Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in July 2018
Page 1 / 4   >   >>
HP Launches Printer Bug Bounty Program
News  |  7/31/2018  | 
Bugcrowd will manage new vulnerability disclosure award program for HP enterprise printers.
DHS Establishes Center For Defense of Critical Infrastructure
News  |  7/31/2018  | 
Center foundational to new government-led 'collective defense' strategy for sharing and responding to cyberthreats, DHS secretary says.
Hundreds of Registry Keys Exposed to Microsoft COM Hijacking
News  |  7/31/2018  | 
Experts believe there could be thousands more in the wild.
Unified Security Data: A Simple Idea to Combat Persistent, Complex Cyberattacks
Commentary  |  7/31/2018  | 
Do you know what happens to your data when it's not in use? If the answer is no, you need to fix that.
10 More Women in Security You May Not Know But Should
Slideshows  |  7/31/2018  | 
The second installment in a series highlighting women who are driving change in cybersecurity but may not be on your radar yet.
Yale Discloses Data Breach
Quick Hits  |  7/31/2018  | 
The university discloses that someone stole personal information a long time ago.
Mimecast Snaps Up Solebit for $88 Million
Quick Hits  |  7/31/2018  | 
Purchase of threat detection firm closely follows company's acquisition of security training platform Ataata.
Accidental Cryptojackers: A Tale of Two Sites
Commentary  |  7/31/2018  | 
Why website operators need to know with whom they are doing business and how to close the loop on third-party vulnerabilities.
SamSam Ransomware Nears $6M Mark in Ill-Gotten Gains
News Analysis-Security Now  |  7/31/2018  | 
For the past three years, the person or persons behind the SamSam ransomware have targeted hospitals, healthcare organizations, as well as the city of Atlanta, and have collected nearly $6 million in illicit funds, according to research from Sophos.
PowerGhost Cryptomining Malware Targets Corporate Networks
Jeffrey Burt  |  7/31/2018  | 
Kaspersky Lab researchers said the malware uses fileless techniques to make it harder to detect and the Eternal Blue exploit to spread to systems across the networks.
Russian National Sentenced to 70 Months For $4 Million Debit Card Fraud
News  |  7/30/2018  | 
Mikhail Malykhin's actions drove one company out business.
New Spectre Variant Hits the Network
News  |  7/30/2018  | 
A new proof of concept is a reminder that complex systems can be vulnerable at the most basic level.
$5 Million in Cryptocurrency Stolen in SIM Hijacking Operation
Quick Hits  |  7/30/2018  | 
College student is arrested for his alleged involvement.
University of Phoenix Poll: 20% of US Adults Have Considered Infosec Careers
Quick Hits  |  7/30/2018  | 
Many respondents could enter the field by leveraging skills they already have.
MUD: The Solution to Our Messy Enterprise IoT Security Problems?
Commentary  |  7/30/2018  | 
The 'Manufacturer Usage Description' proposal from IETF offers a promising route for bolstering security across the industry.
New Spectre-Like Vulnerability Allows for Remote Data Theft
Larry Loeb  |  7/30/2018  | 
Researchers have found new Spectre-like vulnerability in x86 processors called NetSpectre, which allows attackers to steal data remotely.
Zero Trust Means Never Trust & Always Verify
Alan Zeichick  |  7/30/2018  | 
Enterprise security teams have actually been practicing zero trust policies for a number of years, but new advances and better tools now make the philosophy easier to implement. Still, it's always best to verify.
Automating Kernel Exploitation for Better Flaw Remediation
News  |  7/27/2018  | 
Black Hat researchers plan on open sourcing a new framework they say can help organizations get a better rein on vulnerability fixes for kernel bugs.
Imperva Plans to Purchase Prevoty
Quick Hits  |  7/27/2018  | 
Deal will bring DevOps security to the enterprise security vendor.
'Identity Has Become the Perimeter': Oracle Security SVP
News  |  7/27/2018  | 
Eric Olden, Oracle's new leader in security and identity, shares how the enterprise tech giant plans to operate in a cloud-first world.
'Fancy Bear' Targets Democratic Sen. Claire McCaskill
Quick Hits  |  7/27/2018  | 
Russian hackers have their sights on McCaskill and her staff as they gear up for her 2018 re-election campaign.
Every Week Is Shark Week in Cyberspace
Commentary  |  7/27/2018  | 
Your data, identities, and credentials are cyber chum. Here's how to protect yourself from the feeding frenzy.
Symantec: Leafminer Group Is a Dangerous Group of Amateurs
Larry Loeb  |  7/27/2018  | 
While the Leafminer group has been causing significant problems in the Middle East for well over a year, Symantec notes that the group is doing so using rather amateurish techniques.
Kronos Returns as Banking Trojan Attacks Ramp Up
Jeffrey Burt  |  7/27/2018  | 
Proofpoint researchers have seen a new version of the four-year-old Kronos emerge in campaigns in Europe and Japan. The report also finds it may be rebranded as 'Osiris.'
Kronos Banking Trojan Resurfaces
News  |  7/26/2018  | 
Re-emergence of malware consistent with overall surge in banking malware activity this year, Proofpoint says.
5 Ways Small Security Teams Can Defend Like Fortune 500 Companies
Commentary  |  7/26/2018  | 
Keep your company protected with a mix of old- and new-school technologies.
