News & Commentary

Content posted in March 2017
Page 1 / 4   >   >>
Trump Extends Obama's EO for Sanctioning Hackers
Quick Hits  |  3/31/2017  | 
EO ultimately led to sanctions against Russia for hacking and other attempts to tamper with the outcome of the US election.
'Sundown' Rises as New Threat in Depleted Exploit Kit Landscape
News  |  3/31/2017  | 
New exploits and obfuscation tactics have made once second-tier EK a potent threat, researchers from Cisco Talos say.
Customized Malware: Confronting an Invisible Threat
Commentary  |  3/31/2017  | 
Hackers are gaining entry to networks through a targeted approach. It takes a rigorous defense to keep them out.
Germany Creates Separate Military Wing for Cyber Command
Quick Hits  |  3/31/2017  | 
The new unit to tackle cyberattacks will be launched next week and be located in Bonn with staff of 260.
Romanian Man Pleads Guilty to ATM Skimming Scheme
Quick Hits  |  3/31/2017  | 
Radu Bogdan Marin allegedly used stolen account details and fake ATM cards to withdraw tens of thousands of dollars.
US Border Policy Shifts May Drive Changes in Laptop Security
News  |  3/31/2017  | 
In-cabin laptop ban and requirements to unlock devices for border patrol could have enterprises revisiting their on-device data policies.
The Business of Security: How your Organization Is Changing beneath You
Commentary  |  3/30/2017  | 
And why its your job to change with it and skate where the puck is headed.
Payment Card Industry Security Compliance: What You Need to Know
Commentary  |  3/30/2017  | 
A quick refresher on all the different PCI SSC security standards that are relevant for organizations that accept electronic payments.
Patch Unlikely for Widely Publicized Flaw in Microsoft IIS 6.0
Quick Hits  |  3/30/2017  | 
Microsoft recommends upgrade to latest operating system for more protection.
Internet's Security Woes are Not All Technical
News  |  3/30/2017  | 
Google engineer Halvar Flake told Black Hat Asia attendees that flaws in organizational structure and market power put enterprises at risk.
30% of Q4 Malware was New or Zero-Day
Quick Hits  |  3/30/2017  | 
WatchGuard quarterly report, based on Firebox Feed data, lists five key findings on Internet security threats.
Insider Threat Fear Greater Than Ever, Survey Shows
News  |  3/29/2017  | 
More than half of security pros say insider threat incidents have become more frequent in the past 12 months.
Privacy Babel: Making Sense of Global Privacy Regulations
Commentary  |  3/29/2017  | 
Countries around the world are making their own privacy laws. How can a global company possibly keep up?
Russian Man Pleads Guilty for his Role in Ebury Botnet
Quick Hits  |  3/29/2017  | 
Maxim Senakh, arrested by Finnish authorities and extradited to the US, will be sentenced this August.
Dutch Parliament Website Suffers Ransomware Attack
Quick Hits  |  3/29/2017  | 
Hackers, suspected to belong to Turkish groups, continue to target Dutch websites.
Millions of Stolen US University Email Credentials for Sale on the Dark Web
News  |  3/29/2017  | 
Researchers find booming underground market for stolen and fake email credentials from the 300 largest universities in the US.
To Gain Influence, CISOs Must Get Security's Human Element Right
Commentary  |  3/29/2017  | 
Focusing on certain elements of security in isolation can cause a false sense of security.
Cerber Ransomware Now Evades Machine Learning
News  |  3/29/2017  | 
New variant has been broken into separate harmless-looking components to fool ML-based detection systems, Trend Micro says.
Cloud Security: New Research Says IT Pros Still Skittish
News  |  3/29/2017  | 
Respondents complain in two studies that traditional security tools dont work in the cloud, and cant deliver visibility across multiple cloud environments.
Should Trump Tackle Air-Gapped Critical Infrastructure?
News  |  3/28/2017  | 
MIT experts issue recommendations to the president, urging him to take elements of the electric grid and gas pipeline offline - but other security experts say that ship has sailed.
Commercial IoT: Big Trouble in Small Devices
Commentary  |  3/28/2017  | 
There are endless scenarios where hackers could wreak havoc on the industrial Internet of Things. Theres also a readily available solution called HIP.
1.4 Billion Data Records Exposed in 2016 Breaches
Quick Hits  |  3/28/2017  | 
The number of data records breached soared in 2016 over the previous year, with the technology sector facing the brunt of the attacks.
Exploit Kits: Winter 2017 Review
Partner Perspectives  |  3/28/2017  | 
We take another look at the current EK scene by going over RIG, Sundown, Neutrino and Magnitude.
How Identity Deception Increases the Success of Ransomware
Commentary  |  3/28/2017  | 
As scammers hone their skills, their handiwork looks more credible to intended victims, making a successful ransomware scam more likely.
Jail Time Set for Two More Members of Global Telecom Fraud Scheme
Quick Hits  |  3/28/2017  | 
Ramon Batista and Farintong Calderon have been sentenced to 75 months and 36 months in prison, respectively.
