Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
OPM Breach Exposes Agency's Systemic Security Woes
Newest First  |  Oldest First  |  Threaded View
SolielM201
50%
50%
SolielM201,
User Rank: Apprentice
6/17/2015 | 10:47:44 AM
Cut Off
Here's a petition to disconnect select Chinese networks from the Internet, for your signing on the right side if you are in agreement (digitally sign by submitting).  I'm asking for you to let your friends and family of the millions of people affected by compromised data (from OPM, Anthem, Home Depot, Target Corporation...) know of this petition and sign if in agreement.  change.org/p/icann-internet-corporation-for-assigned-names-and-numbers-tell-the-worldwide-internet-maintainers-to-disconnect-select-networks-in-china-from-the-internet-internet-2-0
agusanfear
50%
50%
agusanfear,
User Rank: Apprentice
6/16/2015 | 6:59:51 PM
Re: Decades of neglect...
deploying anti-malware technology and restricting remote access for network administrators?

 

I mean how long does it take for the OPM to understand oblivious security protocols? Someone give OPM a cookie.
macker490
50%
50%
macker490,
User Rank: Ninja
6/15/2015 | 7:11:09 AM
much more serious than Snowden
this breach is MUCH MORE serious than the Edward Snowden affair.
bhanstiu
100%
0%
bhanstiu,
User Rank: Strategist
6/10/2015 | 10:38:34 AM
Decades of neglect...
That one line says everything relevant about the functioning of the US federal government. Very aged infrastructure crumbling, bridges falling apart, 1950's power distribution covering vast sections of the nation, etc. etc., ad nauseum.... but we have billions of dollars to give away, billions for bombs, etc. etc., ad nauseum.... Is anyone really surprised by this situation? We have collectively allowed the US federal government to shirk it's responsibilities in the name of chasing dragons and unicorns, and monitoring all of our communications regardless of relevence to the actual 'busting terrorists' excuses we get all day, every day, all year, decade after decade.

 

From the bad joke that is TSA security theater, to the unpatriot games the NSA is playing, we have been sold a bill of goods, and have not received what we paid for. On all levels.


Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.
CVE-2012-5340
PUBLISHED: 2020-01-23
SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file.