Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content tagged with Application Security
Page 1 / 2   >   >>
Nation-State Attacks Force a New Paradigm: Patching as Incident Response
Commentary  |  4/15/2021  | 
IT no longer has the luxury of thoroughly testing critical vulnerability patches before rolling them out.
Dependency Problems Increase for Open Source Components
News  |  4/14/2021  | 
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
News  |  4/13/2021  | 
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
Dark Reading to Upgrade Site Design, Performance
Commentary  |  4/13/2021  | 
Improvements will make site content easier to navigate, faster, and more functional.
5 Objectives for Establishing an API-First Security Strategy
Commentary  |  4/13/2021  | 
With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.
New Malware Downloader Spotted in Targeted Campaigns
News  |  4/12/2021  | 
Saint Bot is being used to drop stealers on compromised systems but could be used to deliver any malware.
Wake Up and Smell the JavaScript
Commentary  |  4/12/2021  | 
The SolarWinds attack showed the true meaning of a supply chain breach. And it's the canary in the coal mine for sensitive data on the Web.
Unofficial Android App Store APKPure Infected With Malware
Quick Hits  |  4/9/2021  | 
The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.
Cring Ransomware Used in Attacks on European Industrial Firms
Quick Hits  |  4/7/2021  | 
Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.
Cartoon Caption Winner: Something Seems Afoul
Commentary  |  4/7/2021  | 
And the winner of Dark Readings's March cartoon caption contest is ...
Security Falls Short in Rapid COVID Cloud Migration
Quick Hits  |  4/6/2021  | 
The quick pivot to the cloud for remote support also ushered in risks.
Crime Service Gives Firms Another Reason to Purge Macros
News  |  4/6/2021  | 
Recent Trickbot campaigns and at least three common banking Trojans all attempt to infect systems using malicious macros in Microsoft Office documents created using EtterSilent.
NFT Thefts Reveal Security Risks in Coupling Private Keys & Digital Assets
Commentary  |  4/6/2021  | 
Compromised NFT accounts highlight security concerns inherent in the design of centralized systems.
LinkedIn Phishing Ramps Up With More-Targeted Attacks
News  |  4/5/2021  | 
Seeking to take advantage of out-of-work users, malware groups continue to use LinkedIn and business services to offer fictional jobs and deliver infections instead.
Kaspersky Uncovers New APAC Cyberespionage Campaign
Quick Hits  |  4/5/2021  | 
A group related to Chinese-speaking threat group Cycldek is targeting government and military organizations in Vietnam.
NIST Publishes Guide for Securing Hotel Property Management Systems
Quick Hits  |  4/1/2021  | 
These sensitive systems store guests' personal data and payment-card information.
The Role of Visibility in Securing Cloud Applications
Commentary  |  4/1/2021  | 
Traditional data center approaches aren't built for securing modern cloud applications.
3 Ways Vendors Can Inspire Customer Trust Amid Breaches
Commentary  |  3/31/2021  | 
As customers rely more on cloud storage and remote workforces, the probability of a breach increases.
What We Know (and Don't Know) So Far About the 'Supernova' SolarWinds Attack
News  |  3/30/2021  | 
A look at the second elusive attack targeting SolarWinds software that researchers at Secureworks recently cited as the handiwork of Chinese nation-state hackers.
In the Rush to Embrace Hybrid Cloud, Don't Forget About Security
Commentary  |  3/30/2021  | 
Cloud service providers typically only secure the infrastructure itself, while customers are responsible for their data and application security.
Manufacturing Firms Learn Cybersecurity the Hard Way
News  |  3/29/2021  | 
Although 61% of smart factories have experienced a cybersecurity incident, IT groups and operational technology groups still don't collaborate enough on security.
4 Open Source Tools to Add to Your Security Arsenal
Commentary  |  3/29/2021  | 
Open source solutions can offer an accessible and powerful way to enhance your security-testing capabilities.
CISA Builds Out Defensive Tools for Security Teams
News  |  3/29/2021  | 
Need a tool to hunt for attacks in your network? The DHS agency bolsters the offerings in its open source toolbox.
40% of Apps Leaking Information
Quick Hits  |  3/26/2021  | 
Apps in manufacturing most at risk, according to WhiteHat Security.
Data Bias in Machine Learning: Implications for Social Justice
Commentary  |  3/26/2021  | 
Take historically biased data, then add AI and ML to compound and exacerbate the problem.
Exec Order Could Force Software Vendors to Disclose Breaches to Federal Gov't Customers
Quick Hits  |  3/25/2021  | 
A decision on the order, which contains several recommendations, is still forthcoming.
Nearly Half of Popular Android Apps Built With High-Risk Components
News  |  3/25/2021  | 
Information leakage and applications asking for too many permissions were also major issues, according to a survey of more than 3,300 popular mobile applications.
