Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Researchers: RSA Adopted Second Tool That Might Have Helped NSA Surveillance
Newest First  |  Oldest First  |  Threaded View
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
4/1/2014 | 3:33:36 PM
Re: Trust but don't verify
Whether you are RSA or a major retailer (Target), this type of "bad press" will make CIOs or CISOs think long and hard about deploying apps or in this case extensions that can reflect badly on your organization. Before pushing out an app like this, much security testing should have been performed and it may have been but apparently it was not enough. Target apparently was warned about the potentially vulnerable POS devices but refused to act appropriately. I think maybe they are second guessing that decision now.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
4/1/2014 | 3:11:53 PM
Re: Trust but don't verify
In Italy we say that two clues are a test. The situation is really embarrassing, a real disaster for the American cyber security industry.
The distrust of the U.S. government and major companies who collaborate with it could have serious repercussions on a global scale in the coming months.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:10:24 AM
Trust but don't verify
I'm a forgiving gal, so I want to give RSA the benefit of the doubt... but I don't know if I can. I hope that they've taken some lesson from this, and that they'll start getting the technologists more involved in the business decisions that contributed to this debacle. I also hope that the engineers have incorporated some new process to check for this kind of nonsense in the future.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/10/2020
Zscaler to Buy Cloudneeti
Dark Reading Staff 4/9/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Yes, I do have virus protection on my system, now what?
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11669
PUBLISHED: 2020-04-10
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
CVE-2020-1801
PUBLISHED: 2020-04-10
There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro vers...
CVE-2020-3952
PUBLISHED: 2020-04-10
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVE-2020-4362
PUBLISHED: 2020-04-10
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
CVE-2020-1802
PUBLISHED: 2020-04-10
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product version...