Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

News & Commentary
John McAfee, Creator of McAfee Antivirus Software, Dead at 75
Dark Reading Staff, Quick Hits
McAfee, who was being held in a Spanish jail on US tax-evasion charges, had learned on Monday he would be extradited to the US.
By Dark Reading Staff , 6/24/2021
Comment0 comments  |  Read  |  Post a Comment
VMs Help Ransomware Attackers Evade Detection, but It's Uncommon
Kelly Sheridan, Staff Editor, Dark ReadingNews
Some ransomware attackers use virtual machines to bypass security detection, but adoption is slow for the complicated technique.
By Kelly Sheridan Staff Editor, Dark Reading, 6/23/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Tracks New BazaCall Malware Campaign
Dark Reading Staff, Quick Hits
Attackers use emails to prompt victims to call a fraudulent call center, where attackers instruct them to download a malicious file.
By Dark Reading Staff , 6/23/2021
Comment0 comments  |  Read  |  Post a Comment
New DNS Name Server Hijack Attack Exposes Businesses, Government Agencies
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researchers found a "novel" class of DNS vulnerabilities in AWS Route53 and other DNS-as-a-service offerings that leak sensitive information on corporate and government customers, with one simple registration step.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 6/23/2021
Comment0 comments  |  Read  |  Post a Comment
Survey Seeks to Learn How 2020 Changed Security
Dark Reading Staff, Quick Hits
Respondents to a new Dark Reading/Omdia survey will be entered into a drawing for a Black Hat Black Card.
By Dark Reading Staff , 6/23/2021
Comment0 comments  |  Read  |  Post a Comment
When Will Cybersecurity Operations Adopt the Peter Parker Principle?
Robert Boudreaux, Field CTO, Deep InstinctCommentary
Having a prevention mindset means setting our prevention capabilities to "prevent" instead of relying on detection and response.
By Robert Boudreaux Field CTO, Deep Instinct, 6/23/2021
Comment0 comments  |  Read  |  Post a Comment
Transmit Security Announces $543M Series A Funding Round
Dark Reading Staff, Quick Hits
The passwordless technology provider says the funding will be used to increase its reach and expand primary business functions.
By Dark Reading Staff , 6/22/2021
Comment0 comments  |  Read  |  Post a Comment
Identity Eclipses Malware Detection at RSAC Startup Competition
Paul Shomo, Cybersecurity AnalystCommentary
All 10 finalists in the Innovation Sandbox were focused on identity, rather than security's mainstay for the last 20 years: Malware detection.
By Paul Shomo Cybersecurity Analyst, 6/22/2021
Comment0 comments  |  Read  |  Post a Comment
Did Companies Fail to Disclose Being Affected by SolarWinds Breach?
Jai Vijayan, Contributing WriterNews
The SEC has sent out letters to some investment firms and publicly listed companies seeking information, Reuters says.
By Jai Vijayan Contributing Writer, 6/21/2021
Comment1 Comment  |  Read  |  Post a Comment
4 Habits of Highly Effective Security Operators
Ricardo Villadiego, Founder and CEO of LumuCommentary
These good habits can make all the difference in advancing careers for cybersecurity operators who spend their days putting out fires large and small.
By Ricardo Villadiego Founder and CEO of Lumu, 6/18/2021
Comment0 comments  |  Read  |  Post a Comment
Ransomware Operators' Strategies Evolve as Attacks Rise
Kelly Sheridan, Staff Editor, Dark ReadingNews
Security researchers find ransomware operators rely less on email and more on criminal groups for initial access into target networks.
By Kelly Sheridan Staff Editor, Dark Reading, 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
Biden Tells Putin Critical Infrastructure Sectors 'Off Limits' to Russian Hacking
Dark Reading Staff, Quick Hits
President Joe Biden said he and Russian President Vladimir Putin agreed to discuss boundaries in cyber activity.
By Dark Reading Staff , 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
Cars, Medicine, Electric Grids: Future Hackers Will Hit Much More Than Networks in an IT/OT Integrated World
Greg Valentine, Senior Cybersecurity Director, Capgemini North AmericaCommentary
Intelligent systems must include the right cybersecurity protections to prevent physical threats to operational technology.
By Greg Valentine Senior Cybersecurity Director, Capgemini North America, 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
What Industrial Control System Vulnerabilities Can Teach Us About Protecting the Supply Chain
Chen Fradkin, Security Researcher at ClarotyCommentary
Older technologies used in industrial and critical infrastructure leave the sector highly vulnerable to attack, but organizations can take steps to better protect themselves.
By Chen Fradkin Security Researcher at Claroty, 6/15/2021
Comment0 comments  |  Read  |  Post a Comment
Google Workspace Adds Client-Side Encryption
Dark Reading Staff, Quick Hits
Users given control over encryption keys, Google says.
By Dark Reading Staff , 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
Name That Toon: Sight Unseen
John Klossner, CartoonistCommentary
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
By John Klossner Cartoonist, 6/14/2021
Comment10 comments  |  Read  |  Post a Comment
Secure Access Trade-offs for DevSecOps Teams
Ev Kontsevoy, CEO of TeleportCommentary
Thanks to recent advancements in access technologies, everyone can apply identity-based authentication and authorization and zero-trust principles for their computing resources.
By Ev Kontsevoy CEO of Teleport, 6/11/2021
Comment0 comments  |  Read  |  Post a Comment
'Fancy Lazarus' Criminal Group Launches DDoS Extortion Campaign
Kelly Sheridan, Staff Editor, Dark ReadingNews
The group has re-emerged after a brief hiatus with a new email campaign threatening a DDoS attack against businesses that don't pay ransom.
By Kelly Sheridan Staff Editor, Dark Reading, 6/10/2021
Comment0 comments  |  Read  |  Post a Comment
RSA Spins Off Fraud & Risk Intelligence Unit
Kelly Sheridan, Staff Editor, Dark ReadingNews
The new company, called Outseer, will continue to focus on payment authentication and fraud detection and analysis.
By Kelly Sheridan Staff Editor, Dark Reading, 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Addresses Rise in Ransomware Threatening OT Assets
Dark Reading Staff, Quick Hits
The agency has released guidance in response to a rise of ransomware attacks affecting OT assets and control systems.
By Dark Reading Staff , 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18661
PUBLISHED: 2021-06-24
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
CVE-2020-21787
PUBLISHED: 2021-06-24
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
CVE-2020-21788
PUBLISHED: 2021-06-24
In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
CVE-2021-23398
PUBLISHED: 2021-06-24
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
CVE-2021-33348
PUBLISHED: 2021-06-24
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.