Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in April 2015
Breaking The Security Fail Cycle
News  |  4/30/2015  | 
How security teams are evolving in the face of today's threats.
IRC Botnets Are Not Quite Dead Yet
News  |  4/29/2015  | 
The handful that still operate are more sophisticated and resilient than before, Zscaler says.
Big Data & The Security Skills Shortage
Commentary  |  4/29/2015  | 
Finding a security analyst with the data discovery experience to combat modern threats is like searching for the mythical unicorn. The person does not exist
RSA Highlighted Impending IoT Troubles
News  |  4/28/2015  | 
Same mistakes made all over again with a new technology game changer, but the stakes are higher this time.
Application Layer Exfiltration Protection: A New Perspective on Firewalls
Partner Perspectives  |  4/28/2015  | 
Organizations must adopt a new way of thinking about safeguarding sensitive data from theft and unauthorized exfiltration.
Note To Vendors: CISOs Dont Want Your Analytical Tools
Commentary  |  4/28/2015  | 
What they need are solutions that deliver prioritized recommendations and confidence in the analytical rigor behind those recommendations to take meaningful action.
As Malware Surges, U.S. Remains Biggest Source of Attacks
News  |  4/24/2015  | 
The country leads others in malicious IP, URLs and phishing sites.
Cybersecurity: Dont Bank On It With 3rd Parties
Commentary  |  4/24/2015  | 
Not knowing that a contractors employee had access to system passwords is not a valid excuse when your clients records are stolen.
DHS Courts Private Sector For Threat Intelligence-Sharing
News  |  4/23/2015  | 
Homeland Security NCCIC now STIX- and TAXII-enabled for automated machine-to-machine sharing of intel, agency officials told attendees at the RSA Conference.
6 Most Dangerous New Attack Techniques in 2015
News  |  4/23/2015  | 
SANS experts lay out the up-and-coming trends in attack patterns at RSA Conference.
From The RSA Keynote Stage, Day Two
News  |  4/22/2015  | 
A 9-year-old CEO hacker, a record-breaking swimmer, and a variety of ideas about data-driven security hit the RSA stage.
The Bad News For Infosec In The Target Settlement
Commentary  |  4/22/2015  | 
The legal argument behind the $10 million Class Action lawsuit and subsequent settlement is a gross misrepresentation of how attackers operate.
Bank Botnets Continue to Thrive One Year After Gameover Zeus Takedown
News  |  4/22/2015  | 
Features on new botnets suggest attackers have learned from the lessons of takedown.
Virginia Forms First State-Level Cyberthreat Intel-Sharing Organization
Quick Hits  |  4/21/2015  | 
Governor Terry McAuliffe today announced Virginia's new Information Sharing and Analysis Organization (ISAO).
Health Insurers Digital Footprint Widening Attack Surface
Commentary  |  4/21/2015  | 
Insurers are ripe targets for attackers since theyre efficient concentrators of every kind of data needed for identity theft, credit card and insurance fraud. Heres proof.
Waratek Wins RSA Innovation Sandbox
News  |  4/20/2015  | 
RSA: 10th annual event honors runtime application self protection solution for solving Java security problems.
White House's Daniel 'Intrigued' By UL-Type Model For IoT Security
News  |  4/20/2015  | 
Michael Daniel, the national cybersecurity coordinator and assistant to the President, talks Internet of Things security and recent Executive Orders on intel-sharing and sanctions.
DHS: Most Organizations Need Improvement In Managing Security Risk
Commentary  |  4/20/2015  | 
At a Department of Homeland Security Summit, government and corporate security teams are taken to task for failing to address critical issues of software assurance, testing and lifecycle support.
APT Group 'Pawn Storm' Ratchets Up Attacks
News  |  4/17/2015  | 
Threat actors have set up several new C&C servers and dozens of new malicious URLs -- and now targeting White House staffers, Trend Micro says.
Inside the 4 Most Common Threat Actor Tools
Commentary  |  4/17/2015  | 
How do you prevent your environment from becoming the next target? Turn the tables on your attackers.
Popular Home Automation System Backdoored Via Unpatched Flaw
News  |  4/16/2015  | 
Malicious firmware update could lead to device, full home network 0wnage, researcher will show next week at the RSA Conference.
Microsoft Zero-Day Bug Being Exploited In The Wild
News  |  4/16/2015  | 
As attacks mount, and over 70 million websites remain vulnerable, advice is "fix now."
Harnessing The Power Of Cyber Threat Intelligence
Commentary  |  4/16/2015  | 
Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter.
HackerOne Now Offers Bounties For New Bug Discovery Tools And Techniques
News  |  4/15/2015  | 
Tools are a more cost-efficient option for finding bugs in mature products, new research shows.
Why Standardized Threat Data Will Help Stop the Next Big Breach
Commentary  |  4/15/2015  | 
Adopting industry standards for threat intelligence will reduce a lot of the heavy lifting and free cyber security first responders to focus on what they do best.
