Commentary

Content posted in November 2006
E-Tailers Leaving Money On The Table Thanks To Weak Web Sites
Commentary  |  11/30/2006  | 
One week after I'd already bought three holiday presents online I learned that the vast majority of Web sites are vulnerable to attack by malicious hackers and that such security concerns are expected to drive away potential customers who would have shelled out nearly $2 billion online this year. The only real surprise is why those numbers aren't higher.
What Do You Have To Give Them If You Want To Use The Bathroom?
Commentary  |  11/30/2006  | 
An International House of Pancakes (IHOP) restaurant reversed its policy of requiring customers to surrender their driver's licenses before being served, after customers complained about the privacy and identity theft risks. One customer complained: "You want my license? I'm going for pancakes, I'm not buying the Hope diamond." The restaurant was trying to limit "dine-a
The Ripple Effects Of E-Discovery
Commentary  |  11/29/2006  | 
When I last tread this space, it was to alert readers who weren't already aware, of the Dec. 1rst launch of new federal rules regarding electronic discovery. By the way, there's no new law. The new requirements are just an extension of existing rules, which you can find here.
To Improve Holiday Safety, I'll Start A House Fire Every Day In December Using A Different Christmas Decoration
Commentary  |  11/22/2006  | 
The gimmick of churning out software security flaws on a daily basis for some set period has gotten ridiculous. First the Month of Browser Bugs, then the Month of Kernel Bugs, now the research firm firm Argeniss plans the Week of Oracle Database Bugs. Security researchers play an irreplaceable watchdog role. But it's time to retire this publicity stunt.
Making A List And Checking It Twice
Commentary  |  11/21/2006  | 
Thanksgiving on the doorstep means December is just around the corner, bringing with it expressions of cheery good will to all buttressed by those endless, frantic holiday to-do lists. This year, though, before turning out the lights to hit the company party, IT is going to have to check off one more item, and it's a doozy.
Secure U.K. Passport Cracked
Commentary  |  11/17/2006  | 
Two British security experts were able to read encrypted data off a supposedly highly secure U.K. RFID-equipped passport using equipment priced under £250, according to the Guardian..

But is that an impressive hack? The UK government thinks not:

Technology Makes Fraud Trivially Easy
Commentary  |  11/14/2006  | 
Identity theft expert Frank Abagnale describes how technology has made fraud trivially easy:

Abagnale was subject of the 2002 Steven Spielberg movie Catch Me If You Can, starring Leonardo DiCaprio, which depicted his exploits as a teenager in the 60s, posing as an airline pilot to live the glamorous life of a jet-setter around the world, until he was caught.

Best Practices In Smartphone Security
Commentary  |  11/3/2006  | 
Many of you are thinking about giving your employees access to business applications on smartphones. Yet over 60% of you feel your company's smartphones are somewhat secure and that your policies and safeguards need improvement. Security risks will always exist, but there are steps you can take to mitigate them. I thought I'd help by outlining best practices for smartphone security in a list, court
The Surveillance Society: It's Closing In!
Commentary  |  11/2/2006  | 
Sorry 4 typos but I know they're watching--always suspected it but just got confirmation from Reuters news story saying US and UK r as oppressive as China and Russia in terms of spying on citizens--I hear footsteps and know they're coming for me cause I'm speaking out!!


Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.