Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Perimeter posted in March 2009
Conficker's Real Threat
Commentary  |  3/31/2009  | 
Conficker is a real problem, but the world won't end on April Fool's Day. Here's why.
Conficker Detection: Let Me Count The Ways
Commentary  |  3/30/2009  | 
The Internet has been abuzz with information about Conficker. First, it was something along the lines of the sky is falling and will land on April 1st. Then, we were told that April 1st wasn't a big deal because nearly all of the doom and gloom prophecies from the media were about features already in Conficker. Today, we saw a mass release of updates and a couple of new tools for detecting systems alr
Protecting Against The Politics Of Layer 8
Commentary  |  3/27/2009  | 
Discussions regarding security metrics appear nearly every other week on at least one of the mailing lists I follow. How do you measure your effectiveness as a security team, and what's the ROI of this security product? The list goes on. What I'd like to see is the number of breaches due to layer 8, specifically the political part of that "layer."
Social Networks Blurring The Line Into Citizen Journalism
Commentary  |  3/27/2009  | 
In 2006, Israel sent forces into Southern Lebanon during what is now known as the 2006 Lebanon War. Israel had security concerns about missiles harming its civilian population, but what it didn't bargain for was military citizen journalism.
DIY Forensics & Incident Response Lab
Commentary  |  3/25/2009  | 
Continuing with the do-it-yourself lab theme, let's turn to the areas of incident response (IR) and forensics, and how they can benefit from an in-house security training lab. The most detrimental attitude I've run into is, "Oh, I've been to training on product X, so I'm prepared." WRONG!
A Cloud Might Save You Money...But What If The Cloud Goes Broke?
Commentary  |  3/25/2009  | 
I've been talking quite a bit about whether or not (not) users of cloud services can prove compliance with security, privacy, and e-discovery laws. Now a story from The Register has me thinking about yet another issue -- the inescapable question of a service provider's financial stability.
DIY Pentesting Lab
Commentary  |  3/24/2009  | 
In Friday's Tech Insight, I provided arguments for creating your own internal security lab and some of the benefits to both the business and the IT security professionals. This week, I want to provide more direction on what you'll need depending on your goal and focus of the lab. Today, we'll be looking at suggestions for security teams looking to learn more about and get their hands dirty wit
Hacking The Router Patching Conundrum
News  |  3/24/2009  | 
Now that recent research proves that exploiting Cisco routers isn't as hard as once thought, the pressure is on for enterprises that don't regularly patch to change their ways -- without upsetting the network infrastructure
Small Business: The New Black In Cybercrime Targets
News  |  3/19/2009  | 
Enticed by poor defenses of mom-and-pop shops, hackers turn away from hardened defenses of banks and large enterprises
Lowering Your Security Expectations
Commentary  |  3/19/2009  | 
The security experts on a panel presented by the Secure Enterprise Network Consortium "painted a gloomy picture of the cybersecurity landscape," according to Federal Computer Week. The reason behind this is supposedly the ever-changing computing environment and threats that make it impossible for the best solutions to stay relevant. Instead, they are "likely to remain piecemeal and temporary." Haven'
BBC Responds To Legality Issues Of Recent Tech Show
Commentary  |  3/19/2009  | 
Yesterday Nick Reynolds of the BBC directed me, as well as many other writers, to the BBC's official response to allegations that its technology show, Click, violated the U.K.'s Computer Misuse Act when it purchased and used a botnet as part of an investigative report into cybercrime.
Authoritatively, Who Was Behind The Estonian Attacks?
Commentary  |  3/17/2009  | 
In the past couple of weeks the press has been humoring a couple of rumors about who was behind the 2007 cyberattacks against Estonia [PDF]. During these attacks, Estonia's infrastructure, which relies heavily on the Internet, nearly collapsed.
BBC Botnet Experiment IS Illegal, No Matter What They Say
Commentary  |  3/17/2009  | 
Saturday, "Click"--"the BBC's flagship technology programme"--broadcast an investigative report on cybercrime. The exciting thing about this particular program is that they purchased and used a botnet as part of their investigation. The creators of the program are under the impression that their experiment was perfectly legal, beca
Netbooks A Source Of Data Leaks If Not Properly Supported
Commentary  |  3/16/2009  | 
The eWeek article "Netbooks Offer Hackers Easy Access to Data" caught my eye. It's a couple of weeks old, but the message is no less clear.
DefCon CTF Organizers Chosen
Commentary  |  3/13/2009  | 
DefCon creator and organizer Jeff Moss (aka Dark Tangent) put out a call for proposals in late January looking for a group to design, organize and run this year's Capture the Flag (CTF) event at DefCon in Las Vegas. Late last night, Jeff announced that proposal #1, from a currently unnamed team, was chosen for DefCon 17.
Acrobat Antics Here To Stay
Commentary  |  3/12/2009  | 
Adobe has a bit of a problem on its hands, and it is sitting in a spotlight usually reserved for a company like Microsoft. Adobe is currently responsible for a vulnerability that could allow mass pwnage of the Internet. Even though the company finally released a patch for version 9 of Acrobat and Acrobat Reader, two more versions are due to be patched. In other words, this is a bug that's going
See How I Suffer For My Science?
Commentary  |  3/12/2009  | 
Today I saw two fraudulent charges on my bank account, and a few weeks ago I accidentally wiped off all of the data from my BlackBerry. Why? Because I love too much.
German Intelligence Caught Red-Handed In Computer Spying, Analysis
Commentary  |  3/11/2009  | 
According to German Web site Der Spiegel, the German foreign intelligence agency BND has supposedly been spying on computer systems around the world in the past couple of years. Everyone does it. Why not governments?
Hazy Forecast For Cloud Computing Forensics
Commentary  |  3/9/2009  | 
The security of cloud computing is an area I've been following at a distance because I don't currently have any clients who have seriously considered moving any of their data and services into the "cloud." Something caught my eye on Friday, however, that piqued my interest in how security and forensic investigators may handle incidents that involve data and systems in the cloud.
New Dark Reading Tech Center Highlights Insider Threats
Commentary  |  3/9/2009  | 
Today marks the official launch of the Insider Threat Tech Center, a subsite of Dark Reading devoted to bringing you news, opinion, and analysis of the security threats that come from inside the organization -- and the technologies used to prevent them. This is the first of what we hope will be several Dark Reading Tech Centers, which are designed to provide you with a more focused view of specific issues, threats, and tec
Lack Of Manpower Leads To Insecurity
Commentary  |  3/4/2009  | 
The "PHPBB Password Analysis" blog entry here on Dark Reading by Robert Graham offers some truly interesting insight into how users choose passwords -- great info for infosec pros and hackers alike. What I want to point out is something Robert mentions about the phpBB hack in his company's Errata Security blog that
Peter Parker's Uncle Ben Would Not Approve
Commentary  |  3/3/2009  | 
Note to Web browsers: With great power comes great responsibility.
Breaking Out Of Your Zone
Commentary  |  3/2/2009  | 
There is a blog entry over at the Security Catalyst website titled "Running Outside the Zone" that I think all IT security pros should take the time to read, ponder and put into practice. I won't rehash all of the details here, but the gist of the post is that as an infosec professional, you need to get step outside your comfort zone once in a while. It helps you stay sharp, learn new skills and get better in some areas you'


Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd