Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in August 2020
Page 1 / 4   >   >>
Testing & Automation Pay Off for NSA's DevSecOps Project
News  |  8/31/2020  | 
Communication with stakeholders, extensive testing, and robust automation pays dividends for military intelligence agency, one of several presenters at GitLab's virtual Commit conference.
Slack Patches Critical Desktop Vulnerability
News  |  8/31/2020  | 
The remote code execution flaw could allow a successful attacker to fully control the Slack desktop app on a target machine.
Malicious Android Apps Slip Through Google Play Protection
Quick Hits  |  8/31/2020  | 
Multiple Android apps were found spying on users and recruiting victims' devices into ad-fraud botnets.
UVA Researcher Charged with Computer Intrusion & Trade Secret Theft
Quick Hits  |  8/31/2020  | 
Chinese national Haizhou Hu was researching bio-mimics and fluid dynamics at the University of Virginia.
From Defense to Offense: Giving CISOs Their Due
Commentary  |  8/31/2020  | 
In today's unparalleled era of disruption, forward-thinking CISOs can become key to company transformation -- but this means resetting relationships with the board and C-suite.
Data Privacy Concerns, Lack of Trust Foil Automated Contact Tracing
News  |  8/28/2020  | 
Efforts to create a technology framework for alerting people to whether they have been exposed to an infectious disease have been hindered by a number of key issues.
DNC Warns Campaign Staffers of Dating App Dangers
Quick Hits  |  8/28/2020  | 
The Democratic National Committee advises against sharing too much work and personal information on popular dating apps.
TA542 Returns With Emotet: What's Different Now
Quick Hits  |  8/28/2020  | 
Researchers report the TA542 threat group has made code changes to its malware and started targeting new locations with Emotet.
Ransomware Red Flags: 7 Signs You're About to Get Hit
Slideshows  |  8/28/2020  | 
Caught off guard by a ransomware attack? Security experts say the warning signs were there all along.
Redefining What CISO Success Looks Like
Commentary  |  8/28/2020  | 
Key to this new definition is the principle that security programs are designed to minimize business risk, not to achieve 100% no-risk.
Is China the World's Greatest Cyber Power?
News  |  8/27/2020  | 
While the US, Russia, Israel, and several European nations all have sophisticated cyber capabilities, one threat intelligence firm argues that China's aggressive approach to cyber operations has made it "perhaps the world's greatest cyber power."
DDoS Attacks Halt NZ Exchange Trading for Third Day
Quick Hits  |  8/27/2020  | 
New Zealand Exchange officials say the motive for the attacks is unclear.
Vulnerability Volume Poised to Overwhelm Infosec Teams
News  |  8/27/2020  | 
The collision of Microsoft and Oracle patches on the same day has contributed to risk and stress for organizations.
Old Malware Tool Acquires New Tricks
News  |  8/27/2020  | 
Latest version of Qbot has acquired a new feature for collecting email threads from Outlook clients.
Fastly to Acquire Signal Sciences for $775M
Quick Hits  |  8/27/2020  | 
Signal Sciences' technology will be used to build a new web application and API security tool called [email protected]
The Inside Threat from Psychological Manipulators
Commentary  |  8/27/2020  | 
How internal manipulators can actually degrade your organization's cyber defense, and how to defend against them.
How CISOs Can Play a New Role in Defining the Future of Work
Commentary  |  8/27/2020  | 
Rather than just reacting to security issues in the COVID-19 era, CISOs are now in a position to be change agents alongside their C-suite peers.
'Transparent Tribe' APT Group Deploys New Android Spyware for Cyber Espionage
News  |  8/26/2020  | 
The group, which has been around since at least 2013, has impacted thousands of organizations, mostly in India.
Higher Education CISOs Share COVID-19 Response Stories
News  |  8/26/2020  | 
Security leaders from Stanford, Ohio State, and the University of Chicago share challenges and response tactics from the COVID-19 pandemic.
US Warns of Ongoing BeagleBoyz Bank-Theft Operations
Quick Hits  |  8/26/2020  | 
The North Korean operatives have attempted to steal more than $2 billion since 2015 in a series of ongoing campaigns.
6 Signs Your Supply Chain Risk Just Shot Up
Slideshows  |  8/26/2020  | 
Risk levels are not steady states. Here are six indications that the danger posed by your supply chain is headed in the wrong direction.
The 'Shared Responsibility' Misnomer: Why the Cloud Continues to Confound
Commentary  |  8/26/2020  | 
Under the "shared responsibility model," the security management of cloud offerings is split equally between the vendor and the customer. Easy enough, right?
Russian National Arrested for Conspiracy to Hack Nevada Company
Quick Hits  |  8/26/2020  | 
The defendant allegedly planned to pay an employee $1 million to infect the company network with malware.
With More Use of Cloud, Passwords Become Even Weaker Link
News  |  8/26/2020  | 
Slow patching provides vulnerabilities to exploit. A lack of network segmentation allows unrestricted lateral movement. Yet a report surveying a year of penetration tests finds that passwords still top the list of what attackers use to compromise systems.
Deep Fake: Setting the Stage for Next-Gen Social Engineering
Commentary  |  8/26/2020  | 
Humans are susceptible to normalcy bias, which may leave us vulnerable to disinformation that reinforces our beliefs.
Phishing Attack Used Box to Land in Victim Inboxes
News  |  8/25/2020  | 
A phishing attack targeting government and security organizations used a legitimate Box page with Microsoft 365 branding to trick victims.
