Commentary

Content posted in January 2009
Page 1 / 2   >   >>
Primary Storage's Three Faces
Commentary  |  1/30/2009  | 
Primary storage has three faces. There is active data and inactive data; both of these data sets actually consume space, which we can compress and then remove. Then there is the third face, with the capacity that is allocated but not in use. Each needs to be handled in a different way.
Account & Identity Mismanagement
Commentary  |  1/30/2009  | 
Companies' lack of proper identity management and account revocation never ceases to amaze me. Why aren't these things integrated with the human resources hiring process and subsequent exit procedure when an employee leaves or is fired?
Google Chrome Patch Released
Commentary  |  1/30/2009  | 
Google has released an important patch for its Chrome browwer. If you're running Chrome, patch now.
Fannie Mae Logic Bomb Makes Case For Strong IDM
Commentary  |  1/29/2009  | 
The indictment of an IT contractor working at Fannie Mae, who schemed to destroy the data on 4,000 servers, confirms what we know: bad economic times and layoffs are perilous, and identity and access management has never been more important.
Are We In A Tech 'War' With Russia?
Commentary  |  1/29/2009  | 
I was reading the withering comments Vladimir Putin made to Michael Dell in response to Dell's offer to help Russia. Though Putin is Russia's prime minister, he clearly is also the guy who is running the country. Reading between the lines, I think it is likely he is driving a technology w
Click Fraud Rises As Economy Sinks
Commentary  |  1/29/2009  | 
Fake clicks on ad links are climbing as fast as the economy falls,up a full percentage point in the last three months of 2008, according to pay per click monitoring company Click Forensics.
The Inevitable Has Occurred: Heartland Payment Sued
Commentary  |  1/28/2009  | 
The payment processor Heartland Payment Systems just got served with a lawsuit over the allegedly massive data breach.
Hardware Vendor-Induced Vulnerabilities
Commentary  |  1/28/2009  | 
During a recent penetration test, a friend encountered some really strange findings that he asked me to review. Several of the desktops located in one of the departments had a process listening on an ephemeral, nonstandard TCP port. He provided his Nmap and Nessus findings, which both reported an Apache Web server was running on this mysterious port. The fact they were all running Apache was cert
IE8 Security: Some Questions Answered, Others Raised
Commentary  |  1/28/2009  | 
Internet Explorer 8, which Microsoft has now labeled "Release Candidate 1," meaning it's ready to be tried out by (or on) the public, promises some leaps in browser security. Does it deliver? Yes and, depending on who you ask, not quite.
The Death Of PCI DSS? Don't Be Silly
Commentary  |  1/27/2009  | 
Yes, in the past year two big retailers, who were apparently compliant to the Payment Card Industry Data Security Standard, were breached. Does that mean PCI DSS has grown increasingly irrelevant? That's absurd.
How To Celebrate Privacy Day (And How Not To)
Commentary  |  1/27/2009  | 
Wednesday, Jan. 28, has been designated International Data Privacy Day, and I'm still not sure how to celebrate. Should I invite all of my friends and family over, then go in the bathroom, lock the door, and make an entry in my personal diary? Or maybe we should all put on funny hats and go outside with noisemakers, screaming, "It's none of your friggin' business!!" Ah, those holiday traditions.
NFS On VMware, Not NetApp's Sole Domain
Commentary  |  1/27/2009  | 
Using NFS to store and boot virtual machine images is becoming an attractive option, and for obvious reasons NetApp has been promoting the use of its solutions as the perfect complement to a VMware on NFS strategy. However, NFS isn't the sole domain of NetApp any longer. It now has company from a variety of vendors, including EMC, ONStor, BlueArc, and
USB Drives Dropped Off With Laundry: Whole New Meaning For "Clean Data"
Commentary  |  1/27/2009  | 
9,000 USB drives were left in clothes dropped at UK dry cleaners last year. With numbers that high, you can bet that some, and maybe most, of those drives held private, sensitive, confidential data.
Software Piracy Places Everyone At Risk
Commentary  |  1/27/2009  | 
On Monday, the United States claimed victory in a World Trade Organization case against China for that country's alleged lax stance toward software piracy. What's that have to do with IT security? Plenty, as the recent Downadup outbreak, as well as a number of new Trojans to hit the Mac OS X platform, highlight.
OS X Trojan Resurfaces In Photoshop CS4
Commentary  |  1/26/2009  | 
I guess too many people got wind of the iWork 09 Trial Trojan application that was circulating in some peer-to-peer networks. The bad guys have changed their strategy: they're now targeting people downloading pirated versions of Adobe Photoshop.
Get Your Pentesting Permission Slip
Commentary  |  1/26/2009  | 
As infosec professionals, we are often tasked with performing duties that would be considered illegal if we did not receive proper authorization beforehand. For example, if you were performing a penetration test against a system that you or your employer doesn't own, or for which you don't have authorization to access, then you could be violating a number of laws leading to termination and possible criminal prosecution.
Monster.Com Loses Millions MORE Job Seekers' Records
Commentary  |  1/26/2009  | 
Monster.com has been hacked again, with possibly millions of customer records -- including names, phone numbers, e-mails, passwords and more -- stolen from its obviously poorly protected database. The company's handling of the news of the breach (the third in less than two years!) is as sloppy as its security.
Netgear ProSecure Brand Launches With New Security Appliances
Commentary  |  1/26/2009  | 
Netgear -- well known for its networking products -- is moving into the SMB security arena with its new ProSecure brand and a new line of Security Threat Management (STM) Web and Email Threat Management Appliances.
Spread Of Downadup Worm, New Apple Mac Trojan
Commentary  |  1/25/2009  | 
Security firm Symantec notes that the Downadup worm has swept through China, Argentina, Taiwan, Brazil, India, Chile, and Russia. The infection doesn't even register in the United States. Why?
Journalism School 'Ricochets' Spam Messages
Commentary  |  1/23/2009  | 
If you get a message this weekend from RJICONTACTS as part of the Missouri School of Journalism, don't reply. It's the result of a mail server snafu.
Downadup Worm Infects 1 In 16 Of World's PCs, Adding A Million A Day
Commentary  |  1/23/2009  | 
The rapid (to say the least) spread of the Downadup (also known as Confickr) worm is getting worse fast, with security companies noting that one in every sixteen of the world's PCs is infected. And that number may be very conservative.
Cloud Storage Matures
Commentary  |  1/23/2009  | 
The cloud is becoming tangible and definable. Customers are beginning to store data on it and companies like Bycast, Cleversafe, Amazon and Nirvanix have real customers paying real money to use their products or services. Companies like EMC and HP are bringing legitimacy to the co
The Trouble With Phishing
Commentary  |  1/22/2009  | 
Any person who is familiar with even the basics of modern computer threats will know the term phishing. It is an example of the more generic threat known as social engineering, or using psychology as a primary attack vehicle. In general, people tend to be trusting and helpful (although, of course, we can all quickly bring to mind those who are neither). Phishing and other social engineering attacks make use of these traits to trick computer users into giving up valuable information, fr
Obama Administration Outlines Plan To Secure IT Infrastructure
Commentary  |  1/22/2009  | 
Barren of details, it's really not a plan -- yet. But the administration did publish a number of goals aimed at better protecting the nation's critical IT networks.
Honing Security Skills Outside Of The Workplace
Commentary  |  1/22/2009  | 
Here at the Sundance Film Festival, I've noticed varying levels of credentialed people. Some work for Sundance directly; others are volunteers. Some are folks who dropped down a couple thousand dollars for a ticket package that includes an extra level of access the public doesn't have. And, of course, we can't forget the cast and crew of the films. In the four years I've been attending, you can count me as part of the rest of the bunc
Obama Cyber Security Agenda: The Opening Moves
Commentary  |  1/22/2009  | 
The broad outlines of President Obama's cyber security strategy are posted on the White House website, and offer both a glimpse of priorities and the chance to ask a few questions.
Apple Patches QuickTime Flaws
Commentary  |  1/21/2009  | 
Apple on Wednesday released QuickTime 7.6, a new version of its multimedia software that improves quality, compatibility, and security.
The Danger Of IT At Capacity
Commentary  |  1/21/2009  | 
As the IT budget has every ounce of excess rung out of it and storage optimization technologies promise to delay future purchases by delivering maximum utilization, for the first time storage administrators are living at much higher utilization rates. While this looks good, it has a dangerous underbelly.
How Hackers Will Crack Your Password
Commentary  |  1/21/2009  | 
I've been cracking passwords lately for pen tests, and I'm surprised at how corporate guidelines don't really help people choose passwords. As in many places in security, a disconnect exists between how people secure systems and how hackers break systems. So the following is a brief description of what hackers do (or, at least, what I do when pen-testing systems).
Heartland Payment Systems' Big Breach & Lame PR Tactic
Commentary  |  1/21/2009  | 
A recent breach at Princeton, N.J.-based payment processor Heartland Payment Systems, by some accounts, may have totaled tens of millions of individual credit and debit card transactions. And what does the company do? It pulls a cheap PR tactic by announcing the breach on inauguration day.
Record Breach! Heartland Leak May Affect Millions Of Credit Records
Commentary  |  1/20/2009  | 
Credit card processor Heartland Payment Systems admitted today that a 2008 malware-caused breach may have compromised millions -- maybe tens of millions -- of credit card records, including card holder names and card numbers. Early reports are that the breach was caused by a keystroke logger inside Heartland's network.
U.S. To Sharpen Cyber-Weaponry
Commentary  |  1/20/2009  | 
Last month, the Center for Strategic & International Studies (CSIS) Commission on Cybersecurity for the 44th Presidency warned that the United States is losing the battle to protect cyberspace. This is an arms race we can't afford to lose.
Question The Internet
Commentary  |  1/20/2009  | 
While many people have embraced Timothy Leary's advice to question authority, too few demonstrate willingness to question the Internet.
Largest Data Breach In History Tries To Hide Behind Inauguration
Commentary  |  1/20/2009  | 
Heartland Payment Systems, a credit card processor out of Princeton, N.J., that mostly supports small and midsize businesses, announced during today's presidential inauguration that it was the victim of a massive data breach that could include more than 100 million credit card numbers.
Virtualization Driving SMB Storage
Commentary  |  1/20/2009  | 
As server virtualization begins to work its way down the data center food chain, it is making small to medium-sized enterprises (SME) change their plans for storage selection. Shared storage is almost an agreed-to requirement to get the full potential out of a virtualization investment, but how can an SME find the right product and not vaporize its budget?
Ask Not What Cybersecurity Can Do For You, Ask What You Can Do For Cybersecurity
Commentary  |  1/19/2009  | 
Whether or not cybersecurity is mentioned directly in the inaugural address, there is little doubt that questions of national information security have been on President-elect Obama's mind. Question is, will he make personal cybersecurity a national issue as well?
Botnets: A Look Ahead
Commentary  |  1/19/2009  | 
While the infamous Storm botnet ran its course, and at least one hoster that was accused of hosting a good number of botnet command and control servers was shut down, don't expect spam or the botnet threat to disappear anytime soon.
Downadup Worm Growth Explodes
Commentary  |  1/17/2009  | 
Finnish security firm F-Secure calculates more than 6 million newly infected systems with the Downadup worm in the past few days. This makes Downadup one of the most virulent infections we have witnessed in quite some time.
5 Ways To Stretch Your 2009 Security Budget
Commentary  |  1/17/2009  | 
The economy stinks, and as usual, IT is under more pressure than ever to do more with less. While budgets shrink, the complexity of keeping your data safe grows. With some creativity, you can do more with what you have, or in some cases, add necessary new capabilities on the cheap. Here are some of my ideas on where to start.
Worm Warning: New Would-be Botnet Growing Explosively
Commentary  |  1/16/2009  | 
A new botnet. and a big one, could be in the early stages of existence, with more than 3.5 million PCs, by some estimates, already enrolled as a result of a fast-spreading worm. As many as a third of the world's Windows machines may be vulnerable.
If It Walks Like A Botnet
Commentary  |  1/16/2009  | 
There's something fishy going on with the Confickr/Downadup worm. So far, it hasn't crossed the line to an official botnet, but this thing is fast becoming a monster that just won't stop spreading, no matter what Microsoft does to warn users to patch (the patch has been available since October, people) or how security vendors scramble to scan for it as it evolves and changes.
The Downadup Worm Hits 3.5 Million
Commentary  |  1/15/2009  | 
Security firm F-Secure says that the Downadup worm has spread to more than 3.5 million computers by exploiting a vulnerability Microsoft patched last October.
Disaster Recovery Audits: Free Webinar Addresses What's Missing
Commentary  |  1/15/2009  | 
Disaster recovery specialist Continuity Software is hosting a free webinar today to address gaps in typical DR audits. The biggest gap for many small and midsize businesses, of course, is a DR audit, or plan itself.
Paris Hilton's Site Hacked: Expect Much More of This Throughout 2009
Commentary  |  1/14/2009  | 
More than 15,000 Web sites have been infected with the same Trojan that has been by detected at Paris Hilton's Web site, ParisHilton.com. This certainly won't be the last time this happens this year.
Geek Productivity Tough To Measure
Commentary  |  1/14/2009  | 
Measuring productivity is difficult when it comes to IT security professionals and, in general, most IT geeks. It's not as bad as trying to measure the return on investment (ROI) for security products, but it can be difficult if you focus on the number of hours worked as opposed to employee output.
Popup Phishing: Online Banking In-Session Phish Need No E-Mail Hook
Commentary  |  1/14/2009  | 
A new research report shows a new phishing vector -- one that can take place inside supposedly secure banking and other protected session, using a pop-up window rather an e-mail to fool their victims. According to researchers, every browser is vulnerable to the exploit. It's called in-session phishing, and it has the potential to be very troublesome.
Futility Of Microsoft's Exploitability Index
Commentary  |  1/13/2009  | 
As far as Microsoft patch Tuesdays are concerned, 2009 treads in like a lamb, with the software maker issuing only one security bulletin in its MS09-001 January patch rollout. Yet, even as MS09-001 is rated as "critical" for popular versions of its operating system -- the company's Exploitability Index hails: "Functioning exploit code unlikely." What's with the mixed signals?
Out Of Space? Thin Provisioning Vs. Traditional Provisioning
Commentary  |  1/13/2009  | 
There has been a lot written about thin provisioning and how it can optimize capacity and increase efficiency of the storage administrator. The constant response is that thin provisioning is "risky" compared with traditional hard-provisioned volumes. Is it really?
New Year, New Fears (And Even More Of The Same Old Ones)
Commentary  |  1/13/2009  | 
A just-released Commtouch Threat Trend Report puts the spotlight on user-generated content as one of the hottest arenas for malware and phishing attacks. In other words, the bad guys have met their allies and they are us.
The List Developers Need To Know
Commentary  |  1/12/2009  | 
There seems an almost endless number of mistakes that can be made to make applications susceptible to attack. Fortunately, the list of programming mistakes that really matter in today's risk environment is relatively small. Here's that list.
Page 1 / 2   >   >>


Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Be a unicorn, not a donkey...
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.