Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in February 2020
<<   <   Page 2 / 2
Cybercriminals Swap Phishing for Credential Abuse, Vuln Exploits
News  |  2/11/2020  | 
Infection vectors were evenly divided among phishing, vulnerability exploitation, and unauthorized credential use in 2019.
Macs See More Adware, Unwanted Apps Than PCs
News  |  2/11/2020  | 
The latest data from Malwarebytes show the average Mac sees almost twice as many bad apps as Windows systems, but actual malware continues to be scarce.
CIA's Secret Ownership of Crypto AG Enabled Extensive Espionage
Quick Hits  |  2/11/2020  | 
Crypto AG made millions selling encryption devices to more than 120 countries, which unknowingly transmitted intel back to the CIA.
Keeping a Strong Security Metrics Framework Strong
Commentary  |  2/11/2020  | 
Don't just report metrics -- analyze, understand, monitor, and adjust them. These 10 tips will show you how.
How North Korea's Senior Leaders Harness the Internet
News  |  2/10/2020  | 
Researchers learn how North Korea is expanding its Internet use in order to generate revenue and bypass international sanctions.
Israel's Entire Voter Registry Exposed in Massive Incident
Quick Hits  |  2/10/2020  | 
Personal details of nearly 6.5 million Israelis were out in the open after the entire registry was uploaded to an notably insecure app.
6 Factors That Raise the Stakes for IoT Security
Slideshows  |  2/10/2020  | 
Developments that exacerbate the risk and complicate making Internet of Things devices more secure.
Day in the Life of a Bot
Commentary  |  2/10/2020  | 
A typical workday for a bot, from its own point of view.
Google Takeout Serves Up Video Files to Strangers
Quick Hits  |  2/7/2020  | 
A limited number of user videos were shared with others in a five-day incident from November.
RobbinHood Kills Security Processes Before Dropping Ransomware
News  |  2/7/2020  | 
Attackers deploy a legitimate, digitally signed hardware driver to delete security software from machines before encrypting files.
5 Measures to Harden Election Technology
Commentary  |  2/7/2020  | 
Voting machinery needs hardware-level security. The stakes are the ultimate, and the attackers among the world's most capable.
Cybersecurity Vendor Landscape Transforming as Symantec, McAfee Enter New Eras
Commentary  |  2/6/2020  | 
Two years ago, Symantec and McAfee were both primed for a comeback. Today, both face big questions about their future.
Facebook Tops Imitated Brands as Attackers Target Tech
Quick Hits  |  2/6/2020  | 
Brand impersonators favor Facebook, Yahoo, Network, and PayPal in phishing attempts to steal credentials from victims.
Invisible Pixel Patterns Can Communicate Data Covertly
News  |  2/6/2020  | 
University researchers show that changing the brightness of monitor pixels can communicate data from air-gapped systems in a way not visible to human eyes.
How Can We Make Election Technology Secure?
Commentary  |  2/6/2020  | 
In Iowa this week, a smartphone app for reporting presidential caucus results debuted. It did not go well.
IoT Malware Campaign Infects Global Manufacturing Sites
News  |  2/5/2020  | 
The infection uses Lemon_Duck PowerShell malware variant to exploit vulnerabilities in embedded devices at manufacturing sites.
Emotet Preps for Tax Season with New Phishing Campaign
Quick Hits  |  2/5/2020  | 
Malicious emails in a new attack campaign contain links and attachments claiming to lead victims to W-9 forms.
Keeping Compliance Data-Centric Amid Accelerating Regulation
Commentary  |  2/5/2020  | 
As the regulatory landscape transforms, it's still smart to stay strategically focused on protecting your data.
8 of the 10 Most Exploited Bugs Last Year Involved Microsoft Products
News  |  2/4/2020  | 
Six of them were the same as from the previous year, according to new Recorded Future analysis.
SharePoint Bug Proves Popular Weapon for Nation-State Attacks
News  |  2/4/2020  | 
Thousands of servers could be exposed to SharePoint vulnerability CVE-2019-0604, recently used in cyberattacks against Middle East government targets.
Microsoft DART Finds Web Shell Threat on the Rise
Quick Hits  |  2/4/2020  | 
Various APT groups are successfully using Web shell attacks on a more frequent basis.
Ransomware Attacks: Why It Should Be Illegal to Pay the Ransom
Commentary  |  2/4/2020  | 
For cities, states and towns, paying up is short-sighted and only makes the problem worse.
Twitter Suspends Fake Accounts Abusing Feature that Matches Phone Numbers and Users
Quick Hits  |  2/4/2020  | 
The company believes state-sponsored actors may also be involved.
Kubernetes Shows Built-in Weakness
News  |  2/4/2020  | 
A Shmoocon presentation points out several weaknesses built in to Kubernetes configurations and how a researcher can exploit them.
What WON'T Happen in Cybersecurity in 2020
Commentary  |  2/4/2020  | 
Predictions are a dime a dozen. Here are six trends that you won't be hearing about anytime soon.
Bad Certificate Knocks Teams Offline
Quick Hits  |  2/3/2020  | 
Microsoft allowed a certificate to expire, knocking the Office 365 version of Teams offline for almost an entire day.
Researchers Find 24 'Dangerous' Android Apps with 382M Installs
News  |  2/3/2020  | 
Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.
Coronavirus Phishing Attack Infects US, UK Inboxes
Quick Hits  |  2/3/2020  | 
Cybercriminals capitalize on fears of a global health emergency with phishing emails claiming to offer advice for protecting against coronavirus.
How Device-Aware 2FA Can Defeat Social Engineering Attacks
Commentary  |  2/3/2020  | 
While device-aware two-factor authentication is no panacea, it is more secure than conventional SMS-based 2FA. Here's why.
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVE-2021-41394
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.
CVE-2021-41395
PUBLISHED: 2021-09-18
Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.
CVE-2021-3806
PUBLISHED: 2021-09-18
A path traversal vulnerability on Pardus Software Center's &quot;extractArchive&quot; function could allow anyone on the same network to do a man-in-the-middle and write files on the system.
CVE-2021-41392
PUBLISHED: 2021-09-17
static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.