Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
IoT Bug Grants Access to Home Video Surveillance
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/8/2019 | 7:04:31 PM
Re: more of the same
@RyanSepe: I have heard from highly regulated entities that they have experiences with cloud vendors with 360-degree auditing -- i.e., that in addition to auditing the vendor, the vendor audits the customer to ensure that they are doing what they need to do to be secure while using their platform. A great example of teamwork -- and it would be a great way to prevent the kind of brand damage AWS has suffered from this kind of thing.

Of course, one of AWS's biggest selling points is its accessibility for even the smallest of businesses/entities -- so that's pretty impractical (at least, at the personalized level) for AWS for its smaller clients.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/2/2019 | 2:52:32 PM
Re: more of the same
Agree 100%. I think its a tragic principle of a lack of education. By that I mean, Amazon does a great job to ensure that they configure their product to be a secure iteration by default. (Not overly stringent, but gets the job done) Unfortunately, it is then handed off to a NON-Amazon entity (corporate IT entity) who may not be overly familiar with how the S3 bucket is set up. By default this will restrict them from performing the function they need to support the business, so what will they do? They will remove the safeguards to allow them to do said function. In the process, removing any secure configuration they may have had. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/31/2018 | 10:46:46 PM
more of the same
Geezalou, another freakin' gross misconfiguration of S3-bucket access. This has been a huge trend over the past couple of years (despite the fact that the default settings tend to be more secure) -- to the point that AWS has had to change their UI a little.

I expect the trend to continue. Stupidity doesn't just end.


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3493
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
CVE-2021-3492
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
CVE-2020-2509
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later Q...
CVE-2020-36195
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
CVE-2021-29445
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...