Threat Intelligence Is a Two-Way Street
Partner Perspectives  |  4/14/2015  | 
Intelligence analysis should be looked upon as less of a service and more of a partnership.
Authorities Take Down Malware-Distributing Simda Botnet
News  |  4/14/2015  | 
Fourteen C&Cs dismantled to take out nerve center of a botnet that spanned 190 countries.
Botnet to Cybersecurity: Catch Me If You Can
Partner Perspectives  |  4/14/2015  | 
Tracking and disrupting the crime ring behind a polymorphic botnet.
Verizon DBIR: Mobile Devices Not A Factor In Real-World Attacks
News  |  4/14/2015  | 
New annual Verizon Data Breach Investigations Report shows most attacks affect a secondary victim, the average cost of a data breach is just 58 cents per stolen record -- and attackers are not going after mobile en masse.
Chinese Nation-State Hackers Give Up Attack Campaign
News  |  4/13/2015  | 
It worked on Hurricane Panda. Can APT30 and other organized cyberespionage groups also be convinced that an attack campaign isn't worth the trouble?
Majority Of Organizations Unprepared For Insider Attacks
News  |  4/13/2015  | 
SANS report shows gaps in insider detection and response.
Better Together: Network Operations & Infosec
Commentary  |  4/13/2015  | 
Getting networking and information security teams together in the same room is a critical step for companies that want to build a continuous information security culture.
Insider Threats: Focus On The User, Not The Data
Commentary  |  4/10/2015  | 
Global cybersecurity spending will hit almost $77 billion in 2015, so why are there more high-profile leaks than ever?
Utilities And Education The Most Bot-Infested Sectors
News  |  4/9/2015  | 
The more bots in-house, the more a company is likely to have reported a data breach, BitSight report finds.
Solving the Right Problem: Stop Adversaries, Not Just Their Tools
Commentary  |  4/9/2015  | 
A malware-centric strategy is mere childs play against todays sophisticated adversaries. Heres why.
AlienSpy A More Sophisticated Version Of The Same Old RATs
News  |  4/8/2015  | 
The AlienSpy remote access Trojan bears a resemblance to Frutas, Adwind, and Unrecom, say researchers at Fidelis.
5 Reasons You 'Better Call Saul' To Protect Corporate Data
Commentary  |  4/8/2015  | 
These pop-culture lessons from the entertaining Breaking Bad spinoff will make security awareness training both fun and effective.
So, You 'Dont Believe In' Security Education?
Commentary  |  4/7/2015  | 
You're in the minority for a reason. Here's why.
3 Of 4 Global 2000 Companies Still Vulnerable To Heartbleed
News  |  4/7/2015  | 
Largest companies on Earth might have patched, but haven't done their due diligence with revoking and issuing new certificates, says Venafi.
Could Security Concerns Scuttle M&A And Investment Deals?
News  |  4/6/2015  | 
Questions of investor notification of Slack breach prior to signing shows how important security posture will be in vetting future deals.
Car-Hacking Prototype Passes Crash Test
News  |  4/6/2015  | 
Sensor-based technology--with military drone roots--created to detect and automatically stop cyberattacks on cars.
Obamas War On Hackers
Commentary  |  4/6/2015  | 
Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.
The Good & Bad Of BYOD
Commentary  |  4/3/2015  | 
BYOD has very little to do with technology and everything to do with security, organizational politics, and human psychology.
Google: Less Than 1% Of Androids Have Potentially Harmful App Installed
Quick Hits  |  4/2/2015  | 
Google's Android security report shows that devices that only install apps from the Google Play store have fewer infections.
EFF General Counsel Takes On NSA Spying
News  |  4/2/2015  | 
Kurt Opsahl talks to Dark Reading about government surveillance and privacy in anticipation of his Interop keynote.
8 Identity & Access Metrics To Manage Breach Risks
Slideshows  |  4/2/2015  | 
Measurables for improving security posture around access controls.
Stuxnet Five Years Later: Did We Learn The Right Lesson?
Commentary  |  4/2/2015  | 
No! That's despite an abundance of best practices and standards that are shining light into the dark corners of industrial control system security.
Spring Cleaning In The SOC: Focus On the Inside Threat
Commentary  |  4/1/2015  | 
Along with warmer weather and melting snow, spring brings the perfect opportunity for user engagement. Heres how to transform insiders into your most sophisticated security device.
Application of Threat Indicators: A Temporal View
Partner Perspectives  |  4/1/2015  | 
Better outcomes will be achieved when were applying temporal considerations to threat indicators.


Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19071
PUBLISHED: 2019-11-18
A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
CVE-2019-19072
PUBLISHED: 2019-11-18
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
CVE-2019-19073
PUBLISHED: 2019-11-18
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, ...
CVE-2019-19074
PUBLISHED: 2019-11-18
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
CVE-2019-19075
PUBLISHED: 2019-11-18
A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.