Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Advanced Threats posted in June 2021
3 Things Every CISO Wishes You Understood
Commentary  |  6/30/2021  | 
Ensuring the CISO's voice is heard by the board will make security top of mind for the business, its employees, and their customers.
Ransomware Losses Drive Up Cyber-Insurance Costs
News  |  6/29/2021  | 
Premiums have gone up by 7% on average for small firms and between 10% and 40% for medium and large businesses.
Microsoft Refining Third-Party Driver Vetting Processes After Signing Malicious Rootkit
News  |  6/28/2021  | 
Rogue driver was distributed within gaming community in China, company says.
Attacks Erase Western Digital Network-Attached Storage Drives
News  |  6/28/2021  | 
The company suspects a remote code execution vulnerability affecting My Book Live and My Book Live Duo devices and recommends that business and individual users turn off the drives to protect their data.
New House Bill Aims to Drive Americans' Security Awareness
Quick Hits  |  6/28/2021  | 
The legislation requires the National Telecommunications and Information Administration to establish a cybersecurity literacy campaign.
Expecting the Unexpected: Tips for Effectively Mitigating Ransomware Attacks in 2021
Commentary  |  6/23/2021  | 
Cybercriminals continually innovate to thwart security protocols, but organizations can take steps to prevent and mitigate ransomware attacks.
Identity Eclipses Malware Detection at RSAC Startup Competition
Commentary  |  6/22/2021  | 
All 10 finalists in the Innovation Sandbox were focused on identity, rather than security's mainstay for the last 20 years: Malware detection.
Did Companies Fail to Disclose Being Affected by SolarWinds Breach?
News  |  6/21/2021  | 
The SEC has sent out letters to some investment firms and publicly listed companies seeking information, Reuters says.
4 Habits of Highly Effective Security Operators
Commentary  |  6/18/2021  | 
These good habits can make all the difference in advancing careers for cybersecurity operators who spend their days putting out fires large and small.
Trickbot Investigation Shows Details of Massive Cybercrime Effort
News  |  6/11/2021  | 
Nearly a score of cybercriminals allegedly worked together to create the Trickbot malware and deploy it against more than a million users, an unsealed indictment claims.
Many Mobile Apps Intentionally Using Insecure Connections for Sending Data
News  |  6/11/2021  | 
A new analysis of iOS and Android apps released to Apple's and Google's app stores over the past five years found many to be deliberately breaking HTTPS protections.
Deepfakes Are on the Rise, but Don't Panic Just Yet
Commentary  |  6/10/2021  | 
Deepfakes will likely give way to deep suspicion, as users try to sort legitimate media from malicious.
First Known Malware Surfaces Targeting Windows Containers
News  |  6/7/2021  | 
Siloscape is designed to create a backdoor in Kubernetes clusters to run malicious containers.
Is Your Adversary James Bond or Mr. Bean?
Commentary  |  6/2/2021  | 
Especially with nation-state attacks, its critical to assess whether you're up against jet fighter strength or a bumbler who tries to pick locks.
CISO Confidence Is Rising, but Issues Remain
Commentary  |  6/1/2021  | 
New research reveals how global CISOs dealt with COVID-19 and their plans for 20222023.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26564
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFil...
CVE-2020-26565
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
CVE-2020-26806
PUBLISHED: 2021-07-31
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.
CVE-2021-33617
PUBLISHED: 2021-07-31
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
CVE-2021-27491
PUBLISHED: 2021-07-30
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process.