News & Commentary

Content posted in September 2008
Page 1 / 3   >   >>
End Users Lax With Company Data
Commentary  |  9/30/2008  | 
A new security study shows end users from around the world treat data and corporate systems with little respect for the potential consequences. When it comes to corporate data, which is actually often customer data, there's little regard for security.
New DoS Attack Is a Killer
Commentary  |  9/30/2008  | 
Things are a-brewin' in Sweden. Sweden is not just home of the infamous bikini team, it is also the home of Outpost 24, an equally sexy software-as-a-service network scanning service, and the employer of my friend Robert E. Lee and his colleague Jack C. Louis. These guys are the inventors of UnicornScan, a user-land TCP stack turned into a port scanner. Never heard of it? Use Nmap exclusively? Well if you run Linux, I suggest checking
Can You Prove Compliance In The Cloud?
Commentary  |  9/30/2008  | 
Whether you're in the midst of an audit or a forensic investigation, thorough logs are the key to proving compliance with security regulations. So how do you prove your organization is/was compliant when you aren't able to maintain logs? This is the nagging question that gnaws hungrily at my weary brain every time I ponder cloud computing.
Study: Routine Misbehavior by End Users Can Lead to Major Data Leaks
News  |  9/30/2008  | 
Many end users don't understand the risks associated with breaking company security policies, report says
Attackers Mix Online, Offline Exploits to Mask Financial Fraud
News  |  9/30/2008  | 
Cybercriminals split the attack cycle into pieces that may appear unrelated in order to evade detection
A Simple Sync Can 'Sink' Your PC
Quick Hits  |  9/30/2008  | 
Researchers release proof-of-concept for attack on Windows' ActiveSync 4.0
Scareware Purveyors To Get Legal Thrashing
Commentary  |  9/29/2008  | 
We've previously warned about the rising number of scareware threats attempting to scam Internet users. Now Microsoft and the state of Washington are gnashing their legal teeth. Will it work?
Microsoft, Washington State Launch Legal Assault On Scareware
News  |  9/29/2008  | 
The lawsuit against Registry Cleaner XP is trying to halt pop-up ads that look like Windows system messages and falsely claim that a critical system error has occurred.
InfoBlox Upgrades DNS Appliance
News  |  9/29/2008  | 
The new software rev of makes DNS infrastructures more resistant to cache-poisoning attacks.
Free Cloudmail Continuity Offer From LiveOffice
Commentary  |  9/29/2008  | 
Snailmail may be immune to rain, sleet snow, etc. but heavy weather can wreak heavy damage -- and outright interruption and downtime -- on your e-mail traffic. A new free service from LiveOffice argues that the solution to storm clouds' potential for disruption lies in the digital Cloud.
CSRF Flaws Found on Major Websites
News  |  9/29/2008  | 
Princeton University researchers reveal four sites with cross-site request forgery flaws and unveil tools to protect against these attacks
The Death Of The Dual Controller Architecture?
Commentary  |  9/29/2008  | 
Clustered storage is everywhere; are we seeing the end of the dual controller architecture?
Yahoo! Japan Auctions Compromised, Report Says
News  |  9/29/2008  | 
Thieves may have accessed Web auction site as many as 1.5 million times since May
Theft at RAF Facility Endangers Personal Data of 50,000
Quick Hits  |  9/29/2008  | 
Data on British air force hard drives wasn't encrypted; old facility 'wasn't that secure,' reports say
Mozilla Fixes Password Management Gaffe
Commentary  |  9/28/2008  | 
Just after Mozilla released Firefox version 3.0.02, which fixed a bevy of security problems, the foundation had to issue a notice to users about a flaw that could keep users from accessing and even creating passwords under some conditions.
Archive Needs To Succeed For SSD To Dominate
Commentary  |  9/27/2008  | 
In my last entry I wrote that speed is solid state disk's "killer app," but for SSD to really become the primary storage mechanism in tier one, the archive tier needs to be fully established.
