Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

News & Commentary
Artist Uses Malware in Installation
Dark Reading Staff, Quick Hits
A piece of 'art' currently up for auction features six separate types of malware running on a vulnerable computer.
By Dark Reading Staff , 5/17/2019
Comment3 comments  |  Read  |  Post a Comment
DevOps Repository Firms Establish Shared Analysis Capability
Robert Lemos, Contributing WriterNews
Following an attack on their users, and their shared response, Atlassian, GitHub, and GitLab decide to make the sharing of attack information a permanent facet of their operations.
By Robert Lemos Contributing Writer, 5/17/2019
Comment0 comments  |  Read  |  Post a Comment
When Older Windows Systems Won't Die
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft's decision to patch unsupported machines for the critical CVE-2019-0708 flaw is a reminder that XP, 2003, and other older versions of Windows still run in some enterprises.
By Kelly Sheridan Staff Editor, Dark Reading, 5/17/2019
Comment2 comments  |  Read  |  Post a Comment
A Trustworthy Digital Foundation Is Essential to Digital Government
Gus Hunt, Managing Director and Cyber Strategy Lead for Accenture Federal ServicesCommentary
Agencies must take steps to ensure that citizens trust in the security of government's digital channels.
By Gus Hunt Managing Director and Cyber Strategy Lead for Accenture Federal Services, 5/17/2019
Comment0 comments  |  Read  |  Post a Comment
US Charges Members of GozNym Cybercrime Gang
Jai Vijayan, Contributing WriterNews
The FBI and counterparts from other nations say group infected over 41,000 computers with malware that steals banking credentials.
By Jai Vijayan Contributing Writer, 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
The Data Problem in Security
Julian Waits, GM Cyber Security Business Unit, Devo TechnologyCommentary
CISOs must consider reputation, resiliency, and regulatory impact to establish their organization's guidelines around what data matters most.
By Julian Waits GM Cyber Security Business Unit, Devo Technology, 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
Cyber Workforce Exec Order: Right Question, Wrong Answer
Ryan Shaw, Co-Founder, BionicCommentary
Shuffling resources, adding administrative process, and creating a competition and incentive system will do little to grow and mature the talent we need to meet the cybersecurity challenges we face.
By Ryan Shaw Co-Founder, Bionic, 5/16/2019
Comment0 comments  |  Read  |  Post a Comment
GDPR Drives Changes, but Privacy by Design Proves Elusive
Jai Vijayan, Contributing WriterNews
One year later, the EU mandate's biggest impact has been to focus more attention on data protection and privacy, security analysts say.
By Jai Vijayan Contributing Writer, 5/15/2019
Comment0 comments  |  Read  |  Post a Comment
Two Ransomware Recovery Firms Typically Pay Hackers
Dark Reading Staff, Quick Hits
Companies promising the safe return of data sans ransom payment secretly pass Bitcoin to attackers and charge clients added fees.
By Dark Reading Staff , 5/15/2019
Comment0 comments  |  Read  |  Post a Comment
Website Attack Attempts Rose by 69% in 2018
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Millions of websites have been compromised, but the most likely malware isn't cyptomining: it's quietly stealing files and redirecting traffic, a new Sitelock report shows.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Commercial Spyware Uses WhatsApp Flaw to Infect Phones
Robert Lemos, Contributing WriterNews
A single flaw allowed attackers thought to be linked to a government to target human rights workers and install surveillance software by sending a phone request. The victims did not even have to answer.
By Robert Lemos Contributing Writer, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Uniqlo Parent Company Says Hack Compromised 461,091
Dark Reading Staff, Quick Hits
Fast Retailing Co. reports cyberattackers accessed accounts registered to its Japanese Uniqlo and GU brand websites.
By Dark Reading Staff , 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Tweet suggests possible screenshot of stolen city documents and credentials in the wake of attack that took down city servers last week.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 5/14/2019
Comment2 comments  |  Read  |  Post a Comment
Microsoft Patches Wormable Vuln in Windows 7, 2003, XP, Server 2008
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft releases security updates for some out-of-support systems to fix a bug that could be weaponized as a worm if exploited.
By Kelly Sheridan Staff Editor, Dark Reading, 5/14/2019
Comment0 comments  |  Read  |  Post a Comment
Korean APT Adds Rare Bluetooth Device-Harvester Tool
Jai Vijayan, Contributing WriterNews
ScarCruft has evolved into a skilled and resourceful threat group, new research shows.
By Jai Vijayan Contributing Writer, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Thrangrycat Claws Cisco Customer Security
Dark Reading Staff, Quick Hits
A linked pair of vulnerabilities could allow an attacker to take over many different types of Cisco networking components.
By Dark Reading Staff , 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
LockerGoga, MegaCortex Ransomware Share Unlikely Traits
Kelly Sheridan, Staff Editor, Dark ReadingNews
New form of ransomware MegaCortex shares commonalities with LockerGoga, enterprise malware recently seen in major cyberattacks.
By Kelly Sheridan Staff Editor, Dark Reading, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Attacks on JavaScript Services Leak Info From Websites
Robert Lemos, Contributing WriterNews
Three marketing tools, including the Best Of The Web security logomark, were compromised in supply chain attacks, allegedly leaving website customers leaking their users' sensitive information.
By Robert Lemos Contributing Writer, 5/13/2019
Comment0 comments  |  Read  |  Post a Comment
Demystifying the Dark Web: What You Need to Know
Kelly Sheridan, Staff Editor, Dark Reading
The Dark Web and Deep Web are not the same, neither is fully criminal, and more await in this guide to the Internet's mysterious corners.
By Kelly Sheridan Staff Editor, Dark Reading, 5/10/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft SharePoint Bug Exploited in the Wild
Dark Reading Staff, Quick Hits
A number of reports show CVE-2019-0604 is under active attack, Alien Labs researchers say.
By Dark Reading Staff , 5/10/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Artist Uses Malware in Installation
Dark Reading Staff 5/17/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12184
PUBLISHED: 2019-05-19
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...