Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in February 2020
Page 1 / 2   >   >>
New Trickbot Delivery Method Focuses on Windows 10
Quick Hits  |  2/28/2020  | 
Researchers discover attackers abusing the latest version of the remote desktop ActiveX control class introduced for Windows 10.
6 Truths About Disinformation Campaigns
Slideshows  |  2/28/2020  | 
Disinformation goes far beyond just influencing election outcomes. Here's what security pros need to know.
Clearview AI Customers Exposed in Data Breach
Quick Hits  |  2/27/2020  | 
Customers for the controversial facial recognition company were detailed in a log file leaked to news organizations.
Government Employees Unprepared for Ransomware
Quick Hits  |  2/27/2020  | 
Data shows 73% are concerned about municipal ransomware threats but only 38% are trained on preventing these attacks.
How We Enabled Ransomware to Become a Multibillion-Dollar Industry
Commentary  |  2/27/2020  | 
As an industry, we must move beyond one-dimensional approaches to assessing ransomware exposures. Asking these four questions will help.
Intel Analyzes Vulns Reported in its Products Last Year
News  |  2/27/2020  | 
A new Intel report looks at the more than 200 CVEs affecting Intel products in 2019.
What Your Company Needs to Know About Hardware Supply Chain Security
Commentary  |  2/27/2020  | 
By establishing a process and framework, you can ensure you're not giving more advanced attackers carte blanche to your environment.
US State Dept. Shares Insider Tips to Fight Insider Threats
News  |  2/26/2020  | 
The insider threat is a technology, security, and personnel issue, officials said in explaining an approach that addresses all three factors.
Commonsense Security: Leveraging Dialogue & Collaboration for Better Decisions
Commentary  |  2/26/2020  | 
Sometimes, good old-fashioned tools can help an enterprise create a cost-effective risk management strategy.
Open Cybersecurity Alliance Releases New Language for Security Integration
Quick Hits  |  2/26/2020  | 
OpenDXL Ontology is intended to allow security components to interoperate right out of the box.
Kr00k Wi-Fi Vulnerability Affected a Billion Devices
News  |  2/26/2020  | 
Routers and devices with Broadcom and Cypress Wi-Fi chipsets could be forced to sometimes use encryption keys consisting of all zeroes. Now patched, the issue affected a billion devices, including those from Amazon, Apple, Google, and Samsung.
5 Ways to Up Your Threat Management Game
Commentary  |  2/26/2020  | 
Good security programs start with a mindset that it's not about the tools, it's what you do with them. Here's how to get out of a reactive fire-drill mode with vulnerability management.
Emotet Resurfaces to Drive 145% of Threats in Q4 2019
News  |  2/26/2020  | 
Analysis of 92 billion rejected emails reveals a range of simple and complex attack techniques for the last quarter of 2019.
Ensure Your Cloud Security Is as Modern as Your Business
Commentary  |  2/25/2020  | 
Take a comprehensive approach to better protect your organization. Security hygiene is a must, but also look at your risk posture through a data protection lens.
Google Adds More Security Features Via Chronicle Division
News  |  2/25/2020  | 
Order out of chaos? The saga of Chronicle continues with new security features for the Google Cloud Platform.
Verizon: Attacks on Mobile Devices Rise
News  |  2/25/2020  | 
Companies of all sizes are being hit by mobile attacks and feeling the effects for extended periods of time, according to the 2020 Verizon Mobile Security Index.
Security, Networking Collaboration Cuts Breach Cost
News  |  2/24/2020  | 
CISOs report increases in alert fatigue and the number of records breached, as well as the struggle to secure mobile devices in a new Cisco study.
Enterprise Cloud Use Continues to Outpace Security
News  |  2/24/2020  | 
Nearly 60% of IT and security pros say deployment of business services in the cloud has rushed past their ability to secure them.
Solving the Cloud Data Security Conundrum
Commentary  |  2/24/2020  | 
Trusting the cloud involves a change in mindset. You must be ready to use runtime encryption in the cloud.
7 Tips to Improve Your Employees' Mobile Security
Slideshows  |  2/24/2020  | 
Security experts discuss the threats putting mobile devices at risk and how businesses can better defend against them.
NRC Health Ransomware Attack Prompts Patient Data Concerns
Quick Hits  |  2/21/2020  | 
The organization, which sells patient administration tools to hospitals, could not confirm whether patient data was accessed.
How to Get CISOs & Boards on the Same Page
Commentary  |  2/21/2020  | 
These two groups have talked past each other for years, each hobbled by their own tunnel vision and misperceptions.
Security Now Merges With Dark Reading
News  |  2/21/2020  | 
Readers of Security Now will join the Dark Reading community, gaining access to a wide range of cybersecurity content.
Ransomware Damage Hit $11.5B in 2019
Quick Hits  |  2/20/2020  | 
A new report shows the scale of ransomware's harm and the growth of that damage year-over-year -- an average of $141,000 per incident.
5 Strategies to Secure Cloud Operations Against Today's Cyber Threats
Commentary  |  2/20/2020  | 
With these fundamentals in mind, organizations can reduce their security and compliance risks as they reap the cloud's many benefits:
Zero-Factor Authentication: Owning Our Data
Commentary  |  2/19/2020  | 
Are you asking the right questions to determine how well your vendors will protect your data? Probably not.
