Commentary

Content posted in January 2007
YouTube Simpsons Subpoena Spotlights Copyright Insanity
Commentary  |  1/26/2007  | 
No, this isn't another legal tussle or media mess involving O.J. or Judith Regan. It's a Web copyright battle touched off by that overrated weekly animated series starring Homer and Marge. And, as with most copyright disputes, the online data path leads directly to YouTube.
HP Spy Charges Put PC Hacking In Perspective
Commentary  |  1/25/2007  | 
Thoughts of security breaches typically focus on hacking, but that stuff is small potatoes when compared to the big kahuna of unauthorized access: corporate spying.
The Wily 9-Year-Old Who 'Hacked' Airport Security
Commentary  |  1/22/2007  | 
They say social engineering is the most potent form of hacking, and now we have a 9-year-old who's proved it.
5 Free Security Betas You Can Download For Windows Vista
Commentary  |  1/21/2007  | 
Given the torrent of criticism Microsoft has taken for Windows Vista's inelegant User Account Controls (UACs), one couldn't be blamed for assuming that the operating system is handicapped when it comes to security. But one would be wrong, very wrong.
If You Like Needles, You're Gonna Love RFID
Commentary  |  1/19/2007  | 
Some recent news about electronic tracking of cattle, as well as a look at the new James Bond movie, has revived long-repressed fears about vaccinations at the pediatrician.
Trust: It's A Terrible Thing To Waste
Commentary  |  1/18/2007  | 
Kill me now. The latest data hack at the TJX companies has me, and a lot of other people I know, on the edge of their seats. We shop a lot at the TJX family of companies -- T.J. Maxx, Marshalls, HomeGoods, and A.J. Wright and Bob's Stores -- and yesterday's announcement that the company had been hit hard by a data hack is not sitting well.
Phishers And Rootkits And Death Threats, Oh My!
Commentary  |  1/18/2007  | 
I fell for a phisher last week. Embarrassing, but true. Until then, the urgent e-mails telling me that an account had been compromised had only managed to give me slight shivers of concern before my rational self took over and I clicked the delete button. Not this time.
New Security Threats For VoIP
Commentary  |  1/5/2007  | 
Panda Software looks at some scary security threats posed by VoIP. The top part of the article in IT-Observer looks at new ways that VoIP might be used for denial-of-service attacks, but the author, Fernando de la Cuadra, dismisses those threats as unlikely (too quickly, I think). The article then goes on to deal with possible threats posed by social engineering.



Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.