Two Israeli Youths May Be Charged for vDOS Operation
Quick Hits  |  3/28/2017  | 
Israeli authorities prepare to accuse two 18-year-olds for the online attack service, which caused $1.65 million in losses.
Hacking the Business Email Compromise
News  |  3/27/2017  | 
BEC attacks are on the rise, but plain-old spoofing of business executives' email accounts remains more prevalent.
FBI: Attackers Targeting Anonymous FTP Servers in Healthcare
News  |  3/27/2017  | 
The FBI warns medical and dental organizations of cybercriminals targeting anonymous FTP servers to steal personal health data.
Symantec Seeks to Quell CA Customer Concerns over Google Warning
Quick Hits  |  3/27/2017  | 
Exec at Symantec spells out what company will do if Google follows through on its proposed plans to degrade trust in Symantec certs.
This Week On Dark Reading: Event Calendar
Commentary  |  3/27/2017  | 
Ransomware remediation and recovery this week, with clouds on the horizon.
Data Visualization: Keeping an Eye on Security
Commentary  |  3/27/2017  | 
Visualization can be one of the most powerful approaches a security team can use to make sense of vast quantities of data. So why does it end up as an afterthought?
40% of Discarded Digital Devices Contain Personal Data
Quick Hits  |  3/27/2017  | 
NAID study of 250 devices in resale markets found tablets contained the most recoverable personal information.
Cybercriminals Exploit March Madness Frenzy
Quick Hits  |  3/27/2017  | 
Users are clicking on dubious links to stream matches and exposing confidential data to hackers, says Zscaler.
Google Slams Symantec for 'Failures' in SSL/TLS Certificate Process
Quick Hits  |  3/24/2017  | 
Google Chrome engineers railed on Symantec for allegedly issuing thousands of security certificates that had not been properly validated.
Apple: Mac, iPhone Bugs That CIA Allegedly Exploited Were Fixed Years Ago
News  |  3/24/2017  | 
New WikiLeaks data dump describes "Sonic Screwdriver," other CIA exploits for Mac desktops and iPhones
Intro to Cyber Insurance: 7 Questions to Ask
Slideshows  |  3/24/2017  | 
Buying a cyber insurance policy can be complex and difficult. Make sure you're asking these questions as you navigate the process.
America's JobLink Suffers Security Breach
Quick Hits  |  3/24/2017  | 
A third-party hacker exploited a flaw in America's JobLink application code to access the information of job seekers from 10 states.
Sandia Testing New Intrusion Detection Tool That Mimics Human Brain
News  |  3/24/2017  | 
Neuromorphic Data Microscope can spot malicious patterns in network traffic 100 times faster than current tool, lab claims.
US Senate Overturns Obama Consumer Privacy Rule
Quick Hits  |  3/24/2017  | 
The FCC regulation, passed in October, was rejected in a 50-to-48 vote and is now in the House of Representatives.
Prioritizing Threats: Why Most Companies Get It Wrong
Commentary  |  3/24/2017  | 
To stay safer, focus on multiple-threat attack chains rather than on individual threats.
7 Steps to Transforming Yourself into a DevSecOps Rockstar
Slideshows  |  3/23/2017  | 
Security practitioners at one education software firm offer lessons learned from merging DevOps with security.
5 Ways CISOs Could Work Better with Their Cyber Insurers
Commentary  |  3/23/2017  | 
Risk management has become increasingly important, making it crucial companies have good relationships with their insurance company.
LastPass Fixes Serious Security Flaw in Chrome, Firefox Extensions
Quick Hits  |  3/23/2017  | 
Password manager LastPass creates a workaround for a serious vulnerability affecting browser extensions in Chrome, Firefox, and Microsoft Edge.
US May Charge North Korea in Bangladesh Bank Cybertheft
Quick Hits  |  3/23/2017  | 
The potential case accuses North Korea, and suspected Chinese middlemen, of spearheading an $81-million theft from Bangladesh Bank.
Russian Man Pleads Guilty for Role in Citadel Malware Attacks
Quick Hits  |  3/23/2017  | 
Russian national Mark Vartanyan pleads guilty in US federal court following his December 2016 extradition from Norway.
20 Million Mobile Devices at High Risk of Attack, Study Finds
News  |  3/23/2017  | 
Meanwhile, a separate report by Google says half of all Android devices didn't install a single security update in 2016.
Windows 'DoubleAgent' Attack Turns AV Tools into Malware
News  |  3/22/2017  | 
Zero-day attack exploits a legitimate process in Windows, according to Cybellum; AV vendors downplay threat.
Google, Jigsaw Offer Free Cyber Protection to Election Sites
Quick Hits  |  3/22/2017  | 
The Protect Your Election package from Google and Jigsaw includes password alert and two-step verification for candidates and campaigns.
New Yorkers See 60% Rise in Data Breaches in 2016
Quick Hits  |  3/22/2017  | 
Attorney General Eric Schneiderman announced his office received nearly 1,300 data breaches in 2016, a 60% increase over 2015.
Malware Explained: Packer, Crypter & Protector
Partner Perspectives  |  3/22/2017  | 
These three techniques can protect malware from analysis. Heres how they work.
Page 1 / 4   >   >>


Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.