
BEC attacks are on the rise, but plain-old spoofing of business executives' email accounts remains more prevalent.
FBI: Attackers Targeting Anonymous FTP Servers in Healthcare
News  |  3/27/2017  | 
The FBI warns medical and dental organizations of cybercriminals targeting anonymous FTP servers to steal personal health data.
Symantec Seeks to Quell CA Customer Concerns over Google Warning
Quick Hits  |  3/27/2017  | 
Exec at Symantec spells out what company will do if Google follows through on its proposed plans to degrade trust in Symantec certs.
This Week On Dark Reading: Event Calendar
Commentary  |  3/27/2017  | 
Ransomware remediation and recovery this week, with clouds on the horizon.
Data Visualization: Keeping an Eye on Security
Commentary  |  3/27/2017  | 
Visualization can be one of the most powerful approaches a security team can use to make sense of vast quantities of data. So why does it end up as an afterthought?
40% of Discarded Digital Devices Contain Personal Data
Quick Hits  |  3/27/2017  | 
NAID study of 250 devices in resale markets found tablets contained the most recoverable personal information.
Security, Cloud & the SBC
News Analysis-Security Now  |  3/27/2017  | 
Despite all the current hype surrounding 5G at the moment, it's cloud and security technologies that are fundamentally driving business growth opportunities for communications service providers.
Cybercriminals Exploit March Madness Frenzy
Quick Hits  |  3/27/2017  | 
Users are clicking on dubious links to stream matches and exposing confidential data to hackers, says Zscaler.
Google Slams Symantec for 'Failures' in SSL/TLS Certificate Process
Quick Hits  |  3/24/2017  | 
Google Chrome engineers railed on Symantec for allegedly issuing thousands of security certificates that had not been properly validated.
Apple: Mac, iPhone Bugs That CIA Allegedly Exploited Were Fixed Years Ago
News  |  3/24/2017  | 
New WikiLeaks data dump describes "Sonic Screwdriver," other CIA exploits for Mac desktops and iPhones
Intro to Cyber Insurance: 7 Questions to Ask
Slideshows  |  3/24/2017  | 
Buying a cyber insurance policy can be complex and difficult. Make sure you're asking these questions as you navigate the process.
America's JobLink Suffers Security Breach
Quick Hits  |  3/24/2017  | 
A third-party hacker exploited a flaw in America's JobLink application code to access the information of job seekers from 10 states.
Sandia Testing New Intrusion Detection Tool That Mimics Human Brain
News  |  3/24/2017  | 
Neuromorphic Data Microscope can spot malicious patterns in network traffic 100 times faster than current tool, lab claims.
US Senate Overturns Obama Consumer Privacy Rule
Quick Hits  |  3/24/2017  | 
The FCC regulation, passed in October, was rejected in a 50-to-48 vote and is now in the House of Representatives.
Prioritizing Threats: Why Most Companies Get It Wrong
Commentary  |  3/24/2017  | 
To stay safer, focus on multiple-threat attack chains rather than on individual threats.
7 Steps to Transforming Yourself into a DevSecOps Rockstar
Slideshows  |  3/23/2017  | 
Security practitioners at one education software firm offer lessons learned from merging DevOps with security.
5 Ways CISOs Could Work Better with Their Cyber Insurers
Commentary  |  3/23/2017  | 
Risk management has become increasingly important, making it crucial companies have good relationships with their insurance company.
LastPass Fixes Serious Security Flaw in Chrome, Firefox Extensions
Quick Hits  |  3/23/2017  | 
Password manager LastPass creates a workaround for a serious vulnerability affecting browser extensions in Chrome, Firefox, and Microsoft Edge.
US May Charge North Korea in Bangladesh Bank Cybertheft
Quick Hits  |  3/23/2017  | 
The potential case accuses North Korea, and suspected Chinese middlemen, of spearheading an $81-million theft from Bangladesh Bank.
Russian Man Pleads Guilty for Role in Citadel Malware Attacks
Quick Hits  |  3/23/2017  | 
Russian national Mark Vartanyan pleads guilty in US federal court following his December 2016 extradition from Norway.
20 Million Mobile Devices at High Risk of Attack, Study Finds
News  |  3/23/2017  | 
Meanwhile, a separate report by Google says half of all Android devices didn't install a single security update in 2016.
Windows 'DoubleAgent' Attack Turns AV Tools into Malware
News  |  3/22/2017  | 
Zero-day attack exploits a legitimate process in Windows, according to Cybellum; AV vendors downplay threat.
Security Takes the Stage at Oracle Industry Connect
Curt Franklin  |  3/22/2017  | 
Security is a supporting player at Oracle Industry Connect. Is it hero or villain to the assembled customers and partners?
Page 1 / 4   >   >>


Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27099
PUBLISHED: 2021-03-05
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the v...
CVE-2021-28038
PUBLISHED: 2021-03-05
An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during m...
CVE-2021-28039
PUBLISHED: 2021-03-05
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFI...
CVE-2021-28040
PUBLISHED: 2021-03-05
An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in _ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached.
CVE-2020-28502
PUBLISHED: 2021-03-05
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.