6 Tips for Limiting Damage From Third-Party Attacks
Slideshows  |  3/25/2021  | 
The ability to protect your organization from third-party attacks will become increasingly critical as attackers try to maximize the effectiveness of their malicious campaigns.
California State Controller's Office Suffers Data Breach
Quick Hits  |  3/24/2021  | 
Employee unwittingly gave hacker access to email account for more than a day.
Prioritizing Application & API Security After the COVID Cloud Rush
Commentary  |  3/24/2021  | 
As companies hit the gas to accommodate the rapid shift to work-from-home, security fell behind. Now, it's time to close those gaps.
Anti-Spoofing for Email Gains Adoption, but Enforcement Lags
News  |  3/23/2021  | 
More organizations adopt sender authentication, but strict quarantining or rejection of unauthenticated messages remains uncommon.
Disgruntled IT Contractor Sentenced in Retaliatory Office 365 Attack
Quick Hits  |  3/23/2021  | 
Former contractor deleted 1,200 user accounts in revenge.
New Malware Hidden in Apple IDE Targets macOS Developers
News  |  3/19/2021  | 
XcodeSpy is latest example of growing attacks on software supply chain.
Tech Vendors' Lack of Security Transparency Worries Firms
News  |  3/18/2021  | 
A majority of firms say they're more likely to buy from suppliers that are open about security issues -- yet that sentiment isn't necessarily reflected in the technology providers they're currently working with.
Facebook Expands Security Key Support to iOS & Android
News  |  3/18/2021  | 
Facebook's announcement arrives the same week Twitter enabled support for multiple security keys on user accounts.
New CopperStealer Malware Hijacks Social Media Accounts
Quick Hits  |  3/18/2021  | 
Proofpoint researchers say it steals logins and spreads more malware.
Beware the Package Typosquatting Supply Chain Attack
Commentary  |  3/18/2021  | 
Attackers are mimicking the names of existing packages on public registries in hopes that users or developers will accidentally download these malicious packages instead of legitimate ones.
Ransom Payments Have Nearly Tripled
News  |  3/18/2021  | 
In 2020, ransomware targeted the manufacturing sector, healthcare organizations, and construction companies, with the average ransom reaching $312,000, a report finds.
CISA Issues Advisory on TrickBot Campaigns
Quick Hits  |  3/17/2021  | 
US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) and the FBI warn security teams to guard against the advanced Trojan malware.
IronNet Cybersecurity to Go Public in Merger
Quick Hits  |  3/16/2021  | 
Company intends for the deal to drive adoption of its Collective Defense Platform.
Software Development Security Firm Argon Announces Launch
Quick Hits  |  3/16/2021  | 
Check Point founder Shlomo Kramer is one of the firm's investors.
Verkada Breach Demonstrates Danger of Overprivileged Users
News  |  3/15/2021  | 
In re-evaluating supply chains, companies should classify vendors with super admin privileges to devices or backdoors as a significant threat.
Can a Programming Language Reduce Vulnerabilities?
News  |  3/12/2021  | 
Rust offers a safer programming language, but adoption is still a problem despite recent signs of increasing popularity.
Network Pivots, Patch Bypasses: Exploits Hit Hard in 2020
News  |  3/11/2021  | 
An analysis of 50 vulnerabilities finds a spectrum of risk, from widespread vulnerabilities exploited by a variety of attackers to serious issues that will likely be exploited in 2021.
Malware Operator Employs New Trick to Upload Its Dropper into Google Play
News  |  3/10/2021  | 
Check Point researchers recently discovered the Clast82 dropper hidden in nine legitimate Android utility apps.
Call Recorder iPhone App Flaw Uncovered
Quick Hits  |  3/10/2021  | 
Researcher finds thousands of recorded calls easily accessible to others.
Microsoft Patch Tuesday Fixes 82 CVEs, Internet Explorer Zero-Day
News  |  3/9/2021  | 
The monthly rollout follows last week's emergency Microsoft Exchange Server patch covering seven CVEs, four of which are under attack.
Linux Foundation Debuts Sigstore Project for Software Signing
News  |  3/9/2021  | 
Sigstore aims to improve the open source software supply chain by simplifying the process of cryptographic software signing.
COVID-19 Contact-Tracing Apps Signal Broader Mobile App Security Concerns
Commentary  |  3/9/2021  | 
The rapid launch of contract-tracing apps to control COVID-19's spread opened the door to multiple security and privacy vulnerabilities.
Leaked Development Secrets a Major Issue for Repositories
News  |  3/9/2021  | 
Every day, more than 5,000 private keys, database connection strings, certificates, and passwords are leaked to GitHub repositories, putting applications at risk.
Page 1 / 2   >   >>


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375
PUBLISHED: 2021-04-18
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376
PUBLISHED: 2021-04-18
This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377
PUBLISHED: 2021-04-18
This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.