44% of Security Threats Start in the Cloud
Quick Hits  |  2/19/2020  | 
Amazon Web Services is a top source of cyberattacks, responsible for 94% of all Web attacks originating in the public cloud.
DHS's CISA Warns of New Critical Infrastructure Ransomware Attack
Quick Hits  |  2/19/2020  | 
An attack on a natural gas compression facility sent the operations offline for two days.
Don't Let Iowa Bring Our Elections Back to the Stone Age
Commentary  |  2/19/2020  | 
The voting experience should be the same whether the vote is in person, by mail, or over the Internet. Let's not allow one bad incident stop us from finding new ways to achieve this.
The Trouble with Free and Open Source Software
News  |  2/18/2020  | 
Insecure developer accounts, legacy software, and nonstandard naming schemes are major problems, Linux Foundation and Harvard study concludes.
Lumu to Emerge from Stealth at RSAC
Quick Hits  |  2/18/2020  | 
The new company will focus on giving customers earlier indications of network and server compromise.
Cyber Fitness Takes More Than a Gym Membership & a Crash Diet
Commentary  |  2/18/2020  | 
Make cybersecurity your top priority, moving away from addressing individual problems with Band-Aids and toward attaining a long-term cyber-fitness plan.
Firmware Weaknesses Can Turn Computer Subsystems into Trojans
News  |  2/18/2020  | 
Network cards, video cameras, and graphics adapters are a few of the subsystems whose lack of security could allow attackers to turn them into spy implants.
8 Things Users Do That Make Security Pros Miserable
Slideshows  |  2/18/2020  | 
When a user interacts with an enterprise system, the result can be productivity or disaster. Here are eight opportunities for the disaster side to win out over the productive.
Palm Beach Elections Office Hit with Ransomware Pre-2016 Election
Quick Hits  |  2/14/2020  | 
Palm Beach County's elections supervisor does not believe the attack is linked to Russian hacking attempts targeting Florida.
DHS Warns of Cyber Heartbreak
Quick Hits  |  2/14/2020  | 
Fraudulent dating and relationship apps and websites raise the risks for those seeking online romance on Valentine's Day.
The 5 Love Languages of Cybersecurity
Commentary  |  2/14/2020  | 
When it comes to building buy-in from the business, all cybersecurity needs is love -- especially when it comes to communication.
DDoS Attacks Nearly Double Between Q4 2018 and Q4 2019
News  |  2/13/2020  | 
Peer-to-peer botnets, TCP reflection attacks, and increased activity on Sundays are three DDoS attack trends from last quarter.
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
News  |  2/13/2020  | 
The new threat model hones in on ML security at the design state.
Huawei Charged with RICO Violations in Federal Court
Quick Hits  |  2/13/2020  | 
A new set of indictments adds conspiracy to violate RICO statutes to a list of existing charges against the Chinese telecommunications giant.
Small Business Security: 5 Tips on How and Where to Start
Commentary  |  2/13/2020  | 
There is no one-size-fits-all strategy for security, but a robust plan and the implementation of new technologies will help you and your IT team sleep better.
Apps Remain Favorite Mobile Attack Vector
Quick Hits  |  2/13/2020  | 
Mobile apps are used in nearly 80% of attacks targeting mobile devices, followed by network and operating system attacks.
Forget Hacks... Ransomware, Phishing Are Election Year's Real Threats
Commentary  |  2/13/2020  | 
As we gear up for the voting season, let's put aside any links between foreign interference and voting machine security and focus on the actual risks threatening election security.
Avast Under Investigation by Czech Privacy Agency
Quick Hits  |  2/12/2020  | 
The software security maker is suspected of selling data about more than 100 million users to companies including Google, Microsoft, and Home Depot.
FBI: Business Email Compromise Cost Businesses $1.7B in 2019
News  |  2/12/2020  | 
BEC attacks comprised nearly half of cybercrime losses last year, which totaled $3.5 billion overall as Internet-enabled crimes ramped up.
Stop Defending Everything
Commentary  |  2/12/2020  | 
Instead, try prioritizing with the aid of a thorough asset inventory.
5 Common Errors That Allow Attackers to Go Undetected
Commentary  |  2/12/2020  | 
Make these mistakes and invaders might linger in your systems for years.
Healthcare Ransomware Damage Passes $157M Since 2016
Quick Hits  |  2/11/2020  | 
Researchers found the total cost far exceeded the amount of ransom paid to attackers.
Microsoft Patches Exploited Internet Explorer Flaw
News  |  2/11/2020  | 
This month's Patch Tuesday brings fixes for 99 CVEs, including one IE flaw seen exploited in the wild.
Why Ransomware Will Soon Target the Cloud
Commentary  |  2/11/2020  | 
As businesses' daily operations become more dependent on cloud services, ransomware authors will follow to maximize profits. The good news: Many of the best practices for physical servers also apply to the cloud.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11749
PUBLISHED: 2020-07-13
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.
CVE-2020-5766
PUBLISHED: 2020-07-13
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
CVE-2020-15689
PUBLISHED: 2020-07-13
Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.
CVE-2019-4591
PUBLISHED: 2020-07-13
IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.
CVE-2019-20907
PUBLISHED: 2020-07-13
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.