Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in December 2019
Page 1 / 2   >   >>
Operational Technology: Why Old Networks Need to Learn New Tricks
Commentary  |  12/31/2019  | 
Cybercriminals are maximizing their opportunity by targeting older vulnerabilities in OT environments. It's time to fight back.
Fraud in the New Decade
Commentary  |  12/30/2019  | 
Like any enterprise that wants to survive, fraudsters and hackers will continue to build on past successes to fuel future growth
The Night Before 'Breachmas'
Commentary  |  12/24/2019  | 
What does identity management have to do with Charles Dickens' classic 'A Christmas Carol'? A lot more than you think.
Citrix Urges Firms to Harden Configurations After Flaw Report
News  |  12/23/2019  | 
A vulnerability in two of the company's appliances opens 80,000 networks up for exploitation.
Mastercard Announces Plan to Purchase RiskRecon
Quick Hits  |  12/23/2019  | 
The acquisition is expected to close in the first quarter of 2020.
Former NY Hospital Employee Admits to Stealing Colleagues' Data
Quick Hits  |  12/23/2019  | 
Richard Liriano pleads guilty to compromising hospital computers and co-workers' email accounts, as well as stealing personal files and photos.
2020 & Beyond: The Evolution of Cybersecurity
Commentary  |  12/23/2019  | 
As new technologies disrupt the industry, remember that security is a process, not a goal. Educate yourself on how you can best secure your corner of the Web.
20 Vulnerabilities to Prioritize Patching Before 2020
News  |  12/23/2019  | 
Researchers list the top 20 vulnerabilities currently exploited by attack groups around the world.
New Orleans to Boost Cyber Insurance to $10M Post-Ransomware
Quick Hits  |  12/20/2019  | 
Mayor LaToya Cantrell anticipates the recent cyberattack to exceed its current $3 million cyber insurance policy.
Patch Management: How to Prioritize an Underserved Vulnerability
Commentary  |  12/19/2019  | 
Why is one of the biggest problems in cybersecurity also one that CISOs largely ignore? Here are three reasons and a road map to a modern approach.
Global Cyber Alliance Launches New Security Efforts for Election Officials
Quick Hits  |  12/19/2019  | 
The Craig Newmark Trustworthy Internet and Democracy Program will develop security toolkits -- and enhance existing ones -- ahead of the 2020 presidential election.
How a Password-Free World Could Have Prevented the Biggest Breaches of 2019
Commentary  |  12/19/2019  | 
If history has taught us anything, it's that hackers can (and will) compromise passwords. Innovation in authentication technology is poised to change that in the coming year.
5 Security Resolutions to Prevent a Ransomware Attack in 2020
Commentary  |  12/18/2019  | 
Proactively consider tools to detect anomalous behavior, automatically remediate, and segment threats from moving across the network.
Microsoft Issues Out-of-Cycle SharePoint Update
Quick Hits  |  12/18/2019  | 
The update repairs vulnerabilities that could lead to very effective phishing messages.
Worried About Magecart? Here's How to Check for It
Quick Hits  |  12/18/2019  | 
Researchers share how everyday users can check for malicious code on e-commerce websites.
Your First Month as a CISO: Forming an Information Security Program
Commentary  |  12/18/2019  | 
It's easy to get overwhelmed in your new position, but these tips and resources will help you get started.
7 Tips to Keep Your Family Safe Online Over the Holidays
Slideshows  |  12/17/2019  | 
Security experts offer key cyber advice for family members.
15 Million Patient Records Exposed Attack on Canadian Lab
Quick Hits  |  12/17/2019  | 
A cyberattack against LifeLabs exposed personal information on patients in Ontario and British Columbia.
Don't Make Security Training a 'One-and-Done'
Commentary  |  12/17/2019  | 
How to move beyond one-off campaigns and build a true security awareness program.
Financial Services Breaches Less Common, More Damaging, Than Those in Other Sectors
Quick Hits  |  12/16/2019  | 
While far less common than breaches in other industry sectors, financial services breaches were more than twice as expensive, per record exposed, than the average for tech businesses.
SQL Server 2019 Tool Tells Attackers Which Data Is Sensitive
News  |  12/16/2019  | 
The design of SQL Data Discovery & Classification could let attackers pinpoint sensitive information while flying under organizations' radars.
Rooster Teeth Alerts Customers to Magecart Attack
Quick Hits  |  12/16/2019  | 
The entertainment company discovered malicious content on the Shopify platform for its online store and removed it the same day.
Why Enterprises Buy Cybersecurity 'Ferraris'
Commentary  |  12/16/2019  | 
You wouldn't purchase an expensive sports car if you couldn't use it properly. So, why make a pricey security investment before knowing it fits into your ecosystem?
Android App Analysis Uncovers Seasonal Shopping Risk
News  |  12/12/2019  | 
Researchers scanned 4,200 Android apps and found many exhibit malicious behavior or have a dangerous level of permissions.
Get Organized Like a Villain
Commentary  |  12/12/2019  | 
What cybercrime group FIN7 can teach us about using agile frameworks.
Waking Up to Third-Party Security Risk
Commentary  |  12/12/2019  | 
You can't rely on the words, intentions, or security measures of others to guard your company, customer and brand.
Intel Issues Fix for 'Plundervolt' SGX Flaw
News  |  12/11/2019  | 
Researchers were able to extract AES encryption key using SGX's voltage-tuning function.
5 Tips for Keeping Your Security Team on Target
Commentary  |  12/11/2019  | 
In nearly every security environment, competing priorities are a constant battleground. Here's how to keep the focus on what's important.
Only Half of Malware Caught by Signature AV
News  |  12/11/2019  | 
Machine learning and behavioral detection are necessary to catch threats, WatchGuard says in a new report. Meanwhile, network attacks have risen, especially against older vulnerabilities, such as those in Apache Struts.
City of Pensacola, Fla., Confirms Ransomware Attack
Quick Hits  |  12/11/2019  | 
Most systems remain offline to prevent the attack from spreading.
Microsoft Fixes Windows Zero-Day on Lightest Patch Tuesday of 2019
News  |  12/10/2019  | 
This month's batch of security updates addresses 36 CVEs, seven of which are rated Critical and one of which has been exploited in the wild.
Blink Cameras Found with Multiple Vulnerabilities
Quick Hits  |  12/10/2019  | 
Researchers found three broad types of vulnerabilities, one of which should be particularly concerning to consumers.
Intel's CPU Flaws Continue to Create Problems for the Tech Community
Commentary  |  12/10/2019  | 
We can't wait out this problem and hope that it goes away. We must be proactive.
Deliver a Deadly Counterpunch to Ransomware Attacks: 4 Steps
Commentary  |  12/10/2019  | 
You can't prevent all ransomware attacks. However, it's possible to ensure that if a breach happens, it doesn't spread, affect business, and become a newsworthy event.
Scientists Break Largest Encryption Key Yet with Brute Force
Quick Hits  |  12/9/2019  | 
The key, only one-third the length of most commercial encryption keys, took more than 35 million compute hours to break.
Microsoft 'Campaign Views' Offers Full Look at Office 365 Attacks
News  |  12/9/2019  | 
Campaign views, arriving in public preview, aims to share more context around how attackers targeted an organization and whether its defenses worked.
Maersk CISO Says NotPeyta Devastated Several Unnamed US firms
Commentary  |  12/9/2019  | 
At least two companies may have been dealt even more damage than the shipping giant, which lost nearly its entire global IT infrastructure.
4 Tips to Run Fast in the Face of Digital Transformation
Commentary  |  12/9/2019  | 
This gridiron-inspired advice will guarantee your digital transformation success and keep your data safe.
Data Center Provider CyrusOne Confirms Ransomware Attack
Quick Hits  |  12/6/2019  | 
The attack struck CyrusOne's managed services division and compromised six customers primarily serviced by a New York data center.
Senators Call for End to Controversial NSA Program
Quick Hits  |  12/6/2019  | 
The program for collecting telephone call metadata has faced increased scrutiny and restrictions since Edward Snowden revealed its existence in 2013.
Success Enablers or Silent Killers?
Commentary  |  12/6/2019  | 
These five success enablers will help CISOs report, measure, and demonstrate ROI to the C-suite.
VPN Flaw Allows Criminal Access to Everything on Victims' Computers
Quick Hits  |  12/5/2019  | 
Vulnerability in the Aviatrix VPN client, since patched, gives an attacker unlimited access to a breached system.
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Commentary  |  12/5/2019  | 
Assessments can be used against your company in court proceedings. Here's how to mitigate this potential risk.
Microsoft Defender ATP Brings EDR Capabilities to macOS
Quick Hits  |  12/5/2019  | 
Mac computers will now have the option to use Microsoft Defender Advanced Threat Protection's endpoint and detection response.
What's in a Botnet? Researchers Spy on Geost Operators
News  |  12/4/2019  | 
The investigation of a major Android banking botnet yields insights about how cybercriminals structure and run an illicit business.
Navigating Security in the Cloud
Commentary  |  12/4/2019  | 
Underestimating the security changes that need to accompany a shift to the cloud could be fatal to a business. Here's why.
Microsoft Issues Advisory for Windows Hello for Business
Quick Hits  |  12/4/2019  | 
An issue exists in Windows Hello for Business when public keys persist after a device is removed from Active Directory, if the AD exists, Microsoft reports.
Attackers Continue to Exploit Outlook Home Page Flaw
News  |  12/4/2019  | 
FireEye issues guidance on locking down Outlook, claiming that security researchers, at least, are able to work around the patch issued by Microsoft.
Application & Infrastructure Risk Management: You've Been Doing It Backward
Commentary  |  12/4/2019  | 
Before getting more scanning tools, think about what's needed to defend your organization's environment and devise a plan to ensure all needed tools can work together productively.
TrickBot Expands in Japan Ahead of the Holidays
News  |  12/3/2019  | 
Data indicates TrickBot operators are modifying its modules and launching widespread campaigns around the world.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.
CVE-2020-24565
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25770
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25771
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...