News & Commentary
Content posted in August 2009
|
Microsoft IIS Zero-Day Vulnerability Reported
Exploit code affecting the FTP module for certain versions of Microsoft IIS has been posted online. US-CERT recommends taking countermeasures.
Wikipedia Considers Coloring Untested Text
Registered Wikipedia users may soon have access to software that colors text deemed untrustworthy.
'Freakshow' Provides Inside Look At Real Malware Behind Big Breaches
Forensic specialists who investigated hacks of a hotel chain, casino, and restaurant share details on the sophisticated malware used to successfully steal confidential data
LA Fire Threatens Communications Towers
Cellular communications towers, as well as TV and radio broadcast towers atop Mount Wilson are at risk.
Intrepidus Launches PhishMe Malware Edition
Software-as-a-service (SaaS) solution train users against spear phishing attacks that involve emails that hyperlink to a website hosting malware, as well as those that include malicious file attachments
Zeus Trojan Uses IM Speed Distribution Of Stolen Data
Jabber IM module built into Trojan sends compromised data quickly to mobile criminals
Data Breach Silence Breached: 5 Good Security Tips
For every high profile big headline data breach, there are plenty of others that are kept quiet. A good piece in Informationweek takes a peek behind the curtain of quiet and offers some solid lessons in how to avoid having your data compromised.
The Foundation Of The Data Asset
In my last entry we discussed Making Data an Asset. This entry will focus on where that data asset should be stored. What is needed is a strong storage foundation, one that is designed to last for years, if not decades, but also one that will store that data efficiently and of course be complimentary to the enterprise class indexing that we described in our last entry.
Snow Leopard's Toothless Trojan Defense
Snow Leopard is the strongest business offering that Apple has ever fielded, but Apple remains in the dark ages when it comes to protection against malware and its unwillingness to work with third-party vendors to minimize the risk of bringing an Apple machine into a large business.
Hacking Oil Rigs
When it comes to cyberwar, real cyberwar, perhaps the most damaging attacks won't come in the form of denial-of-service attacks, but be aimed directly at our energy supply.
Snow Leopard's Anti-Malware Lacks Roar
A security firm's assessment of the malware protection capabilities that was leaked prior to Friday's release shows that Apple's Snow Leopard won't be chasing down much malware.
Trojan Could Enable Attackers To Eavesdrop On Skype Calls
Exploit saves conversations as MP3 files to make detection more difficult, researchers say
Lessons From The Credit Union Penetration-Test Debacle
Determining who is "in the loop" during a penetration test is an important step not always properly planned during the beginning phases of an engagement. The recent media release from the National Credit Union Association (NCUA) provides an excellent example of what can go wrong.
Filtering Network Attacks With A 'Netflix' Method
University of California at Irvine researchers devise new model for blacklisting network attackers
DHS Clarifies Laptop Border Searches
The new rules leave open the possibility that travelers may face penalties for refusing to provide passwords or encryption keys.
Identity Theft Ring Ensnared Fed Chairman Bernanke
Identity thieves may have drawn more attention that they wanted when they defrauded the nation's top banker.
Attack Of The Tweets: Major Twitter Flaw Exposed
U.K. researcher says vulnerability in Twitter API lets an attacker take over a victim's account -- with a tweet
Is Your Wi-Fi Network Open to Intrusion?
Security has been an ongoing concern among wireless LANs users since their emergence in the middle 1990s. While vendors have worked diligently to close up any holes, new ones seem to emerge on a regular period, and one is now coming to light that could impact many small and medium businesses.
Cybercriminals: Taking The Road Less Traveled
If you were a criminal, what data would you be looking for? The most obvious answer is to look for the types of data that give you direct access to cash: bank accounts, brokerage accounts, credit cards. Like Willie Sutton, you'd go where the money is, right? And that's why some of the stiffest security defenses surround this sort of account data.
5 Security Lessons From Real-World Data Breaches
We break the code of silence on data breaches to show how criminals operate -- and how you can thwart them.
Making Data An Asset
Data is often looked at as a liability; something that has to be stored, protected and preserved. Data storage has led to massively expanding storage environments and such initiatives as archive. Protection has led to incredibly elaborate backup and recovery schemes and preservation has led to eDiscovery and compliance. All of these processes are reactive, how can the view of data be changed to proactive, to using data as an asset?
Q&A: DHS Cybersecurity Chiefs Speak Out
The Department of Homeland Security aims to grow its cybersecurity workforce and technical capabilities, Phil Reitinger and Greg Schaffer say.
CD-ROM 'Attack' Threatens Credit Unions
National Credit Union Association warned credit unions nationwide of new, creative yet simple scam that uses phishing and malicious CD-ROM disks -- but it may be a false alarm
Printer Security? Yep: Printer Security!
The news that IEEE has released new standards for networked printer security is a good reminder that it's not just the computers and servers on your network that pose risks.
