News & Commentary
Content posted in July 2014
|
'Energetic' Bear Under The Microscope
Kaspersky Lab report finds more industries hit by the infamous cyber espionage campaign -- and evidence pointing to French and Swedish-speaking attackers as well as Eastern European ones.
InfoSec’s Holy Grail: Data Sharing & Collaboration
Despite all the best intentions, cooperation around Internet security is still a work in progress. Case in point: Microsoft’s unilateral action against No-IP.
10 Dramatic Moments In Black Hat History
From Google hacking to ATM "jackpotting" to the NSA -- Black Hat has had some memorable moments over the years.
New Mobile Phone '0wnage' Threat Discovered
Widespread major vulnerabilities discovered in client control software that affect nearly all smartphone platforms: Details to come at Black Hat USA next week.
Phishing: What Once Was Old Is New Again
I used to think the heyday of phishing had passed. But as Symantec notes in its 2014 Internet Security Threat Report, I was wrong!
Security Holes Found In Some DLP Products
Researchers to reveal key security flaws in commercial and open-source data loss prevention software at Black Hat USA next week.
Dark Reading Radio: Data Loss Prevention (DLP) Fail
Learn about newly found vulnerabilities in commercial and open-source DLP software in our latest episode of Dark Reading Radio with security researchers Zach Lanier and Kelly Lum.
Scan Shows Possible Heartbleed Fix Failures
Study indicates many Global 2000 firms patched, but failed to replace digital certificates.
The Perfect InfoSec Mindset: Paranoia + Skepticism
A little skeptical paranoia will ensure that you have the impulse to react quickly to new threats while retaining the logic to separate fact from fiction.
Internet Of Things Contains Average Of 25 Vulnerabilities Per Device
New study finds high volume of security flaws in such IoT devices as webcams, home thermostats, remote power outlets, sprinkler controllers, home alarms, and garage door openers.
DHS-Funded 'SWAMP' Helps Scour Code For Bugs
Cloud-based platform offering free secure coding tools for developers in government, enterprises, academia, gaining commercial attention as well.
Weak Password Advice From Microsoft
Tempting as it may seem to do away with strong passwords for low-risk websites, password reuse is still a significant threat to both users and business.
Myth-Busting Machine Learning In Security
Black Hat USA presentation to help quell misconceptions and confusion over machine learning methods in today's security tools.
Researchers Develop 'BlackForest' To Collect, Correlate Threat Intelligence
Researchers at the Georgia Tech Research Institute develop the BlackForest system to help organizations uncover and anticipate cyberthreats.
Internet of Things: 4 Security Tips From The Military
The military has been connecting mobile command posts, unmanned vehicles, and wearable computers for decades. It’s time to take a page from their battle plan.
Travel Agency Fined £150,000 For Violating Data Protection Act
That'll teach them not to retain credit card data in perpetuity.
Passwords Be Gone! Removing 4 Barriers To Strong Authentication
As biometric factors become more prevalent on mobile devices, FIDO Alliance standards will gain traction as an industry-wide authentication solution.
7 Arrested, 3 More Indicted For Roles In Cyber Fraud Ring That Stung StubHub
Arrests made in New York state, London, Toronto, and Spain for money laundering, grand larceny, and using StubHub customers' credit cards to buy and sell 3,500 e-tickets to prime events.
RAM Scraper Malware: Why PCI DSS Can't Fix Retail
There is a gaping hole in the pre-eminent industry security standard aimed at protecting customers, credit card and personal data
Dark Reading Radio: The Winners & Losers of Botnet Takedowns
Our guests are Cheri McGuire, VP of global government affairs and cyber security policy for Symantec, and Craig D. Spiezle, executive director and founder of the Online Trust Alliance.
7 Black Hat Sessions Sure To Cause A Stir
At Black Hat, researchers will point out the weaknesses in everything from the satellites in outer space to the thermostat in your home.
Nigerian 419 Scammers Evolving Into Malware Pushers (But Not Very Good Ones)
"Silver Spaniel" attacks use commodity malware to damage others' security, but they aren't very good at protecting their own.
Infographic: With BYOD, Mobile Is The New Desktop
Security teams have no choice but to embrace the rapid proliferation of BYO devices, apps, and cloud services. To ignore it is to put your head in the sand.
Don't Overestimate EMV Protections, Underestimate Card Thief Sophistication
At Black Hat, an AccessData researcher will offer up a crash course in card payment tech and protections to root out security community misconceptions
Internet of Things: Security For A World Of Ubiquitous Computing
Endpoint security is hardly dead, and claiming that it is oversimplifies the challenges corporations face now and in the not-very-distant future.
