Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Chinese Hacking Charges a Wakeup Call for Both China & US Businesses
Newest First  |  Oldest First  |  Threaded View
ThreatTrack Security
50%
50%
ThreatTrack Security,
User Rank: Author
5/22/2014 | 2:01:19 PM
Wakeup Call
Don't forge about Huawei.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/22/2014 | 10:05:14 AM
Re: Stick in the Eye
I agree, this sounds like job security for the IT Security folks. Attempting to monitor activity of employees will result in needing more staff, thoughts?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/22/2014 | 9:48:33 AM
Re: Stick in the Eye
As we saw with Snowden, the human element is difficult to manage. Organizations just need to be more vigilant and do a better job monitoring user behavior and minimizing access to data they don't need.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/22/2014 | 9:22:17 AM
Re: Stick in the Eye
Good point, you want to hire the best person for the job regardless of where they are from but in today's climate you must consider the risks of employees leaking information even casually to friends and family.
ThomasL787
50%
50%
ThomasL787,
User Rank: Apprentice
5/21/2014 | 8:48:26 PM
Re: Stick in the Eye
It's all well and good to point fingers at various and sundry groups outside of the United States, but are they the only ones we have to worry about?  Every time a US company hires a foreign (H1B) worker, they are potentially exposing their intellectual property to the world. 

Even if the worker is trying to be trustworthy, they can inadvertantly expose crucial information to their friends "back home" in casual conversations. 

If they are malcious, they can do a fair amount of damage as we have seen with Mr. Snowden.  After all, if the company is harmed by the loss of some secret formula or algorithm, it's no problem for the worker because they will probably only be in the position for a year or two before they go back home.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/21/2014 | 9:57:51 AM
Re: Stick in the Eye
I think one of the key outcomes here is awareness....putting faces and names to the deeds humanizes the seemingly abstract and invisible activity. Oh--and the named defendants won't be doing much world travel now.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/21/2014 | 9:54:35 AM
Stick in the Eye
It can be satisfying to poke a stick in the eye of your opponent, and to get the reprehensible behavior of the NSA off the front page for a day or two, but those are the only effects these charges will have.


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32693
PUBLISHED: 2021-06-17
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the fir...
CVE-2021-32424
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.
CVE-2021-32426
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
CVE-2021-32694
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
CVE-2021-32695
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose t...