New IEEE Printer Security Standard Calls For Encryption, Authentication, Electronic 'Shredding'
Printers finally getting security attention, but locking them down depends on actual implementation, configuration, experts say
Attacking Customers, Employees With SQL Injection
In the security world, providing "what-if" scenarios can be good, but real-world examples are often required to get people to sit up and listen.
New Malicious Web Links Up More Than 500 Percent In First Half 2009
Vulnerabilities level off, phishing is down, IBM XForce report says
Google Taps Mobile Phones For Traffic Data
The search giant says user privacy is protected because data stays anonymous.
OOOPS Factors: Accidental Data Leaks Are Biggest Business Threat
A new IDC/RSA report shows that the the accidental data leak is the insider threat businesses feel is most likely to happen. Not a lot of comfort in that, if you think about it.
IDC Report: Most Insider Leaks Happen By Accident
Unintentional leaks may cause more damage than internal fraud, research study says
Is Snow Leopard Coming With Antivirus?
Apple security firm Intego posted a hint that Snow Leopard, the new Macintosh operating system that is due for release this Friday, may contain some level of anti-malware detection.
PCI Council Releases Recommendations For Preventing Card-Skimming Attacks
New best practices are aimed at helping retailers -- especially small merchants -- but security experts say skimming risk runs deeper
Jessica Biel Searches Deemed Most Dangerous
Searching for celebrities may be one of the most effective ways to infect your computer.
White House Overhauls Cybersecurity Reporting
Federal agencies will be required to submit standardized cybersecurity reports via new software, rather than spreadsheets.
Message From Hackers: Enjoy The Summer Break Because Winter Attacks Will Be Harsh
More than 80 percent are more active over the winter holidays, according to newly released survey of hackers at Defcon17
When Mass SQL Injection Worms Evolve...Again
In the past, I've described how mass SQL injection worms took the Web completely by storm. Two years ago, SQL injection attacks evolved from sentient, one-off, targeted data-stealing exploits, like in the breaches at Hannaford Brothers and Heartland, to fully automated, unauthenticated
Government Finalizing Medical Data Breach Notification Rules
Medical data breaches are on the rise. Much in the same way that credit card breach notifications skyrocketed following California's enactment of SB 1386, California's medical breach laws are doing the same now with patient data. Unlike financial breaches, however, federal rules are now coming into play.
Newly Discovered Vulnerability Could Threaten Cisco Wireless LANs
Flaw in Cisco Over-The-Air-Provisioning could allow attackers to gain control of wireless access points, AirMagnet researchers say
Project Honey Pot Files Lawsuit Against Spammers
Group hopes to collect information that will lead to identification of unknown bank scammers
Hacker Ring Tied To Major Breaches Just Tip Of The Iceberg
TJX-Heartland attacker and cohorts also reportedly hacked ATM machines in 7-Elevens, but their wide net is likely just one of many
Your Cloud Insurance Policy
Security is all about managing risk -- looking at the threats, evaluating the likelihood that they will affect you, and determining what the impact would be. But in the end, do the numbers really make us feel warm and fuzzy? I didn't think so.
Federal Agencies Pursue Cybersecurity Common Ground
NIST is working with defense and intelligence agencies to develop cybersecurity specifications that could be applied across government.
Getting To The Last Copy Of Data
One of the storage management challenges we see every day in customer data centers is there are too many copies of data in circulation. Ironically its this fact that built much of the value and motivation behind data deduplication. It should not be this way. Why should you get to a last copy of data?
Employers Crack Down On Social Networking, Web Surfing At Work
More than three-quarters of organizations now block social net sites, ScanSafe says
Tech Insight: SQL Injection Demystified
Attackers are using the old standby SQL injection en masse -- a look at the attack and how to protect your applications from it
What Are Botmasters Thinking?
They're thinking that bots are where the money is, according to a fascinating piece over at Dark Reading. Did you know, for instance, that the average bot is worth between a dime and quarter on the market? You gotta sell a lotta bots at that price to make real money -- and people are making real money doing just that.
Radisson Hotels Computers Compromised
A hacker appears to have had access to guest information at a limited number of hotels for several months.
Eight Indicted For $22M Identity Theft Scam Against AT&T, T-Mobile
Defendants allegedly hijacked customers' identities to steal millions of dollars in wireless gear
Botmaster: It's All About Infecting, Selling Big Batches of Bots
Undercover Cisco researcher told the going rate for a single bot is 10- to 25 cents
Lawsuit Seeks End To Bank Cybercrime Secrecy
Business bank accounts are being looted in a surge of cybercrime, leaving companies with serious losses.
|
White Papers
Video
0 Comments
Current Issue
Flash Poll
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security — even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-10839
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
PUBLISHED: 2018-10-16
From DHS/US-CERT's National Vulnerability Database CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This