Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Advanced Threats posted in July 2016
Second Democratic Party Website Hacked
News  |  7/29/2016  | 
In a DNC-like attack, pro-Russian hackers broke into a website belonging to the Democratic Congressional Campaign Committee -- and reportedly also the Clinton campaign website.
5 Things We Know So Far About The DNC Hack
Slideshows  |  7/29/2016  | 
The plot thickens this week as Donald Trump openly calls on Russia to release Hillary Clinton’s emails. All roads appear to lead to Russia in the DNC -- and now possibly the DCCC -- hacks.
Multiple Major Security Products Open To Big Vulns Via 'Hooking Engines'
News  |  7/28/2016  | 
Black Hat USA talk will show how flawed implementation of hooking techniques are putting security and other software at risk.
How To Stay Safe On The Black Hat Network: ‘Don’t Connect To It’
Commentary  |  7/28/2016  | 
Black Hat attendees may have changed their titles and now carry business cards but hackers gotta hack and there’s no better place to do it than Black Hat.
Russia Likely Behind DNC Breach, Says FBI
Quick Hits  |  7/26/2016  | 
Motive behind DNC hack and leak is possibly to tilt election in favor of Trump, say US officials.
New Portal Offers Decryption Tools For Some Ransomware Victims
News  |  7/25/2016  | 
Nomoreransom.org, a joint initiative between Europol, the Dutch National Police, Kaspersky Lab and Intel Security, offers help in getting encrypted data back.
How Jihadists Operate Online And Under The Radar: Report
News  |  7/22/2016  | 
Secure browsers, VPNs, protected email apps, and mobile security apps are just tip of iceberg, Flashpoint report shows.
Auto Industry ISAC Releases Best Practices For Connected Vehicle Cybersecurity
News  |  7/21/2016  | 
Goal is to provide car manufactures with guidelines for protecting modern vehicles against emerging cyber threats
Tools & Training To ‘Hack Yourself’ Into Better Security
Commentary  |  7/21/2016  | 
How to teach your blue team to think like the red team when your network is under attack and time is your most valuable asset.
Majority Of Companies Say Trade Secrets Likely Compromised
News  |  7/21/2016  | 
About 60 percent of companies in a survey by Ponemon and Kilpatrick Townsend say at least some of their trade secrets are likely in the hands of rivals
Ransomware Victims Rarely Pay The Full Ransom Price
News  |  7/18/2016  | 
The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.
UK Rail Hit By Four Cyberattacks In One Year
Quick Hits  |  7/18/2016  | 
No disruption to rail network caused, hackers appear to be nation-states, says cybersecurity firm Darktrace.
Meet The Teams In DARPA's All-Machine Hacking Tournament
Slideshows  |  7/15/2016  | 
"Autonomous security" is DARPA's latest game. Its Cyber Grand Challenge will culminate at DEF CON with a contest to see which of these seven finalists' machines will automatically detect and remediate the most security vulnerabilities.
Context-Rich And Context-Aware Cybersecurity
Partner Perspectives  |  7/14/2016  | 
An adaptive threat-prevention model is quickly replacing traditional, unintegrated architectures as security teams work to achieve a sustainable advantage against complex threats.
Adobe Fixes 52 Vulnerabilities In Flash
Quick Hits  |  7/13/2016  | 
Updated version fixes CVEs that allowed remote code execution on affected machines.
Fiat Chrysler Launches Bug Bounty Program
Quick Hits  |  7/13/2016  | 
Platform will be leveraged to identify and resolve security issues in automobile software.
What I Expect to See At Black Hat 2016: 5 Themes
Commentary  |  7/13/2016  | 
Over the years, Black Hat has morphed from a little show for security researchers to a big conference that attracts everyone from black-hat hackers to C-level security execs. Here's what piques my interest this year.
Profiles Of The Top 7 Bug Hunters From Around the Globe
Slideshows  |  7/12/2016  | 
'Super hunters' share a common goal: to find the most high impact valid bugs before a bad guy does.
Does Defense In Depth Still Work Against Today’s Cyber Threats?
Commentary  |  7/11/2016  | 
Yes. But not for much longer unless the industry shifts to an automated security and zero trust model.
NATO Ambassador: How The Ukraine Crisis Fits Cyber War Narrative
News  |  7/7/2016  | 
Kenneth Geers previews his Black Hat talk and discusses the strategic military maneuvers governments can make within cyberspace.
Big Business Ransomware: A Lucrative Market in the Underground Economy
Commentary  |  7/1/2016  | 
Why lock and/or pilfer a person’s files worth hundreds of dollars when corporate data is infinitely more valuable?
China’s Economic Cyber-Spying Drops Post Sept Talks: US Official
Quick Hits  |  7/1/2016  | 
U.S. Assistant Attorney General John Carlin's statement finds support in FireEye report of a 90% fall in China-based hacking.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file