Hacking Your Hotel Room
At Black Hat USA next month, a researcher will show how to hack your way into controlling everything in a hotel room -- from lighting to television sets.
CEO Report Card: Low Grades for Risk Management
Dark Reading's latest community poll shows a stunning lack of confidence in chief execs' commitment to cyber security.
Government-Grade Stealth Malware In Hands Of Criminals
"Gyges" can be bolted onto other malware to hide it from anti-virus, intrusion detection systems, and other security tools.
Website Hacks Dropped During World Cup Final
Hackers apparently took time off to watch the Germany-Argentina title match of the 2014 FIFA World Cup.
A New Age in Cyber Security: Public Cyberhealth
The cleanup aimed at disrupting GameOver Zeus and CryptoLocker offers an instructive template for managing mass cyber infections.
Ransomware: 5 Threats To Watch
Cyber criminals have kicked it up a notch with nasty malware that locks you out of your machine and holds it for ransom.
Senate Hearing Calls For Changes To Cybercrime Law
In the wake of Microsoft's seizure of No-IP servers and domains, private and public sector representatives met to discuss what can be done to address the problem of botnets.
Passwords & The Future Of Identity: Payment Networks?
The solution to the omnipresent and enduring password problem may be closer than you think.
Automobile Industry Accelerates Into Security
Industry looking at intelligence-sharing platform or an Auto-ISAC in anticipation of more automated, connected -- and vulnerable -- vehicles.
Payment Card Data Theft: Tips For Small Business
For small businesses looking to reduce their exposure to data theft the good news is the advantage of being small.
Tapping Into A Homemade Android Army
Black Hat speaker will detail how security researchers can expedite their work across numerous Android devices at once.
Active Directory Flaw Lets Attackers Change Passwords
Aorato finds way to compromise Active Directory and change passwords without being noticed by SIEM.
Google Forms Zero-Day Hacking Team
'Project Zero' to hunt bugs in all software that touches the Net.
Dark Reading Radio: Where Do Security Startups Come From?
This week's radio broadcast will discuss how hot new security companies are born and how they are funded. Showtime is 1:00 p.m. ET.
DropCam Vulnerable To Hijacking
Researchers at DEF CON to demonstrate flaws in a popular WiFi video monitoring system.
New GameoverZeuS Variant Found In The Wild
A new botnet abandons peer-to-peer communication and may or may not be operated by the one disrupted by Operation Tovar last month.
How Next-Generation Security Is Redefining The Cloud
Your cloud, datacenter, and infrastructure all contain flexible and agile components. Your security model should be the same.
Hacking Password Managers
Researchers find four classes of common vulnerabilities in popular password managers and recommend greater industry scrutiny and more automated ways to find vulnerabilities.
Attack Campaign Targets Facebook, Dropbox User Credentials
The goal of the attackers is not fully clear but the credential theft could set up sophisticated targeted attackers.
While Brazilians Watch World Cup, Bank Fraudsters Are At Work
Passive biometrics allow BioCatch to tell the difference between busy fraudsters and distraught soccer fans.
Strategic Security: Begin With The End In Mind
The trouble with traditional infosec methodology is that it doesn’t show us how to implement a strategic security plan in the real world.
Study: Most Critical Infrastructure Firms Have Been Breached
A new Ponemon Institute study finds 70% of critical infrastructure companies have been hit by security breaches in the last year, but cyber security programs are still a low priority.
Global Law Enforcement, Security Firms Team Up, Take Down Shylock
À la GOZeuS, an international, public-private collaboration seizes a banking Trojan's command and control servers.
Cloud & The Fuzzy Math of Shadow IT
Do you know how many cloud apps, on average, are running in your organization? The number is probably greater than you think.
Chinese Hackers Target Logistics & Shipping Firms With Poisoned Inventory Scanners
'ZombieZero' still actively pushing rigged handheld scanning devices, reviving concerns of doing business with Chinese tech companies.
|
White Papers
Video
0 Comments
Current Issue
Flash Poll
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2011-2765
PUBLISHED: 2018-08-20
PUBLISHED: 2018-08-20
PUBLISHED: 2018-08-20
PUBLISHED: 2018-08-20
PUBLISHED: 2018-08-20
From DHS/US-CERT's National Vulnerability Database CVE-2011-2765
PUBLISHED: 2018-08-20
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
CVE-2018-15594PUBLISHED: 2018-08-20
arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests.
CVE-2018-15572PUBLISHED: 2018-08-20
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
CVE-2018-15573PUBLISHED: 2018-08-20
** DISPUTED ** An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf...
CVE-2018-15574PUBLISHED: 2018-08-20
** DISPUTED ** An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability."
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This