Commentary

Content posted in October 2011
Basic Baselining For Quick Situational Awareness
Commentary  |  10/28/2011  | 
Baselines can be extremely valuable in knowing what's going on within your network, but they can't help if they're not created -- start with the basics
UBS Finds Risk Management Stress Test Costly
Commentary  |  10/25/2011  | 
UBS failed to stop a single rogue trader from racking up $2 billion in losses. Yet, some experts argue that banks overall may be better than others at managing risk.
Sinkholing For Profit
Commentary  |  10/24/2011  | 
Concerns over the legality and ethics of security organizations that profit from their sinkhole operations
Does Cybercrime Pay?
Commentary  |  10/21/2011  | 
Turning a profit in today's underground economy remains tough. Here's why.
Authentication Reality Check
Commentary  |  10/18/2011  | 
Two-factor authentication products slow to catch on
On Trusting Certificate Authorities
Commentary  |  10/18/2011  | 
The time has come for a way to vet CAs by reputation
Authentication With Hardware
Commentary  |  10/18/2011  | 
Needed: a unified way for users to log in websites regardless of the device they are using
FFIEC Goes Beyond Traditional Authentication
Commentary  |  10/18/2011  | 
The FFIEC recommends that organizations provide additional business and fraud detection controls to offset weaknesses in authentication technology
Pro Pen Testing: The Zero-Knowledge Approach
Commentary  |  10/14/2011  | 
Special care must be taken in a penetration test that locates targets with 'zero-knowledge'
McAfee + NitroSecurity: SIEM Merger Done Right
Commentary  |  10/12/2011  | 
McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world
Advanced Threats And Scenario-Based Penetration Testing
Commentary  |  10/12/2011  | 
Why your pen-test efforts probably aren't preparing you for the worst
DerbyCon Fosters Community -- Videos Available Online
Commentary  |  10/7/2011  | 
DerbyCon's successful first year reminds us of what the security community is all about: sharing and learning from others, promoting new ideas, and advancing the art of security
Steve Jobs And Tech Security
Commentary  |  10/6/2011  | 
Apple's products continue to highlight what relatively secure operating system environments look like.
Most Consumers Don't Lock Mobile Phone Via PIN
Commentary  |  10/4/2011  | 
44% of respondents say its's too much of a hassle, new survey reports.


'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12697
PUBLISHED: 2018-06-23
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
CVE-2018-12698
PUBLISHED: 2018-06-23
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
CVE-2018-12699
PUBLISHED: 2018-06-23
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
CVE-2018-12700
PUBLISHED: 2018-06-23
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
CVE-2018-11560
PUBLISHED: 2018-06-23
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.