News & Commentary
Content posted in April 2014
|
Sefnit Botnet Swaps Tor for SSH
Facebook security researchers spot a Sefnit/Mevade click-fraud and Bitcoin-mining botnet returning to its previous SSH command-and-control communications infrastructure.
How Enterprises Can Harvest The Knowledge Of Security-Focused Venture Capitalists
Tomorrow’s game-changing security startups are meeting with investors today. Here are some tips on how you take advantage of smart guidance from venture funding firms.
Post-Heartbleed: When Not To Change Your Password
One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.
European Police Seek Cybercrime Triage
Many organized cybercrime gangs operate beyond European and US borders -- or jurisdiction -- thus making online crime eradication impossible.
Consumers Ditch Their Breached Retailers, Banks and Doctors
New survey shows how data breaches do affect some consumers' buying decisions.
What Not To Do In a Cyberattack
How to keep calm and avoid common mistakes in an incident response operation.
New IE Zero-Day Prompts More Calls to Ditch Windows XP
Experts call for Windows XP users running IE to be mindful that they should upgrade to a new system supported by Microsoft.
AOL Subscriber Data Stolen: You've Got Pwned
Change passwords and security questions now, AOL warns subscribers. For everyone else, treat all emails from AOL addresses with suspicion.
Mobile & Social: The Tipping Point For Cybercrime
Spamming and scamming has moved to social media in full force, according to new research on the Twittersphere from Trend Micro.
Microsoft Warns Of Zero-Day Vulnerability In Internet Explorer
Zero-day security vulnerability in IE 6-11 could allow remote code execution even if the user doesn't click on anything, Microsoft says.
SEC Requests Financial Firms' Security Details
SEC asks 50 businesses for copies of their security policies, procedures, and controls in an effort to help the industry bolster cybersecurity protection.
Organized Crime Group Scams US Companies Out Of Millions
Social engineering attack tricks companies into large wire transfers.
Why Bug Bounties Are The New Normal
Bug bounties today are big business. Find out how crowdsourcing is changing the dynamics of independent security research and vulnerability disclosure.
FBI Warning Highlights Healthcare's Security Infancy
Cyberattacks likely to increase against healthcare providers, FBI warns, and experts say it's no surprise since industry's security posture is about a decade behind that of the financial services sector.
After Heartbleed, Tech Giants Fund Open Source Security
In the wake of the Heartbleed vulnerability, 12 tech giants -- including Facebook, Google, IBM, and Microsoft -- each pledge $100,000 annually to improve core open source technology such as OpenSSL.
Data Security: Think Outside The Box
What the public and private sector can learn from each other's data security priorities is an exercise in nuance that is well worth the effort. Here's why.
Employees Slacking on Security of Their Mobile Devices
A survey says that 15% say they had a password compromised.
FBI Informant Sabu Tied To Foreign Attacks
Report triggers questions about FBI's apparent use of a zero-day vulnerability, and whether campaign was designed to amass intelligence on foreign targets.
Venture Capital: The Lifeblood Behind Security Innovation
Want to know where the next generation of IT security innovation and technology is coming from? Follow the money.
Report: Some Retail Firms Still Don't Recognize Cyber Security Risks
Nearly 10 percent of retail firms have not reported any cyber security exposure to the SEC since 2011, Willis Group says.
How To Detect Heartbleed Mutations
The nightmare of Heartbleed is not the chaos of fixing the bug. It's identifying hundreds, possibly thousands, of small mutations still hiding in the network.
Intelligence-Sharing Suffers Growing Pains
For most organizations, intelligence-sharing remains mainly ad-hoc and informal -- and thus fraught with frustration and pitfalls, new report from Ponemon finds.
Android Heartbleed Alert: 150 Million Apps Still Vulnerable
Android developers are starting to patch OpenSSL flaws. Meanwhile, Apple ships an SSL fix for iOS and OS X.
Workplace Data Privacy Vs. Security: The New Balance
Is it time to rethink the traditional lock-down approach to employee use of corporate networks at work?