'Clickjacking' Attack Prompts Warning To Disable Browser Plug-Ins
News  |  9/26/2008  | 
The flaw affects Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox, and Opera and could trick a user into clicking on content from another page.
ISPs Call For Industry Standards On Behavioral Targeting
News  |  9/26/2008  | 
Verizon, AT&T, and Time Warner Cable pledge to Congress to only monitor activity if users choose to opt in.
Portrait Of A Computer Forensic Examiner
News  |  9/26/2008  | 
While data can be recovered from any computer, expert Ives Potrafka believes that corporate IT departments have far less control over what happens on PCs used for work.
Adobe PDF Reader Vulnerable, U.S. CERT Warns
News  |  9/26/2008  | 
The government's standard precautionary advice: Don't open files from sources you don't trust, and keep your antivirus software and patches up to date.
Astaro Debuts E-mail Spam Fighter For SMBs
Commentary  |  9/26/2008  | 
Everybody hates spam. It clogs inboxes and online traffic, cuts productivity, and holds out false hope of riches, romance, and hair. Astaro's new Mail Gateway is designed to help your company deal with spam and other e-mail issues without spending a lot of money.
Survey: Virtually No Security in Enterprises' Virtual Systems
Quick Hits  |  9/26/2008  | 
Enterprise survey shows few companies have secured their virtual environments
New ID Theft Service Crawls the Web on Consumers' Behalf
News  |  9/26/2008  | 
For $15, Affinion penetrates hacker chat rooms and warns users when their data is for sale
DeviceLock Enhances Portable Storage Security
News  |  9/26/2008  | 
Its endpoint security, access-control software is designed to keep crucial company information from walking out the door
Senate Committee Approves Updated FISMA Bill
Commentary  |  9/25/2008  | 
The Senate Homeland Security and Government Affairs Committee just approved S.3474, which will update the Federal Information Security Management Act (FISMA), in the hope of lifting federal security efforts beyond what many have deemed a paperwork shuffle that does little to boost security.
One In Ten Computer Users Don't Have A Clue About Security
Commentary  |  9/25/2008  | 
They've got computers, they've got apps and they've almost undoubtedly got confidential data, but a new study from privacy company Steganos found that nearly 10 percent of computer users didn't know if they had anti-virusware installed. And it gets worse...
Time To Send Out For Security Help?
News  |  9/25/2008  | 
Providers are looking to provide everything from e-mail security to log management, all from the cloud.
Locking Down The Cloud: Why DNS Security Must Be Improved
News  |  9/25/2008  | 
What's in a domain name? Everything, when your data is at stake.
Envysion Makes A Strong Case For Managed Video As A Service
News  |  9/25/2008  | 
Tests show the package is versatile enough to use for far more than monitoring PoS.
Tiger Team Member Attacks Developers, Not Apps
News  |  9/25/2008  | 
Expert shows how he can get into a Web app without touching the application itself
Laptops Stolen From DHS Transportation Worker ID Program Office
Quick Hits  |  9/25/2008  | 
TSA's New Haven, Conn., office was broken into over the weekend and two laptops that handle applications for new biometric IDs for port workers were stolen
India's Government Claims BlackBerry Crypto Crack
Commentary  |  9/24/2008  | 
After months of wrangling with Research In Motion to hand over its crypto keys, the country now claims to have attained the ability to snoop on some RIM users in that country.
Sarah Palin E-Mail Hacking Grand Jury Returns No Indictment
News  |  9/24/2008  | 
A Tennessee Democratic state representative's son was linked last week to involvement in the breach of the Republican vice presidential candidate's Yahoo Mail account.
Speed Is The SSD 'Killer App'
Commentary  |  9/24/2008  | 
In a recent blog entry I provided a time line on when I thought SSD would become the dominant storage type for what is currently the active storage tier. One of the key enablers of this will be the increasing need for speed and mechanical hard drives' lack of ability to deliver it in a cost- effective manner.
