News & Commentary

Content posted in May 2017
Page 1 / 3   >   >>
A Nation State-Looking Cyberattack that Wasn't
News  |  5/31/2017  | 
Symantec researchers uncover a cybercrime campaign with all the hallmarks of a state-sponsored campaign that didn't even make much money for the attackers.
Google Arms Gmail Security with Machine Learning
News  |  5/31/2017  | 
Google rolls out four security updates to protect enterprise Gmail accounts from phishing, data loss, and other threats.
Cybersecurity Insurance Lacking at 50% of US Companies
Quick Hits  |  5/31/2017  | 
While half of US security professionals say their companies passed on cybersecurity insurance, the figure is far higher in healthcare, according to a survey released today.
The Case for Disclosing Insider Breaches
Commentary  |  5/31/2017  | 
Too often organizations try to sweep intentional, accidental or negligent employee theft of data under the rug. Heres why they shouldnt.
Mobile App Back-End Servers, Databases at Risk
News  |  5/31/2017  | 
Mobile app developers'casual use of back-end technology like Elasticsearch without security-hardening puts unsuspecting enterprises at grave risk of exposure.
Most Security Pros Expect to Suffer Cyberattacks via Unsecured IoT
News  |  5/31/2017  | 
A new report shows the majority of security professionals believe within the next two years they will be victims of DDoS and other attacks due to unsecured IoT devices.
The Cons of a 'Silver Bullet' Approach to Endpoint Defense
News  |  5/31/2017  | 
Companies relying on individual security solutions won't find one is a 'silver bullet' that will provide seamless protection.
Rethinking Vulnerabilities: Network Infrastructure as a Software System
Commentary  |  5/31/2017  | 
Increasing complexity is putting networks at risk. It's time to shift our security approach and take some lessons from software development.
Cisco and IBM Team Up on Security
Quick Hits  |  5/31/2017  | 
The two tech titans enter into an agreement to collaborate on technology, services, and threat intelligence.
Securing the Human a Full-Time Commitment
News  |  5/30/2017  | 
Encouraging the people in your organization to make safer cyber decisions requires dedicated brainpower to pull off, SANS study shows.
Cybercriminals Regularly Battle it Out on the Dark Web
News  |  5/30/2017  | 
People operating criminal services on Tor and other darknets attack each other frequently, a study by Trend Micro shows.
Bot-Driven Online Ad Fraud Losses Decline
News  |  5/30/2017  | 
But counterfeit ad inventory the next big worry for online advertisers.
Cybercrime Costs to Reach $8 Trillion by 2022
Quick Hits  |  5/30/2017  | 
Some 2.8 billion data records expected to be breached in 2017, according to a report released today by Juniper Research.
Chipotle Dishes Details on Data Breach
Quick Hits  |  5/30/2017  | 
An investigation into the Chipotle security incident announced April 25 confirmed a timeline of attack and type of customer information exposed.
Securing IoT Devices Requires a Change in Thinking
Commentary  |  5/30/2017  | 
There's no magic bullet for IoT security, but there are ways to help detect and mitigate problems.
FTC: It Takes Criminals Just 9 Minutes to Use Stolen Consumer Info
Quick Hits  |  5/26/2017  | 
Federal Trade Commission experiment lured hackers to learn about how they use stolen consumer information.
Elections, Deceptions & Political Breaches
Commentary  |  5/26/2017  | 
Political hacks have many lessons for the business world.
8 Most Overlooked Security Threats
Slideshows  |  5/26/2017  | 
Businesses know the obvious security threats to watch for, but some of the biggest dangers may not at top-of-mind.
New Samba Bug Dangerous But No WannaCry
News  |  5/25/2017  | 
The administrators of the open-source Samba software have fixed a newly discovered vulnerability that lets attackers upload malicious files to vulnerable systems and servers.
In the Cloud, Evolving Infrastructure Means Evolving Alliances
Commentary  |  5/25/2017  | 
New opportunities make for unusual bedfellows. Here's how to navigate the shift in organizational dynamics between security operations, line-of-business managers, and developers.
3 Nigerian Cyberthieves Sentenced to Total of 235 Years in Prison
Quick Hits  |  5/25/2017  | 
Using love-struck girlfriends found on the Internet to help them carry out their schemes, three Nigerian cyberthieves and their cohorts made off with tens of millions of dollars in pilfered goods before they were ultimately sentenced to a collective total of 235 years in prison.
WannaCry Ransom Notes Penned by Chinese-Speaking Authors, Analysis Shows
News  |  5/25/2017  | 
But a Chinese-language link doesn't shoot down theories of the North Korean Lazarus Group's involvement in the ransomware worm attacks, say language experts at Flashpoint.
WannaCry Gives Consumers a First Look into Ransomware
Quick Hits  |  5/25/2017  | 
Although ransomware has been around for two years, it took the fast-moving and expansive WannaCry to provide a majority of consumers their first glimpse, according to a study released today.
You Have One Year to Make GDPR Your Biggest Security Victory Ever
News  |  5/25/2017  | 
The EU's new razor-toothed data privacy law could either rip you apart or help you create the best security program you've ever had. Here's how.
Medical Devices Fall Short in Security Best Practices
News  |  5/25/2017  | 
More than half of medical device makers and healthcare delivery organizations anticipate an attack on their medical devices within the next 12 months, but only a smattering take significant steps to prevent it, according to a survey released today.
Ransomware: Carding's Replacement for the Criminal Masses
Commentary  |  5/25/2017  | 
Ransomware is not only here to stay, it's going to proliferate by orders of magnitude and cause substantial risk to businesses for the foreseeable future.
82% of Databases Left Unencrypted in Public Cloud
News  |  5/25/2017  | 
Personal health information and other sensitive data is left exposed as businesses overlook encryption and network security.
Split Tunnel SMTP Exploit Bypasses Email Security Gateways
News  |  5/25/2017  | 
Attackers can inject malicious payloads directly to email server via email encryption appliances, Securolytics says.
WannaCry: The North Korea Debate
News  |  5/24/2017  | 
Researchers split over whether an infamous North Korean hacking group, an affiliate, or another attacker altogether, is behind the epic ransomware worm.
Unsanctioned Computer Support Costs Companies $88K per Year
Quick Hits  |  5/24/2017  | 
A new survey of security professionals says that 83% of respondents help colleagues in other departments fix their privately-owned computers on company time.
Data Security & Privacy: The Risks of Not Playing by the Rules
Commentary  |  5/24/2017  | 
Achieving compliance is a complex and challenging process. But with the right systems and policies, you can stay ahead of the next data breach and the regulators.
DDoS Attacks Fell 23% in First Quarter, Grew in Size
Quick Hits  |  5/24/2017  | 
Although the number of DDoS attacks dropped in the first three months of the year, the average size of each attack grew, according to a Verisign report released Tuesday.
Target Reaches Breach Settlement: $18.5 Million Fine, Security Controls
News  |  5/24/2017  | 
Target to cough up $18.5 million to 47 states in a settlement following its 2013 security breach, which exposed data of millions of customers.
4 Reasons the Vulnerability Disclosure Process Stalls
Commentary  |  5/24/2017  | 
The relationship between manufacturers and researchers is often strained. Here's why, along with some resources to help.
Data Breach, Vulnerability Data on Track to Set New Records in 2017
News  |  5/23/2017  | 
There are so far 1,254 publicly reported data breaches and 4,837 published vulnerabilities in the first quarter of this year.
Credential-Stuffing Threat Intensifies Amid Password Reuse
News  |  5/23/2017  | 
Employees who reuse logins on multiple websites drive the impact of third-party breaches as hackers use credential stuffing to compromise more accounts.
9 Ways Organizations Sabotage Their Own Security: Lessons from the Verizon DBIR
Slideshows  |  5/23/2017  | 
Mistakes and missteps plague enterprise security. The Verizon 2017 Data Breach Investigations Report (DBIR) offers nuggets on what organizations must stop doing now.
Staying a Step Ahead of Internet Attacks
Commentary  |  5/23/2017  | 
There's no getting around the fact that targeted attacks, such as spearphishing, will happen. But you can figure out the type of attack to expect next.
With Billions Spent on Cybersecurity, Why Are Problems Getting Worse?
Commentary  |  5/23/2017  | 
Technology alone won't keep you safe. Fully engaged employees should be your first line of defense.
Hacker Hit with 30-Month Prison Term in Securities Case
Quick Hits  |  5/23/2017  | 
Ukrainian hacker sentenced for his role stealing press releases about upcoming stock trades that generated roughly $30 million in illegal profits.
WannaCry Hit Windows 7 Machines Most
News  |  5/22/2017  | 
More than 95% of all of the infected machines were running Windows 7, according to Kaspersky Lab data.
Russian 'Cron' Cyber Gang Arrested for Raiding Bank Accounts
Quick Hits  |  5/22/2017  | 
Russian authorities arrest a group of 16 hackers who allegedly were attacking banks in their native country via mobile malware, nixing plans for their global expansion.
Emerging Threats to Add to Your Security Radar Screen
News  |  5/22/2017  | 
The cybersecurity threat landscape is poised to grow in size and complexity - what to look out for.
Chinese Man Pleads Guilty to Espionage, Theft from US Firm
Quick Hits  |  5/22/2017  | 
Chinese national Xu Jiaqiang pleaded guilty to economic espionage and theft of trade secrets from his former employer in the US.
In Search of an Rx for Enterprise Security Fatigue
Commentary  |  5/22/2017  | 
Are you exhausted by the vast number of measures your organization needs to keep its systems and data safe? You're not alone.
Researcher Creates Tool to Unlock WannaCry-Infected Windows XP Files
Quick Hits  |  5/19/2017  | 
A security researcher appears to have discovered a flaw in WannaCry that may provide Windows XP victims of the attack with a way to unlock their files.
Ransomware Rocks Endpoint Security Concerns
News  |  5/19/2017  | 
Meanwhile, threat detection technologies are evolving that can help security teams spot incidents more efficiently.
Deconstructing the 2016 Yahoo Security Breach
Commentary  |  5/19/2017  | 
One good thing about disasters is that we can learn from them and avoid repeating the same mistakes. Here are five lessons that the Yahoo breach should have taught us.
5 Security Lessons WannaCry Taught Us the Hard Way
News  |  5/18/2017  | 
There is a lot more our industry should be doing to protect its systems and data from cyber blackmail.
APT3 Threat Group a Contractor for Chinese Intelligence Agency
News  |  5/18/2017  | 
Recorded Future says its research shows clear link between cyber threat group and China's Ministry of State Security.
Page 1 / 3   >   >>


6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.