Michaels Data Breach Response: 7 Facts
Could the retailer have done more to spot the eight-month intrusion in the first place?
Bots Attack US Mainly During Dinnertime
Most bot-infected machines hail from the US and wage attacks there between 6 and 9 p.m. Eastern Time, new report finds.
7 Tips To Improve 'Signal-to-Noise' In The SOC
When security analysts are desensitized to alerts because of sheer volume, they miss the true positives that can prevent a large-scale data breach. Here's how to up your game.
Free Scanning Tool Promises To Find Heartbleed On Any Device
CrowdStrike says tool identifies the flaw on web servers, VPNs, servers, routers, printers, and phones.
Stolen Passwords Used In Most Data Breaches
New Verizon 2014 Data Breach Investigations Report identifies nine types of attack patterns that accounted for 93 percent of security incidents in the past decade.
FAQ: Understanding The True Price of Encryption
In the wake of recent events like Heartbleed, the search for cost-effective, easy, and scalable encryption solutions has never been more important.
Heartbleed Attack Targeted Enterprise VPN
Attack spotted using the OpenSSL Heartbleed bug to steal session tokens and bypass two-factor authentication.
Michaels Retail Chain Reveals Details Of Breach: Nearly 3M Affected
Attack on point-of-sale systems went on for more than six months, officials say.
Poll: Dark Reading Community Acts On Heartbleed
Roughly 60 percent of respondents to our flash poll have installed the Heartbeat fix or are in the process of doing so.
Heartbleed: A Password Manager Reality Check
Is a password manager an effective defense against vulnerabilities like Heartbleed, or just another way to lose data to hackers?
Phishers Recruit Home PCs
Residential broadband machines spotted hosting phishing attacks.
SQL Injection Cleanup Takes Two Months or More
A new report highlights the prevalence and persistence of SQL injection attacks.
Satellite Communications Wide Open To Hackers
Satellite terminals widely used in transportation, military, and industrial plants contain backdoors, hardcoded credentials, weak encryption algorithms, and other design flaws, a new report says.
11 Heartbleed Facts: Vulnerability Discovery, Mitigation Continue
Millions of websites, applications from Cisco and VMware, Google Play apps, as well as millions of Android devices are vulnerable -- and the list keeps growing.
Microsoft Delays Enterprise Windows 8.1 Support Doomsday
Responding to criticism, Microsoft gives businesses until August to adopt Windows 8.1 Update and continue receiving security updates. Consumers still face May 13 deadline.
How A Little Obscurity Can Bolster Security
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
Did A Faulty Memory Feature Lead To Heartbleed?
Debate arises over an older memory allocation feature in OpenSSL, and the OpenBSD community starts to tear down and revise the crypto software for its own use.
The Real Wakeup Call From Heartbleed
There's nothing special about Heartbleed. It’s another flaw in a popular library that exposed a lot of servers to attack. The danger lies in the way software libraries are built and whether they can be trusted.
Mobility: Who Bears The Brunt Of Data Security & Privacy
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
Don't Blame It On The Web Programming Platform
New data shows no one Web development platform generates more vulnerabilities than another -- and website security is still a problem.
White House Details Zero-Day Bug Policy
NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.
Active Directory Is Dead: 3 Reasons
These days, Active Directory smells gangrenous to innovative companies born in the cloud and connecting customers, employees, and partners across devices at light speed.
Heartbleed's Intranet & VPN Connection
How the game-changing crypto bug affects internal servers, clients, and VPN networks -- and what to do about it.
Akamai Withdraws Proposed Heartbleed Patch
As researchers demonstrate OpenSSL bug exploits that retrieve private keys, Akamai rescinds a patch suggestion for the SSL/TLS library after a security researcher punches holes in it.
CIO Vs. CSO: Allies Or Enemies?
In the wake of the Target breach it's clear that the CIO and CSO must have clear boundaries of responsibility and equal representation in the board room.
|
White Papers
Video
0 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security — even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-10839
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
From DHS/US-CERT's National Vulnerability Database CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This