Online Business Fraud Down, Consumer Fraud Up
Quick Hits  |  8/25/2020  | 
Criminals are changing tactics to match changing business conditions in the coronavirus pandemic, according to a new report.
Three Easy Ways to Avoid Meow-like Database Attacks
Commentary  |  8/25/2020  | 
The largest problem facing database security today is the disconnect between security teams and DBAs beginning from the moment of configuration and continuing throughout the database lifecycle.
Palo Alto Networks to Acquire The Crypsis Group for $265M
Quick Hits  |  8/25/2020  | 
This is the latest in a series of acquisitions that Palo Alto has made since 2018.
The Fatal Flaw in Data Security
Commentary  |  8/25/2020  | 
Simply stated: No matter how sophisticated your security software is, data cannot be simultaneously used and secured. But that may be changing soon.
MITRE Releases 'Shield' Active Defense Framework
News  |  8/24/2020  | 
Free knowledge base offers techniques and tactics for engaging with and better defending against network intruders.
CISA Releases 5G Security Guidelines
Quick Hits  |  8/24/2020  | 
The new document defines lines of effort for developing security for the growing 5G network.
Attackers Use Unicode & HTML to Bypass Email Security Tools
News  |  8/24/2020  | 
Researchers spot cybercriminals using new techniques to help malicious phishing emails slip past detection tools.
DeathStalker APT Targets SMBs with Cyber Espionage
Quick Hits  |  8/24/2020  | 
The hacker-for-hire group, operating since at least 2012, primarily targets financial firms.
Large Ad Network Collects Private Activity Data, Reroutes Clicks
News  |  8/24/2020  | 
A Chinese mobile advertising firm has modified code in the software development kit included in more than 1,200 apps, maliciously collecting user activity and performing ad fraud, says Snyk, a software security firm.
New Cybersecurity Code of Practice for Installers Unveiled by BSIA
News  |  8/24/2020  | 
The British Security Industry Association's (BSIA) cybersecurity group has released a new code of practice for installers responsible for safety and security systems.
Dark Reading Launches New Section on Physical Security
Commentary  |  8/24/2020  | 
Partnership with IFSEC enables Dark Reading to cover new areas of security and expand its audience.
Why Should Physical Security Professionals Learn Cybersecurity Skills?
News  |  8/24/2020  | 
In the first of a series of columns set to be hosted exclusively on IFSEC Global, Sarb Sembhi, CISM, CTO & CISO, Virtually Informed outlines why physical security professionals should be investing in their cyber security skillset.
Huawei Role in UK 5G Network Set to Be Removed
News  |  8/24/2020  | 
The Digital Secretary for the UK, Oliver Dowden, has told the House of Commons that Huawei is set to be stripped of its role in the countys 5G network due to security concerns.
Average Cost of a Data Breach in 2020: $3.86M
Commentary  |  8/24/2020  | 
When companies defend themselves against cyberattacks, time is money.
University of Utah Pays in Cyber-Extortion Scheme
Quick Hits  |  8/21/2020  | 
Though a ransomware attempt was thwarted, the university paid to prevent the release of student PII.
74 Days From the Presidential Election, Security Worries Mount
News  |  8/21/2020  | 
With pandemic measures continuing and political divisions deepening, security experts express concern about the security and integrity of the November election.
'Next-Gen' Supply Chain Attacks Surge 430%
News  |  8/21/2020  | 
Attackers are increasingly seeding open source projects with compromised components.
Post-Pandemic Digitalization: Building a Human-Centric Cybersecurity Strategy
Commentary  |  8/21/2020  | 
COVID-19 won't be the last major disruption of its kind. Instead, it is a glimpse into what may be to come as digitalization continues to affect all aspects of our lives.
Cryptominer Found Embedded in AWS Community AMI
News  |  8/21/2020  | 
Researchers advise Amazon Web Services users running Community Amazon Machine Images to verify them for potentially malicious code.
Smart-Lock Hacks Point to Larger IoT Problems
News  |  8/20/2020  | 
Two recent reports on smart-locks vulnerabilities show that IoT vendors have a bigger job to do in ensuring their products are safely deployed and configured.
Former Uber CSO Charged in Hack Cover-up
Quick Hits  |  8/20/2020  | 
The charges stem from a 2016 attack in which 57 million records were breached.
Twitter Hack: The Spotlight that Insider Threats Need
Commentary  |  8/20/2020  | 
The high profile attack should spur serious board-level conversations around the importance of insider threat prevention.
IBM Db2 Flaw Gives Attackers Read/Write Access to Shared Memory
Quick Hits  |  8/20/2020  | 
Researchers discover a lack of explicit memory protections around the shared memory used by the Db2 trace facility.
Black Hat USA 2020 Musings: Weird and Wonderful Virtual Events are Here to Stay
Commentary  |  8/20/2020  | 
Black Hat USA 2020 was nothing like an in-person event, but it was incredibly useful for all involved, providing even the most grizzled industry veterans with fresh perspectives.
Page 1 / 4   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41127
PUBLISHED: 2021-10-21
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot...
CVE-2021-41169
PUBLISHED: 2021-10-21
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
CVE-2021-27746
PUBLISHED: 2021-10-21
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
CVE-2021-36869
PUBLISHED: 2021-10-21
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
CVE-2021-39352
PUBLISHED: 2021-10-21
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrat...