Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Author

 George V. Hulme

Profile of George V. Hulme

News & Commentary Posts: 529
An award winning writer and journalist, for more than 20 years George Hulme has written about business, technology, and IT security topics. He currently freelances for a wide range of publications, and is security blogger at InformationWeek.com.
Articles by George V. Hulme
posted in August 2008

BNY Mellon Data Breach Potentially Massive

8/29/2008
It was in May when we noted an investigation launched by the authorities in the state of Connecticut into a backup tape lost by the Bank of New York Mellon. The results of that investigation are in, and they don't look good.

Post a Comment

Web Application Hacks: Upping The Arms Race

8/27/2008
It doesn't seem that long ago since Web applications attacks supplanted network and worm attacks. But they have, and now the attackers are finding ways to obfuscate these attacks. It's an ever-evolving arms race. And we have an updated Top 10 Web site vulnerabilities list.

Post a Comment

Best Western Hotel Chain Pwned

8/24/2008
According to news reports that started to surface over the weekend, Best Western, one of the world's largest hotel chains -- if not the largest -- is investigating a breach that purportedly has placed millions of its guests' data at-risk, and in the hands of Russian mobsters.

Post a Comment

FEMA Phones Get Hacked

8/21/2008
If you are going to hack a phone system, do you really want to hack DHS? That's what happened this weekend when someone made hundreds of illegal calls from a Federal Emergency Management Agency (FEMA) Private Branch Exchange (PBX) to the Middle East and Asia. It appears that it was the usual culprits of poor change control and misconfigurations that left FEMA's digital doors open.

Post a Comment

Sneak Peek: New PCI DSS Rules

8/20/2008
Updates to the Payment Card Industry Data Security Standard (PCI DSS) have been released by the PCI Security Standards Council. The updates, hopefully, will bring some clarity to a number of areas which retailers, merchants, and auditors say are foggy.

Post a Comment

Microsoft Snags Another Security Researcher

8/18/2008
There was a time when it seemed Microsoft viewed security researchers as the enemy, and a big public relations problem. They were the troublemakers who poked holes in Microsoft's operating systems, browser, and desktop software. And they published exploits that helped to automate attacks. Today, Microsoft announced that it hired one of them.

Post a Comment

MBTA: Legally Shackling Security Researchers Rarely Works

8/14/2008
As many security and technology followers know, three MIT students had planned on presenting their findings on a number of vulnerabilities they found in the Massachusetts Bay Transportation Authority's CharlieTicket and CharlieCard payment cards at last week's Defcon conference. That was, until a gag order was put in place to keep them quiet. Today, a federal judge in Boston let the temporary restraining order stand. And so this Saga of Stupidity continues.

Post a Comment

Securing Virtualization, Or Is That Virtualizing Security?

8/12/2008
One of the big topics at last week's Black Hat and Defcon security confabs was virtualization security, but few speakers talked about what is really important: how we approach virtualizing security, and how virtualization itself changes the way we approach information security. All of that changed when I was trampled over by The Four Horsemen Of the Virtualization Security Apocalypse.

Post a Comment

Defcon/Black Hat: Social Network Security = Fail!

8/11/2008
Social networks such as LinkedIn, MySpace, Facebook, and microblogging sites such as Twitter are all fertile grounds for both social engineering and technical attacks. It can get even nastier when you combine the two. Too bad we haven't learned anything about secure coding practices and proper authentication in the past 20 years or so.

Post a Comment

Defcon 16 Kicks Off In Controversy

8/10/2008
Would you expect the 16th annual hackfest to begin any other way? Whether it's the arrest of security researchers, or the outted undercover TV producer of years gone by, Black Hat's sister security and hacking conference, Defcon, always causes a stir. This year, it was the press conference that wasn't to be.

Post a Comment

Black Hat Disputes Charles Edge Talk Even Submitted

8/7/2008
Last week we covered two incidents surrounding Apple's (non) participation at this year's Black Hat conference. Apparently, the first was a potential talk pulled for consideration because Apple just doesn't like its engineers explaining anything about how they handle software security. The other, Black Hat contends, was never even submitted.

Post a Comment

Black Hat 2008, First Day Sessions

8/5/2008
I've been in Las Vegas for a couple of days now, meeting with some old friends in the information security community, and making a few new ones. This year, the annual Black Hat confab will be serving interesting talks on the security implications of virtualization, social networks, and Web 2.0. Should make a good conference that will highlight some of the big security concerns going forward.

Post a Comment

Hacking Nukes

8/4/2008
It's rare that I read something in a press release that I agree with, let alone find frightening, but this release from Lumeta scared the heebe geebees out of me.

Post a Comment

FileVault Is Flawed; And Apple's Not Talk'n

8/1/2008
A security researcher hoping to discuss an undisclosed Apple flaw at next week's annual Black Hat conference in Las Vegas pulls his talk. Then, Apple suddenly jumps ship on a planned security panel to be conducted by its engineers. These incidents expose Apple's being a laggard in its approach to IT security.

Post a Comment
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13757
PUBLISHED: 2020-06-01
Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing exces...
CVE-2020-13758
PUBLISHED: 2020-06-01
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVE-2020-9291
PUBLISHED: 2020-06-01
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVE-2019-15709
PUBLISHED: 2020-06-01
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.
CVE-2020-13695
PUBLISHED: 2020-06-01
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.