Commentary

Content posted in November 2005
Security's Sisyphean Situation
Commentary  |  11/23/2005  | 
Did you hear that? It's the sound of your network and applications being attacked. Hear that? It just happened again. What's worse, the nature of these attacks is changing. Gone are the good old days of simply having your Web site defaced, your e-mail corrupted by indiscriminant worms, and your networks flooded by brute-force denial-of-service attacks. Sure, you'll see plenty of those in 2006, but what you should really be worried about are the attacks you can't see. Where did it all go wrong? L
Lock 'Em Up!
Commentary  |  11/18/2005  | 
It's only through this kind of successful enforcement effort that there's even a chance of stemming the tide. Kudos--and many thanks--to the federal, state, local, and international law-enforcement personnel involved.
Today's Reminder: The Greatest Threats To Your Data May Be On Your Payroll
Commentary  |  11/15/2005  | 
The steady stream of customer data breaches that have plagued financial services firms, consumer data clearing houses, and universities this year have put IT departments on alert to the vulnerability of sensitive information. Yet the bulk of reactions have centered on fortifying companies against hackers and other unwelcome intruders. Too many companies have ignored what is perhaps the greatest threat to data secu
EFF Releases List Of Spyware-Infected Sony CDs
Commentary  |  11/9/2005  | 
The Electronic Frontier Foundation has released a partial list of what it claims are the CDs that sony has infected with its copy-protection software. The titles include CDs by Celine Dion, Neil Diamond, Dion, and Ricky Martin. The EFF article also has tips on how you can tell if a CD you bought from Sony contains the copy protection.
Conspiracy Theory: Michael Lynn Negotiates Corner Office, Reserved Parking Space With Juniper
Commentary  |  11/7/2005  | 
Anyone predicting that Michael Lynn did severe damage to his career might want to retract those statements now that the former ISS researcher and current Cisco nemesis has landed at Juniper Networks. Although it's unclear what Lynn's role is or how long he's been with Cisco's biggest rival, I'm sure that conspiracy theorists will have a field day with this one. Lynn, you'll remember if you weren't on Mars this summer, has become infamo
Sony Is Just As Bad As Music Pirates
Commentary  |  11/7/2005  | 
Sony's latest response to the threat of music piracy is to engage in behavior every bit as bad as the pirates it's trying to protect itself from.
Hacking Back: Cyber Counterterrorism
Commentary  |  11/4/2005  | 
The recent arrest and 17-count indictment against 20-year-old accused hacker and botmaster Jeanson James Ancheta for both using and selling the tools to attack a number of networks, including some within the Defense Department, should be taken as a shot across the bow by anyone who reads this. Ancheta is accused of being part of a new breed of criminal hacker: not just in it for the fame--sure, he's getting his 15 minutes, although it could be more like 50 years--but rather after money. Accordin


5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Cloud Security's Changing Landscape
[Strategic Security Report] Cloud Security's Changing Landscape
Cloud services are increasingly becoming the platform for mission-critical apps and data. Heres how enterprises are adapting their security strategies!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.