Shadowserver to Build 'Sinkhole' Server to Find Errant Bots
News  |  9/24/2008  | 
New initiative will emulate IRC, HTTP botnet traffic
Many PC Users Remain Unaware of Security, Privacy
Quick Hits  |  9/24/2008  | 
More than a tenth of users don't know whether they have an antivirus, firewall; majority don't know what privacy settings they're using
North American Companies Embracing Security Outsourcing
Commentary  |  9/23/2008  | 
The U.S. managed security services market is booming, and set to double in size in the next few years? MSSPs have been around, in one iteration or another, for as long as I can remember. Why is the market set to rock now?
Risky Employee Web Use: Cloud Storms Gathering
Commentary  |  9/23/2008  | 
How are you going to keep them on task when they can go to the Web? is not only a productivity question, it's a growing security concern. A new study indicates the concern is growing fast.
For US Enterprises, Computer Crime Starts at Home
News  |  9/23/2008  | 
Despite perceptions about overseas hackers, attacks increasingly emanate from domestic sources, studies say
Phony Pop-Up Warning Messages Dupe Most Users
News  |  9/23/2008  | 
New research from NC State University shows how even savvy users fall for malicious system error messages
Man Indicted for Hacking & Blackmailing Luxury Automaker
Quick Hits  |  9/23/2008  | 
Sixty-year-old hacker threatened Maserati North America with exposing his theft of customer data from carmaker's Website
Information Cards Are Awesome; But Are Identifying Parties Really Ready To Do This Right?
Commentary  |  9/23/2008  | 
Perhaps the greatest thing about information cards is that they might finally free us from the purpose-defeating and idiotic practice of using Social Security numbers as a nigh-universal identifier. But it won't work unless the Identifying Parties find a way to balance security with portability, and can smartly manage distribution, expiration, and destruction.
'Profiler' Hacks Global Hacker Culture
News  |  9/23/2008  | 
Former notorious Italian hacker releases initial results of research identifying different types of hackers and their behaviors on and offline
McAfee Secures Place In UTM Market With $465 Million Acquisition
Commentary  |  9/22/2008  | 
There's still big demand for unified threat management (UTM) devices, especially in the SMB part of the market, and with its $465 million acquisition McAfee is making a big move that will shore its network security products.
McAfee Acquires Secure Computing
Commentary  |  9/22/2008  | 
McAfee is buying Secure Computing for $465 million, rounding out its network security business and strengthening its security risk management offerings among companies of all sizes.
Cloud Storage 2.0
Commentary  |  9/22/2008  | 
Cloud storage 1.0 as it exists today has one primary service; it stores data. Not very exciting. Cloud storage 2.0 will have to provide the ability to do more with that data than just store it.
Untangle Offers Free Open Source Security
Commentary  |  9/22/2008  | 
Untangle's new open source security gateway aims to free small and midsized businesses from dedicated security machines -- and to do so for free.
US-Based Malware Network Shuts Down
News  |  9/22/2008  | 
Network that served large numbers of hackers is no longer in service, observers say
Brocade Enhances Storage Mgt. Software, Adds Encryption Engine
News  |  9/22/2008  | 
Fibre Channel specialist enhances management capabilities to include products gained from McData acquisition
Employees Still Flouting Security Policies, Study Says
Quick Hits  |  9/22/2008  | 
Three in 10 enterprises say their business' security is being compromised by personal use of corporate systems
Page 1 / 3   >   >>


Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
Election Websites, Backend Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10510
PUBLISHED: 2018-08-15
A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to execute arbitrary code on vulnerable installations.
CVE-2018-10511
PUBLISHED: 2018-08-15
A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF) attack on vulnerable installations.
CVE-2018-10512
PUBLISHED: 2018-08-15
A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server (DoS).
CVE-2018-8753
PUBLISHED: 2018-08-15
The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attackers to decrypt RSA-encrypted nonces by leveraging a Bleichenbacher attack.
CVE-2018-9129
PUBLISHED: 2018-08-15
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.