News & Commentary
Content posted in August 2015
|
Sights & Sounds Of Black Hat USA And DEF CON
Some hackers call the week of Black Hat USA and DEF CON 'security summer camp' -- a look at some of the highlights of the two shows.
Biggest Apple Account Theft Ever Hits Only JailBroken iOS Devices
KeyRaider stole 225,000 legitimate Apple accounts and slammed devices with ransomware and phony purchases, but only jailbroken gear, mostly in China, is affected.
10 Best Practices For BYOD Policy
Bring-your-own device doesn't have to mean bring your own security problems.
Top Infosec Execs Will Eventually Report To CEOs, CISOs Say
But becoming a trusted resource to the executive suite will demand major changes in the traditional chief information security officer role.
Ashley Madison CEO Resigns
Once again, a security breach claims an executive's job, but the business plans to continue operating.
FBI Sounds Alarm Again On Business Email Compromise Threat
Over 7,000 US business have been victimized by so-called BEC fraud between October 2013 and August 2015 alone, the FBI said in an alert this week.
The 7 ‘Most Common’ RATS In Use Today
Sniffing out RATS -- remote access Trojans -- is a challenge for even the most hardened cyber defender. Here’s a guide to help you in the hunt.
Valasek Not Done With Car Hacking Just Yet
Security Pro File: Chris Valasek chats up the daunting challenge of topping the Jeep Cherokee hack, '80s Adidas tracksuits, his loathing of coding, and his love for Windows -- and Hall & Oates.
Thousands Of Potentially Malicious Android Apps Unearthed In Google Play
Indiana University researchers develop a new scanning technique dubbed 'MassVet' for vetting mobile app stores at scale.
Cybersecurity Under FTC Authority: What Does it Mean?
Consumers can now expect the same level of security and privacy in the digital realm as they do in the physical.
Flash: Web Browser Plugins Are Vulnerable
Maybe it’s time to uninstall Flash for those that don’t need it and continuously monitor those that do.
Consumers Want Password Alternatives
Consumer confidence in online passwords wanes and their password hygiene remains as sketchy as ever, study finds.
A Tale Of Two IoT Security Outcomes
Commandeered Jeep gets fixed but a 'hijacked' satellite network does not? Why Internet of Things security remains a work in progress.
Getting To Yes, Cooperatively
As security advocates, determining what “beneficial” means to a particular audience should be our first step in developing recommendations.
From Vicious To Virtuous: A Plan Of Attack For Incident Response
How do you get there? Increase the cost and effort required by the bad guys and boost your efficiency.
IBM Advises Businesses To Block Tor
With Tor-based attacks on the rise, IBM says it's time to stop Tor in the enterprise.
What Would You Do Differently If You Knew You Were Going To Be Robbed?
Neither prevention nor detection alone is sufficient in today’s cybercrime environment.
Ouch! Feeling The Pain Of Cybersecurity In Healthcare
There are lots of reasons why medical data is so vulnerable but the sheer numbers at risk speak volumes about the scale of the problem.
Security Stands As Top Factor In Digital Brand Confidence
Security ranked alongside marketing and IT ops concerns as important indicators of trust in online sites.
What Drives A Developer To Use Security Tools -- Or Not
National Science Foundation (NSF)-funded research by Microsoft Research, NC State, and UNC-Charlotte sheds light on what really makes a software developer scan his or her code for security bugs.
Ruling: FTC Can Hold Wyndham Liable For Data Breach
Appeals Court ruling solidifies Federal Trade Commission's authority to take action against companies whose data breaches expose customer information.
Survey Says: Incident Response Is Fighting Back
Companies appear to be recognizing the need for increased incident-response spending.
Keyless Cars: A New Frontier For Bug Bounties?
With up to 100 million lines of code in the average car today -- and growing -- security vulnerabilities are bound to become the new normal.
University Of Virginia BreachTargeted Two Individuals With China Links
Latest example of threat actors seeking to exfiltrate data by going after individuals.
With Great IoT Comes Great Insecurity
In the brave new world of 'things' and the services they connect to, built-in security has never been more critical. Here's what's getting in the way.
AlienSpy RAT Resurfaces In Case Of Real-Life Political Intrigue
Mysterious death of Argentinian politician potentially tied to his phone's infection with popular remote access tool.
The Month Of Android Vulnerabilities Rolls On
Multi-media handling takes the most hits, and there are no easy fixes.
Spiderbot, Spiderbot, Does Whatever A Hacker Thought
Virtual machine, she ignores, owns the bot, then controls yours.
Law Firms Form Their Own Threat Intel-Sharing Group
The Legal Services Information Sharing and Analysis Organization (LS-ISAO) Services is launched with the help of the financial services industry.
How Much Threat Intelligence Is Too Much?
Turn your threat data into actionable intelligence by focusing on what is relevant to you and your organization.
Beware The Hidden Risk Of Business Partners In The Cloud
Enterprises vastly underestimate the cyber risk from digital connections to vendors, suppliers, agencies, consultants -- and any company with which employees do business.
ID Thieves, Blackmailers Have Lots To Gain In Ashley Madison Breach
Breach highlights need for greater anonymity controls in identity and payment mechanisms.
Vulnerable From Below: Attacking Hypervisors Using Firmware And Hardware
Malicious attacks with firmware privileges can compromise an entire system, so it is especially important to apply measures to reduce the risks.
Applying the 80/20 Rule to Cyber Security Practices
How to look holistically across technology and processes and focus resources on threats that create the greatest damage.
IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch
Remote code execution vulnerability in Internet Explorer versions 7 through 11 being used to drop PlugX RAT.
IRS Get Transcript Breach Triples In Scope
Breach reported in May much larger than initially thought
Hackers Dump Ashley Madison User Database... Where Most People Won't Find It
Attackers make good on doxing threat, but post database to dark web.
Unpatched 'Tpwn' Mac OS X Bug Could Grant Root Privileges
Researchers beginning to find more cracks in Mac operating systems.
|
White Papers
Video
9 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's not that smart. He's running iOS 11 on a 5c."
Latest Comment: "He's not that smart. He's running iOS 11 on a 5c."
Current Issue
The Year in Security 2018This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-20742
PUBLISHED: 2019-01-24
PUBLISHED: 2019-01-24
PUBLISHED: 2019-01-24
PUBLISHED: 2019-01-24
PUBLISHED: 2019-01-24
From DHS/US-CERT's National Vulnerability Database CVE-2018-20742
PUBLISHED: 2019-01-24
An issue was discovered in UC Berkeley RISE Opaque before 2018-12-01. There is no boundary check on ocall_malloc. The return value could be a pointer to enclave memory. It could cause an arbitrary enclave memory write.
CVE-2019-6486PUBLISHED: 2019-01-24
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
CVE-2018-17693PUBLISHED: 2019-01-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the con...
CVE-2018-17694PUBLISHED: 2019-01-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2018-17695PUBLISHED: 2019-01-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2019 UBM, All rights reserved
Tweet This