Stealth Mango Proves Malware Success Doesn't Require Advanced Tech
News  |  7/26/2018  | 
At Black Hat USA, a pair of researchers will show how unsophisticated software can still be part of a successful surveillance campaign.
8 Steps Toward Safer Elections
Slideshows  |  7/26/2018  | 
Heres some advice from leading authorities on how state and local governments can adapt to an environment where election systems will inevitably be hacked.
Tenable Prices IPO, Raises $250 Million
News  |  7/26/2018  | 
The past year has been one of significant growth for the cybersecurity firm, which is trading under the NASDAQ symbol TENB.
CoinVault Authors Sentenced to Community Service
Quick Hits  |  7/26/2018  | 
Ransomware first began targeting victims in 2014.
LifeLock Learns Lesson from Leaky Links
Quick Hits  |  7/26/2018  | 
A Web programming problem could have exposed millions of customer email addresses.
The Double-Edged Sword of Artificial Intelligence in Security
Commentary  |  7/26/2018  | 
AI is revolutionizing cybersecurity for both defenders and attackers as hackers, armed with the same weaponized technology, create a seemingly never-ending arms race.
DHS Warns of Increasing Attacks on ERP Systems
News Analysis-Security Now  |  7/26/2018  | 
Following reports by Digital Shadows and Onapsis, the US Department of Homeland Security has issued a warning to businesses that nation-states and other groups are targeting Enterprise Resource Planning systems.
California's CCPA Law: Why CISOs Need to Take Heed
Joe Stanganelli  |  7/26/2018  | 
The recently enacted California Consumer Privacy Act, while hardly a sweeping reform of the state's privacy laws, changes the playing field for IT risk and liability where California residents' personal information is concerned.
Google Debuts Hardware Key for Secure Cloud Access
News Analysis-Security Now  |  7/26/2018  | 
Google introduces hardware keys to provide priority end users with secure cloud access, as well as rolling out security for virtualized and containerized applications, and new G Suite protections.
The ABCs of Hacking a Voting Machine
News  |  7/25/2018  | 
A hacker who successfully infiltrated a voting machine at last year's DEF CON will demonstrate at Black Hat USA how he did it, as well as what he later found stored on other decommissioned WinVote machines.
US-CERT Warns of ERP Application Hacking
News  |  7/25/2018  | 
ERP applications such as Oracle and SAP's are open to exploit and under attack, according to a new report referenced in a US-CERT warning.
Iranian Hacker Group Waging Widespread Espionage Campaign in Middle East
News  |  7/25/2018  | 
Unlike other threat actors that have a narrow set of targets, Leafminer has over 800 organizations in its sights, Symantec says.
Google Security Updates Include Titan Hardware Key
News  |  7/25/2018  | 
At Next 2018, Google also launches context-aware access management, shielded VMs, and G Suite security center investigation tool.
The Good & Bad News About Today's Cybersecurity Investment Landscape
Commentary  |  7/25/2018  | 
Lots of things keep CISOs up at night. But instead of guessing what CISOs want, investors and vendors should incorporate customer feedback throughout product ideation and development cycles.
Google Calls Out Insecure Sites in New Chrome Version
Quick Hits  |  7/25/2018  | 
The latest version of the Chrome browser puts a label on unencrypted websites.
'Password Check Required'? Not So Fast
Quick Hits  |  7/25/2018  | 
The most successful phishing emails tell users to check their passwords or investigate security alerts.
Securing Our Interconnected Infrastructure
Commentary  |  7/25/2018  | 
A little over a year ago, the world witnessed NotPetya, the most destructive cyberattack to date. What have we learned?
Continued Russian Attacks Show Weakness of Industrial Control Systems
News Analysis-Security Now  |  7/25/2018  | 
A new report shows that Russian-based attackers are increasingly able to penetrate the Industrial Control Systems of US-based utilities, showing that a new approach to security within critical infrastructure is needed.
Bluetooth Vulnerability Opens Up Man-in-the-Middle Attacks
Larry Loeb  |  7/25/2018  | 
With almost certainly hypothetical, this vulnerability in Bluetooth's protocol could result in a man-in-the-middle attack and allow the culprits to steal personal data off a device.
New Free Chrome Plug-in Blocks Cryptojacking Browser Attacks
News  |  7/24/2018  | 
Qualys also plans Firefox, Safari, IE versions.
Trend Micro Launches Targeted Server-Side Bug Bounty Program
News  |  7/24/2018  | 
Targeted Incentive Program will pay anywhere from $25,000 to $200,000 to researchers who are first to demonstrate exploitable vulnerabilities.
How 'Projection' Slows Down the Path to Security Maturity
Commentary  |  7/24/2018  | 
A little bit of self-awareness goes a long way when it comes to evaluating a company's security maturity level. It's also a prerequisite to improving.
72% of CEOs Steal Corporate IP from Former Employers
News  |  7/24/2018  | 
Employees often take corporate IP because they feel ownership over their work, a trend security experts say is a problem.
DHS Officials: Hundreds of US Utility Victims Infiltrated by Russian Hackers
Quick Hits  |  7/24/2018  | 
Federal government officials up their count of US energy sector victims from dozens to hundreds, according to a Wall Street Journal report.
Page 1 / 4   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41154
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.1...
CVE-2021-41155
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix...
CVE-2021-41152
PUBLISHED: 2021-10-18
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on t...
CVE-2021-41153
PUBLISHED: 2021-10-18
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. Thi...
CVE-2021-41156
PUBLISHED: 2021-10-18
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft ...