Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in January 2018
Page 1 / 2   >   >>
Lazarus Group, Fancy Bear Most Active Threat Groups in 2017
News  |  1/31/2018  | 
Lazarus, believed to operate out of North Korea, and Fancy Bear, believed to operate out of Russia, were most referenced threat actor groups in last year's cyberattacks.
Passwords: 4 Biometric Tokens and How They Can Be Beaten
Commentary  |  1/31/2018  | 
Authentication security methods are getting better all the time, but they are still not infallible.
K-12 Study Gives Schools Low Marks for Protecting Student Privacy Online
News  |  1/31/2018  | 
Survey says local school districts and education departments lack even the most basic security and privacy safeguards.
5 Questions to Ask about Machine Learning
Commentary  |  1/31/2018  | 
Marketing hyperbole often exceeds reality. Here are questions you should ask before buying.
Digital Extortion to Expand Beyond Ransomware
News  |  1/30/2018  | 
In the future of digital extortion, ransomware isn't the only weapon, and database files and servers won't be the only targets.
Breach-Proofing Your Data in a GDPR World
Commentary  |  1/30/2018  | 
Here are six key measures for enterprises to prioritize over the next few months.
DNS Hijacking: The Silent Threat That's Putting Your Network at Risk
Commentary  |  1/30/2018  | 
The technique is easy to carry out and can cause much damage. Here's what you need to know about fighting back.
Microsoft Issues Emergency Patch to Disable Intel's Broken Spectre Fix
News  |  1/29/2018  | 
Affected Windows systems can also be set to "disable" or "enable" the Intel microcode update for Spectre attacks.
An Action Plan to Fill the Information Security Workforce Gap
Commentary  |  1/29/2018  | 
Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data, and other ideas to entice women into a cyber career.
Former CIA CTO Talks Meltdown and Spectre Cost, Federal Threats
News  |  1/26/2018  | 
Gus Hunt, former technology leader for the CIA, explains the potential long-term cost of Meltdown and Spectre.
Intel CEO: New Products that Tackle Meltdown, Spectre Threats Coming this Year
Quick Hits  |  1/26/2018  | 
In an earnings call yesterday, Intel CEO Brian Krzanich says security remains a 'priority' for the microprocessor company.
Hardware Security: Why Fixing Meltdown & Spectre Is So Tough
Commentary  |  1/26/2018  | 
Hardware-based security is very difficult to break but, once broken, catastrophically difficult to fix. Software-based security is easier to break but also much easier to fix. Now what?
This Year's Pwn2Own Hackfest Will Offer Up to $2 Million in Rewards
News  |  1/25/2018  | 
Microsoft is a partner at annual contest for the first time.
Industrial Safety Systems in the Bullseye
News  |  1/25/2018  | 
TRITON/TRISIS attack on Schneider Electric plant safety systems could be re-purposed in future attacks, experts say.
Ransomware Detections Up 90% for Businesses in 2017
News  |  1/25/2018  | 
Last year, cybercriminals shifted from consumer to enterprise targets and leveraged ransomware as their weapon of choice.
How Containers & Serverless Computing Transform Attacker Methodologies
Commentary  |  1/25/2018  | 
The pace of hacker innovation never slows. Now security technologies and methods must adapt with equal urgency.
Meltdown & Spectre: Computing's 'Unsafe at Any Speed' Problem
Commentary  |  1/25/2018  | 
Ralph Nader's book shook up the automotive world over 50 years ago. It's time to take a similar look at computer security.
Security Automation: Time to Start Thinking More Strategically
Commentary  |  1/24/2018  | 
To benefit from automation, we need to review incident response processes to find the areas where security analysts can engage in more critical thought and problem-solving.
Financial Impact of Cloud Failure Could Hit $2.8B in Insured Loss
News  |  1/24/2018  | 
A new report highlights the potential financial damage of downtime at top cloud services providers.
Fallout from Rushed Patching for Meltdown, Spectre
News  |  1/23/2018  | 
Not all systems require full patching for the flaws right now, anyway, experts say.
Meltdown, Spectre Patches, Performance & My Neighbor's Sports Car
Commentary  |  1/23/2018  | 
When a flaw in the engine of a data center server makes it run more like a Yugo than a Porsche, it's the lawyers who will benefit.
45% of Businesses Say Employees Are Biggest Security Risk
Quick Hits  |  1/23/2018  | 
The most common cloud security worries remain the same, with unauthorized access and malware infiltrations topping concerns.
5 Steps to Better Security in Hybrid Clouds
Commentary  |  1/23/2018  | 
Following these tips can improve your security visibility and standardize management across hybrid environments.
Satori Botnet Malware Now Can Infect Even More IoT Devices
News  |  1/22/2018  | 
Latest version targets systems running ARC processors.
Intel Says to Stop Applying Problematic Spectre, Meltdown Patch
News  |  1/22/2018  | 
Cause of reboot problems with its Broadwell and Haswell microprocessor patching now identified, the chipmaker said.
File Inclusion Vulns, SQL Injection Top Web Defacement Tactics
News  |  1/22/2018  | 
Hacktivists driven by political, religious, and other causes commonly exploit basic vulnerabilities to spread their messages, researchers say.
Most Companies Suffer Reputation Damage After Security Incidents
Quick Hits  |  1/22/2018  | 
New Kroll Annual Global Fraud & Risk Report says 86% of companies worldwide experienced security incidents and information theft and loss in the past twelve months.
9 Steps to More-Effective Organizational Security
Commentary  |  1/22/2018  | 
Too often security is seen as a barrier, but it's the only way to help protect the enterprise from threats. Here are tips on how to strengthen your framework.
Kaspersky Lab Seeks Injunction Against US Government Ban
News  |  1/19/2018  | 
Revenues and reputation have taken a hit in the wake of the US Department of Homeland Security's decision to prohibit use of its products and services by the feds, the company says.
Google Pays Researcher Record $112,500 for Android Flaw
Quick Hits  |  1/19/2018  | 
The bug bounty reward, given to a researcher who submitted a working remote exploit chain, is Google's highest for an Android bug.
You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting
News  |  1/19/2018  | 
Some bug hunters make 16 times the median salary of software engineers in their home countries.
Understanding Supply Chain Cyber Attacks
Commentary  |  1/19/2018  | 
While the attack surface has increased exponentially because of the cloud and everything-as-a-service providers, there are still ways in which host companies can harden supply chain security.
BEC Attacks to Exceed $9B in 2018: Trend Micro
News  |  1/18/2018  | 
Business email compromise is projected to skyrocket as attackers adopt sophisticated techniques to dupe their victims.
Tax Reform, Cybersecurity-Style
Commentary  |  1/18/2018  | 
How the security industry can be more effective and efficient by recognizing four hidden "taxes" in the buying and selling process.
Feds Team with Foreign Policy Experts to Assess US Election Security
News  |  1/18/2018  | 
Expert panel lays out potential risks for the 2018 election cycle and beyond
California Predicted to Lose $329M to Cybercrime in 2018
Quick Hits  |  1/18/2018  | 
The Golden State will be hit hardest but New York will lose the most money per incident.
How to Keep Blue Teams Happy in an Automated Security World
Commentary  |  1/18/2018  | 
The creativity and intuition of your team members must be developed and nurtured.
Schneider Electric: TRITON/TRISIS Attack Used 0-Day Flaw in its Safety Controller System, and a RAT
News  |  1/18/2018  | 
ICS/SCADA vendor discloses in-depth analysis of a recent targeted attack against one of its customers.
WatchGuard Buys DNS-Filtering Company Percipient Networks
Quick Hits  |  1/17/2018  | 
Percipient's 'Strongarm' to become part of WatchGuard's SMB security services.
Where to Find Security Holes in Serverless Architecture
News  |  1/17/2018  | 
Serverless architectures take away business responsibility for server management, but security should still be top of mind.
Living with Risk: Where Organizations Fall Short
Commentary  |  1/17/2018  | 
People tasked with protecting data are too often confused about what they need to do, even with a solid awareness of the threats they face.
How AI Would Have Caught the Forever 21 Breach
Commentary  |  1/17/2018  | 
Companies must realize that the days of the desktop/server model are over and focus on "nontraditional" devices.
In Security & Life, Busy Is Not a Badge of Honor
Commentary  |  1/16/2018  | 
All security teams are busy, but not all security teams are productive. The difference between the two is huge.
Most Common Exploits of 2017 in Microsoft Office, Windows
News  |  1/16/2018  | 
The most common exploit affects Microsoft Office and has been used by attackers in North Korea, China, and Iran.
Doh!!! The 10 Most Overlooked Security Tasks
Slideshows  |  1/16/2018  | 
Heres a list of gotchas that often slip past overburdened security pros.
Four Malicious Google Chrome Extensions Affect 500K Users
Quick Hits  |  1/16/2018  | 
ICEBRG Security Research team's finding highlights an often-overlooked threat.
Mental Models & Security: Thinking Like a Hacker
Commentary  |  1/16/2018  | 
These seven approaches can change the way you tackle problems.
How to Attract More Women Into Cybersecurity Now
News  |  1/12/2018  | 
A recent survey finds a number of attributes women seek in their careers can be found in a cybersecurity profession the dots just need to be connected.
What Can We Learn from Counterterrorism and National Security Efforts?
Commentary  |  1/12/2018  | 
The best practices and technologies that originated in the intelligence realm can help businesses stay safer, too.
Survey Suggests Many Are Still Waiting for Spectre, Meltdown Windows Updates
News  |  1/11/2018  | 
Microsoft's insistence on a specific registry key setting for offering the updates on systems appears to be the issue, security vendor Barkly says.
Page 1 / 2   >   >>


DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerry,  11/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15073
PUBLISHED: 2019-11-20
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15072
PUBLISHED: 2019-11-20
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15071
PUBLISHED: 2019-11-20
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail syste...
CVE-2019-6176
PUBLISHED: 2019-11-20
A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.
CVE-2019-6184
PUBLISHED: 2019-11-20
A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalation.