Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Now

Latest Content
<<   <   Page 3 / 25   >   >>
Trend Micro Scopes Out 2019 So Far
Larry Loeb  |  9/3/2019  | 
Fileless attacks and exploit kits make a comeback.
Cisco Maxes Out Its CVE Severity
Larry Loeb  |  8/30/2019  | 
Cisco had to take itself to the virtual woodshed this week after issuing a security advisory about its IOS XE operating system.
AV Vendor & French Gendarmerie Take Down a Transnational Worm
Larry Loeb  |  8/29/2019  | 
The good guys got lucky this time.
Enterprise Firms Are Simplifying & Securing Networks With a More Flexible Network Edge
Dan Reis  |  8/27/2019  | 
Distributed enterprises are on a digital transformation journey. As a result, enterprises are turning to secure SD-WAN to deploy a robust networking ecosystem that accelerates their digital transformation.
NSA to Share Added Security for Firmware Functions
Larry Loeb  |  8/26/2019  | 
Most people think of the National Security Agency as the home of operational intelligence gathering. But many people are unaware of the research that it has done and released to the public.
Nuclear Plant Security Compromised by Financially Motivated Insiders
Larry Loeb  |  8/23/2019  | 
Equipment at a nuclear power plant in Ukraine was used to mine cryptocurrency.
Newly Registered Domains Mean New Problems – Palo Alto
Larry Loeb  |  8/23/2019  | 
Why NRDs should matter to the security community.
Fintech Startups Get Sloppy With Application Security
Larry Loeb  |  8/20/2019  | 
Some startups need to shape up or ship out.
New Industry Drives Renewed Interest in Embedded Security
Larry Loeb  |  8/20/2019  | 
Hardware for security may just get hot.
CTF Protocol Serves as a Low-Level Way to Take Over Windows Machines
Larry Loeb  |  8/16/2019  | 
There is a protocol in Windows that has been around since the days of Windows XP, which has been found to be insecure.
Security Assurance Is a Long-Term & Ongoing Investment
Steve Durbin  |  8/14/2019  | 
Establishing a business-focused security assurance program is a long-term, ongoing investment.
A Brace Helps to Balance the Load
Larry Loeb  |  8/13/2019  | 
A syntax construct inside the TCL language is allowing injection attacks to occur.
This RAT Doesn't Squeak Much
Larry Loeb  |  8/13/2019  | 
Saefko does stuff. Lots of stuff.
European Approach to Artificial Intelligence: Ethics Is Key
Oliver Schonschek  |  8/13/2019  | 
The socio-economic, legal and ethical impacts of AI must be carefully addressed, says the European Commission.
State Farm Insurance Notifies Users About a Breach but Doesn't Panic
Larry Loeb  |  8/9/2019  | 
State Farm Insurance has filed a notice of data breach that involved customer accounts, seemingly to meet California regulations.
MSFT Walks Back Original Action, Admits RDP Vulnerability Affects Hyper-V
Larry Loeb  |  8/9/2019  | 
Check Point Research's Eyal Itkin told the world in February of this year that there were multiple critical vulnerabilities in the widely used RDP protocol.
Wipro Says That Target on the Enterprise's Back Just Got Bigger
Larry Loeb  |  8/7/2019  | 
Wipro has presented the third edition of their 'State of Cybersecurity Report,' looking at trends and behaviors that have occurred over the last year.
Has Your Employee Been Compromised by Sextortion?
Larry Loeb  |  8/5/2019  | 
Sextortion is one particular kind of extortion that is defined by the Cambridge dictionary as "The practice of forcing someone to do something by threatening to publish sexual information about them."
Bulletproof Proxy Providers Try to Hide Botnet IP Address Needles in Haystacks
Larry Loeb  |  8/2/2019  | 
Cequence Security's CQ Prime research team thinks it has spotted a new trend it calls 'bulletproof proxies.'
Who Is Phoning Home on Your Firm's Dime?
Larry Loeb  |  8/1/2019  | 
ExtraHop customers in 2018 and the first weeks of 2019 took a look at some third-party supplied enterprise software's behavior and were not pleased when it would, unannounced, call home for its creators.
Capital One Had to Be Told by Outsider That Data Breach Occurred
Larry Loeb  |  7/30/2019  | 
Capital One got hacked and didn't even know it.
Kubernetes Won't Get Secure Just Sitting There
Larry Loeb  |  7/30/2019  | 
Let's delve into containers.
Not Using DMARC Security Protocol Leaves Businesses Vulnerable to Spoofing
Larry Loeb  |  7/29/2019  | 
A global survey found that most business and government domains don't use DMARC, which opens them up to email spoofing.
IT Modernization: Needed & Not Easy
Larry Loeb  |  7/26/2019  | 
'Challenges with architecture modernization' ranks high on IT survey respondents' list of grievances.
Sanctioned Russian Spies Can Own Your Android Device
Larry Loeb  |  7/25/2019  | 
It's professional-grade naughtiness, people.
Comodo Leaves AV Vulnerabilities Unpatched
Larry Loeb  |  7/25/2019  | 
Even though Comodo was notified by Tenable in April of the problems, no patches by have been forthcoming from the antivirus firm.
Palo Alto Networks Does Not Fully Address Vulnerability in GlobalProtect SSL VPN Solution
Larry Loeb  |  7/24/2019  | 
If Palo Alto Networks wants to keep the trust of its customers in the future, it will have to do much better in how it relates to them.
Skylight Says Cylance Can Be Bypassed; Cylance Says, 'Not So Fast, There!'
Larry Loeb  |  7/23/2019  | 
Skylight's findings certainly gained attention, but at what cost to the company's credibility?
Bluetooth Devices Leaking Tracking Data
Larry Loeb  |  7/19/2019  | 
Researchers from Boston University found that the current version of Bluetooth Low Energy, as implemented by Apple iOS and Windows 10, leaked identifiers that allowed tracking of the device that was using BLE.
Malvertising Adds Sophistication to Disruption
Larry Loeb  |  7/17/2019  | 
French security researcher Malekal delved into a murky world.
New BitPaymer Ransomware Discovered Hunting Big Game
Larry Loeb  |  7/16/2019  | 
New variant shares most of its code with the BitPaymer ransomware operated by INDRIK SPIDER.
Data Protection in the Cloud Is Still a Big Issue in the EU
Oliver Schonschek  |  7/16/2019  | 
Building trust is key to the success of the European cloud market.
DNS Hijacking on the Rise as Warning Is Issued
Larry Loeb  |  7/15/2019  | 
The National Cyber Security Centre, a part of the UK's GCHQ, has issued an advisory that deals with Domain Name System (DNS) hijacking by threat actors.
Older Versions of Windows at Risk From New Zero-Day Exploit
Larry Loeb  |  7/12/2019  | 
Cybersecurity firm ESET discovered a Windows zero-day exploit that affects older systems like Windows 7 and Server 2008.
Demand for Certain B2B Security Software Accelerates
Larry Loeb  |  7/11/2019  | 
B2B security software is growing faster than overall B2B software sales, according to new figures.
7 Steps to Attain a Zero Trust Security Posture
Chris Curcio  |  7/10/2019  | 
A Zero Trust security posture begins with strong identity and access management.
Manipulated Machine Learning Sows Confusion
Steve Durbin  |  7/10/2019  | 
Machine learning, and neural networks in particular, will become a prime target for those aiming to manipulate or disrupt dependent products and services.
Research Shows Top Banks Failing in Security, Privacy & Compliance
Larry Loeb  |  7/10/2019  | 
Apart from that, it's all going swimmingly.
An Attack Using Only System Tools Is Not Invisible – You Just Have to Look Harder
Larry Loeb  |  7/9/2019  | 
Microsoft's team behind Windows Defender ATP has identified a new 'fileless' malware campaign that can bypass standard antivirus tools.
Security in a Cloud-Hybrid World
Dan Reis  |  7/9/2019  | 
When an application and its data processing and storage can easily shift between geographic locations, organizations need to implement security systems to ensure they don't unknowingly violate a regulatory framework regardless of geography. \r\n
TA505 Invades the Middle East
Larry Loeb  |  7/8/2019  | 
The campaign, detected by Trend Micro, has been identified as coming from threat actor TA505.
Cryptominer Delivers New Kind of Malware
Larry Loeb  |  7/5/2019  | 
Malicious actors seem to be beginning to turn to Golang as a malware language since it is not typically picked up by antivirus software.
Survey Finds Enterprise Concerned About Mass Data Fragmentation
Larry Loeb  |  7/5/2019  | 
For many organizations, the public cloud has failed to live up to expectations.
Phishing Campaign Evades Analysis by Hiding URL in QR Code
Larry Loeb  |  7/2/2019  | 
Phishing attacks are never really dead.
Identity Can't Recognize Itself
Larry Loeb  |  7/2/2019  | 
Identity management needs to be 'frictionless' if it is going to gain users.
MSFT Realizes That Some Things Need to Be Changed
Larry Loeb  |  6/28/2019  | 
There are lots of directions in which various people think the field of 'identity' is heading. While some of these directions get accepted over a time period (like Zero Trust), someone always gets stuck with having to make the tools that enable a direction's implementation to occur.
Wipro Breach Actually a Whole Campaign
Larry Loeb  |  6/27/2019  | 
India's third-largest IT outsourcing company, Wipro, was been breached and boarded, and getting to the bottom of the mess wasn't easy.
Zero Trust Doesn't Trust You at All
Larry Loeb  |  6/27/2019  | 
Enterprise security practitioners who deal with identity day in and day out come together to find out the current status of the field.
Best Defense: 5 Key Trends in Application Security
Ameya Talwalkar  |  6/26/2019  | 
What application security must address to stay ahead of the attackers.
Developers Find Temporary Fix for OpenSSH Remote Access Software Vulnerability
Larry Loeb  |  6/26/2019  | 
The latest update from the OpenSSH developers encrypts private keys before storing them into the system memory, which will protect the keys against almost all types of side-channel attacks.
<<   <   Page 3 / 25   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28968
PUBLISHED: 2021-10-22
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
CVE-2020-28969
PUBLISHED: 2021-10-22
Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.
CVE-2020-36485
PUBLISHED: 2021-10-22
Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file.
CVE-2020-36486
PUBLISHED: 2021-10-22
Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.
CVE-2020-36488
PUBLISHED: 2021-10-22
An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands.