Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Content by Kelly22

Kelly22
Member Since: November 15, 2013
Author
Blog Posts: 855
Posts: 5

Most Recently Posted

All (100)           Blogs (99)           Comments (1)          
All
Building Security Strategies in Sub-Saharan Africa: Trends and Concerns
News  |  7/2/2020  | 
Security experts discuss the rise in cybercrime affecting sub-Saharan Africa and the necessary changes to improve security.
Businesses Invest in Cloud Security Tools Despite Concerns
News  |  7/1/2020  | 
A majority of organizations say the acceleration was driven by a need to support more remote employees.
Ripple20 Threatens Increasingly Connected Medical Devices
News  |  6/30/2020  | 
A series of IoT vulnerabilities could put hospital networks, medical data, and patient safety at risk.
Russian Cybercriminal Behind CardPlanet Sentenced to 9 Years
News  |  6/29/2020  | 
Aleksei Burkov will go to federal prison for operating two websites built to facilitate payment card fraud, hacking, and other crimes.
Cloud Security Alliance Offers Tips to Protect Telehealth Data
News  |  6/19/2020  | 
As telehealth grows more common, security experts address the privacy and security concerns of storing health data in the cloud.
Healthcare CISOs Share COVID-19 Response Stories
News  |  6/18/2020  | 
Cybersecurity leaders discussed the threats and challenges that arose during the pandemic, and how they responded, during a virtual roundtable.
7 Tips for Employers Navigating Remote Recruitment
Slideshows  |  6/17/2020  | 
Hiring experts explain how companies should approach recruitment when employers and candidates are working remotely.
'Ripple20' Bugs Plague Enterprise, Industrial & Medical IoT Devices
News  |  6/16/2020  | 
Researchers discover 19 vulnerabilities in a TCP/IP software library manufacturers have used in connected devices for 20 years.
Cisco Brings SecureX into Full Security Lineup to Cut Complexity
News  |  6/16/2020  | 
This step is intended to address growing enterprise concerns around security and complexity, both top of mind among CISOs and CIOs.
Ryuk Continues to Dominate Ransomware Response Cases
News  |  6/15/2020  | 
Analysis reveals how Ryuk's operators are changing their techniques and using new means to break in.
ICS Threat Snake Ransomware Suspected in Honda Attack
News  |  6/11/2020  | 
An attack targeting the automaker reportedly infected internal servers and led to the suspension of production at plants around the world.
Misconfigured Databases Targeted Hours After Deployment
News  |  6/10/2020  | 
Researchers left a poorly configured database open on the Internet to learn who would connect to it and what they would steal.
Microsoft Fixes 129 Bugs in Largest Patch Tuesday Release
News  |  6/9/2020  | 
The June release of security updates addresses several remote code execution vulnerabilities in SharePoint, Excel, Windows OLE, and other services.
Chinese and Iranian APT Groups Targeted US Presidential Campaigns
News  |  6/8/2020  | 
Google analysts report advanced persistent threat groups linked to China and Iran launched phishing attacks against the Biden and Trump campaigns.
New 'Tycoon' Ransomware Strain Targets Windows, Linux
News  |  6/4/2020  | 
Researchers say Tycoon ransomware, which has targeted software and educational institutions, has a few traits they haven't seen before.
Chasing RobbinHood: Up Close with an Evolving Threat
News  |  6/3/2020  | 
A security researcher details how RobbinHood has changed and why it remains a threat for businesses to watch.
Apple Pays Researcher $100,000 for Critical Vulnerability
News  |  6/1/2020  | 
Apple has fixed a flaw in the "Sign in with Apple" feature that could have enabled attackers to break into user accounts for third-party services.
GitHub Supply Chain Attack Uses Octopus Scanner Malware
News  |  5/28/2020  | 
Octopus Scanner is a new malware used to compromise 26 open source projects in a massive GitHub supply chain attack.
Microsoft Shares PonyFinal Threat Data, Warns of Delivery Tactics
News  |  5/27/2020  | 
PonyFinal is deployed in human-operated ransomware attacks, in which adversaries tailor their techniques based on knowledge of a target system.
StrandHogg 2.0 Emerges as 'Evil Twin' to Android Threat
News  |  5/26/2020  | 
The vulnerability, which exists in almost every version of Android, is both more dangerous and harder to detect than its predecessor.
10 iOS Security Tips to Lock Down Your iPhone
Slideshows  |  5/22/2020  | 
Mobile security experts share their go-to advice for protecting iPhones from hackers, thieves, and fraudsters.
60% of Insider Threats Involve Employees Planning to Leave
News  |  5/20/2020  | 
Researchers shows most "flight-risk" employees planning to leave an organization tend to start stealing data two to eight weeks before they go.
Web Application Attacks Double from 2019: Verizon DBIR
News  |  5/19/2020  | 
Verizon's annual data breach report shows most attackers are external, money remains their top motivator, and web applications and unsecured cloud storage are hot targets.
As DevOps Accelerates, Security's Role Changes
News  |  5/18/2020  | 
There remains a disconnect between developers and security teams, with uncertainty around who should handle software security.
As Businesses Rush to the Cloud, Security Teams Struggle to Keep Up
News  |  5/14/2020  | 
Most organizations have a gap between current and planned cloud usage and the maturity of their cloud security programs.
New Cyber-Espionage Framework Dubbed Ramsay
News  |  5/13/2020  | 
The framework is designed to collect and exfiltrate sensitive documents from air-gapped networks.
Microsoft Fixes 111 Vulnerabilities for Patch Tuesday
News  |  5/12/2020  | 
This marks the third month in a row that Microsoft patched more than 100 bugs, of which 16 are classified as critical.
Thunderbolt Vulnerabilities Could Threaten Millions of PCs
News  |  5/11/2020  | 
Attackers with physical access to targeted machines could exploit these flaws to access and copy data within minutes, researchers say.
Microsoft Identity VP Shares How and Why to Ditch Passwords
News  |  5/7/2020  | 
Passwords are on their way out, says Joy Chik, who offers guidance for businesses hoping to shift away from them.
Maze Ransomware Operators Step Up Their Game
News  |  5/6/2020  | 
Investigations show Maze ransomware operators leave "nothing to chance" when putting pressure on victims to pay.
Microsoft Challenges Security Researchers to Hack Azure Sphere
News  |  5/5/2020  | 
Participants can earn up to $100,000 for finding severe flaws in Microsoft's Linux-based Azure Sphere IoT operating system.
SMB Security Catches Up to Large Companies, Data Shows
News  |  5/4/2020  | 
Small and midsize businesses face issues similar to those of large organizations and have updated security practices to respond with threat hunting, patch management, and dedicated personnel.
7 Tips for Security Pros Patching in a Pandemic
Slideshows  |  5/4/2020  | 
The shift to remote work has worsened patch management challenges and created new ones. Security pros share insights and best practices.
Microsoft's Records Management Tool Aims to Simplify Data Governance
News  |  4/30/2020  | 
Records Management is intended to help businesses manage security and data governance as more struggle to handle increased amounts of data and regulatory requirements.
86% of Companies Report Network Disruption Amid Remote Work Shift
News  |  4/29/2020  | 
Nearly two-thirds say disruptions were at least moderate in severity, and more have seen VPN connectivity issues as employees work from home.
New Startup Accurics Tackles Cloud Infrastructure Security
News  |  4/28/2020  | 
Accurics offers a free product to prevent "drift" between infrastructure defined through code and infrastructure running in the cloud.
Why Consumers, SMBs Are Likely to Fall for Coronavirus Scams
News  |  4/23/2020  | 
Data reveals both a lack of skepticism and a willingness to engage with emails crafted to seem like government communications.
IBM Cloud Data Shield Brings Confidential Computing to Public Cloud
News  |  4/22/2020  | 
The Cloud Data Shield relies on confidential computing, which protects data while it's in use by enterprise applications.
Researchers Use Microsoft Terminal Services Client in New Attack Method
News  |  4/21/2020  | 
The technique would enable attackers to run malicious code via Remote Desktop Protocol using DLL side-loading to bypass security controls.
Stimulus Payments Are Popular Leverage for Cyberattacks
News  |  4/20/2020  | 
More than 4,300 domains related to stimulus and relief packages, many of them malicious, have been registered since January.
10 Standout Security M&A Deals from Q1 2020
Slideshows  |  4/17/2020  | 
The first quarter of 2020 brought investments in enterprise IoT and endpoint security, as well as billion-dollar investments from private equity firms.
Neglected Infrastructure, Invasive Tech to Plague Infosec in 2022
News  |  4/16/2020  | 
Researchers outline cybersecurity threats they predict businesses will face in two years as technology evolves.
Slack's Incoming Webhooks Can Be Weaponized in Phishing Attacks
News  |  4/15/2020  | 
Researchers report how attackers could weaponize a feature in the Slack collaboration platform to access corporate data and messages.
Microsoft Patches 113 Bugs, 3 Under Active Attack
News  |  4/14/2020  | 
Microsoft has seen a 44% jump in the number of CVEs fixed between January and April 2020 compared with the same period in 2019.
Comment: Re: - Kelly22 - 4/14/2020
Dell Releases Security Tool to Defend PCs from BIOS Attacks
News  |  4/13/2020  | 
The SafeBIOS Events & Indicators of Attack tool gives admins visibility into BIOS configuration changes and alerts them to potential threats.
Zoom, Microsoft & NTT Data Leaders Share Work-from-Home Security Tips
Quick Hits  |  4/9/2020  | 
Tech leaders encourage organizations to maintain security awareness training and offer advice on how to protect their information.
Researchers Fool Biometric Scanners with 3D-Printed Fingerprints
News  |  4/8/2020  | 
Tests on the fingerprint scanners of Apple, Microsoft, and Samsung devices reveal it's possible to bypass authentication with a cheap 3D printer.
Cybercriminals Hide Malware & Phishing Sites Under SSL Certificates
News  |  4/7/2020  | 
More than half of the top 1 million websites use HTTPS, researchers report, but not all encrypted traffic is safe.
9 Security Podcasts Worth Tuning In To
Slideshows  |  4/7/2020  | 
Recommendations for podcasts discussing news, trends, guidance, and stories across the cybersecurity industry.
Microsoft: Emotet Attack Shut Down an Entire Business Network
News  |  4/6/2020  | 
The infection started with a phishing email and spread throughout the organization, overheating all machines and flooding its Internet connection.
Researcher Hijacks iOS, macOS Camera with Three Safari Zero-Days
News  |  4/3/2020  | 
A security researcher earned $75,000 for finding a whopping seven zero-days in Safari, three of which can be combined to access the camera.
A Day in The Life of a Pen Tester
News  |  4/2/2020  | 
Two penetration testers share their day-to-day responsibilities, challenges they encounter, and the skills they value most on the job.
Defense Evasion Dominated 2019 Attack Tactics
News  |  3/31/2020  | 
Researchers mapped tactics and techniques to the MITRE ATT&CK framework to determine which were most popular last year.
Does the 2020 Online Census Account for Security Risk?
News  |  3/31/2020  | 
Experts discuss the security issues surrounding a census conducted online and explain how COVID-19 could exacerbate the risk.
Missing Patches, Misconfiguration Top Technical Breach Causes
News  |  3/25/2020  | 
Less than half of businesses surveyed can patch critical vulnerabilities within 72 hours. Why does the process take so long?
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
News  |  3/24/2020  | 
Researchers warn Microsoft 365 account holders to pay attention to unknown applications that request permissions.
Microsoft Publishes Advisory for Windows Zero-Day
News  |  3/23/2020  | 
There is no available patch for the vulnerabilities, which Microsoft says exist in all supported versions of Windows.
8 Infosec Page-Turners for Days Spent Indoors
Slideshows  |  3/23/2020  | 
Stuck inside and looking for a new read? Check out these titles written by security practitioners and reporters across the industry.
200M Records of US Citizens Leaked in Unprotected Database
News  |  3/20/2020  | 
Researchers have not determined who owns the database, which was one of several large exposed instances disclosed this week.
Process Injection Tops Attacker Techniques for 2019
News  |  3/18/2020  | 
Attackers commonly use remote administration and network management tools for lateral movement, a new pool of threat data shows.
Privacy in a Pandemic: What You Can (and Can't) Ask Employees
News  |  3/16/2020  | 
Businesses struggle to strike a balance between workplace health and employees' privacy rights in the midst of a global health emergency.
DDoS Attack Trends Reveal Stronger Shift to IoT, Mobile
News  |  3/13/2020  | 
Attackers are capitalizing on the rise of misconfigured Internet-connected devices running the WS-Discovery protocol, and mobile carriers are hosting distributed denial-of-service weapons.
New Android Malware Strain Sneaks Cookies from Facebook
News  |  3/12/2020  | 
Two malware modifications, when combined, can snatch cookies collected by browsers and social networking apps.
COVID-19 Drives Rush to Remote Work. Is Your Security Team Ready?
News  |  3/11/2020  | 
A rapid transition to remote work puts pressure on security teams to understand and address a wave of potential security risks.
How Microsoft Disabled Legacy Authentication Across the Company
News  |  3/9/2020  | 
The process was not smooth or straightforward, employees say in a discussion of challenges and lessons learned during the multi-year project.
7 Cloud Attack Techniques You Should Worry About
Slideshows  |  3/6/2020  | 
Security pros detail the common and concerning ways attackers target enterprise cloud environments.
Gotta Patch 'Em All? Not Necessarily, Experts Say
News  |  3/3/2020  | 
When it's impossible to remediate all vulnerabilities in an organization, data can indicate which bugs should be prioritized.
How Security Leaders at Starbucks and Microsoft Prepare for Breaches
News  |  3/2/2020  | 
Executives discuss the security incidents they're most worried about and the steps they take to prepare for them.
Educating Educators: Microsoft's Tips for Security Awareness Training
News  |  2/28/2020  | 
Microsoft's director of security education and awareness shares his approach to helping train employees in defensive practices.
US State Dept. Shares Insider Tips to Fight Insider Threats
News  |  2/26/2020  | 
The insider threat is a technology, security, and personnel issue, officials said in explaining an approach that addresses all three factors.
Emotet Resurfaces to Drive 145% of Threats in Q4 2019
News  |  2/26/2020  | 
Analysis of 92 billion rejected emails reveals a range of simple and complex attack techniques for the last quarter of 2019.
Security, Networking Collaboration Cuts Breach Cost
News  |  2/24/2020  | 
CISOs report increases in alert fatigue and the number of records breached, as well as the struggle to secure mobile devices in a new Cisco study.
Enterprise Cloud Use Continues to Outpace Security
News  |  2/24/2020  | 
Nearly 60% of IT and security pros say deployment of business services in the cloud has rushed past their ability to secure them.
7 Tips to Improve Your Employees' Mobile Security
Slideshows  |  2/24/2020  | 
Security experts discuss the threats putting mobile devices at risk and how businesses can better defend against them.
All About SASE: What It Is, Why It's Here, How to Use It
News  |  2/22/2020  | 
Secure Access Service Edge is a new name for a known and growing architecture designed to strengthen security in cloud environments.
Microsoft Announces General Availability of Threat Protection, Insider Risk Management
News  |  2/20/2020  | 
Microsoft made several security announcements ahead of RSA Conference, including its decision to bring Microsoft Defender to iOS and Android.
Users Have Risky Security Habits, but Security Pros Aren't Much Better
News  |  2/19/2020  | 
Researchers spot gaps in users' and IT practitioners' security habits, and between security tools and user preferences.
44% of Security Threats Start in the Cloud
Quick Hits  |  2/19/2020  | 
Amazon Web Services is a top source of cyberattacks, responsible for 94% of all Web attacks originating in the public cloud.
DDoS Attacks Nearly Double Between Q4 2018 and Q4 2019
News  |  2/13/2020  | 
Peer-to-peer botnets, TCP reflection attacks, and increased activity on Sundays are three DDoS attack trends from last quarter.
FBI: Business Email Compromise Cost Businesses $1.7B in 2019
News  |  2/12/2020  | 
BEC attacks comprised nearly half of cybercrime losses last year, which totaled $3.5 billion overall as Internet-enabled crimes ramped up.
Microsoft Patches Exploited Internet Explorer Flaw
News  |  2/11/2020  | 
This month's Patch Tuesday brings fixes for 99 CVEs, including one IE flaw seen exploited in the wild.
Cybercriminals Swap Phishing for Credential Abuse, Vuln Exploits
News  |  2/11/2020  | 
Infection vectors were evenly divided among phishing, vulnerability exploitation, and unauthorized credential use in 2019.
How North Korea's Senior Leaders Harness the Internet
News  |  2/10/2020  | 
Researchers learn how North Korea is expanding its Internet use in order to generate revenue and bypass international sanctions.
RobbinHood Kills Security Processes Before Dropping Ransomware
News  |  2/7/2020  | 
Attackers deploy a legitimate, digitally signed hardware driver to delete security software from machines before encrypting files.
90% of CISOs Would Cut Pay for Better Work-Life Balance
News  |  2/6/2020  | 
Businesses receive $30,000 of 'free' CISO time as security leaders report job-related stress taking a toll on their health and relationships.
IoT Malware Campaign Infects Global Manufacturing Sites
News  |  2/5/2020  | 
The infection uses Lemon_Duck PowerShell malware variant to exploit vulnerabilities in embedded devices at manufacturing sites.
SharePoint Bug Proves Popular Weapon for Nation-State Attacks
News  |  2/4/2020  | 
Thousands of servers could be exposed to SharePoint vulnerability CVE-2019-0604, recently used in cyberattacks against Middle East government targets.
Researchers Find 24 'Dangerous' Android Apps with 382M Installs
News  |  2/3/2020  | 
Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.
What It's Like to Be a CISO: Check Point Security Leader Weighs In
News  |  1/31/2020  | 
Jony Fischbein shares the concerns and practices that are top-of-mind in his daily work leading security at Check Point Software.
Two Vulnerabilities Found in Microsoft Azure Infrastructure
News  |  1/30/2020  | 
Researchers detail the process of finding two flaws in the Azure Stack architecture and Azure App Service, both of which have been patched.
Inside the Check Point Research Team's Investigation Process
News  |  1/29/2020  | 
The team sheds light on how their organization works and what they're watching in the threat landscape.
'Understand What You Believe': Fmr. FBI Agent Unpacks Information Threats
News  |  1/28/2020  | 
In the past few years, social media has transformed from a communications gold mine to a minefield of disinformation campaigns.
New Zoom Bug Prompts Security Fix, Platform Changes
News  |  1/28/2020  | 
A newly discovered Zoom vulnerability would have enabled an attacker to join active meetings and access audio, video, and documents shared.
Severe Vulnerabilities Discovered in GE Medical Devices
News  |  1/23/2020  | 
CISA has released an advisory for six high-severity CVEs for GE Carescape patient monitors, Apex Pro, and Clinical Information Center systems.
For Mismanaged SOCs, The Price Is Not Right
News  |  1/22/2020  | 
New research finds security operations centers suffer high turnover and yield mediocre results for the investment they require.
New Ransomware Tactic Shows How Windows EFS Can Aid Attackers
News  |  1/21/2020  | 
Researchers have discovered how ransomware can take advantage of the Windows Encrypting File System, prompting security vendors to release patches.
7 Tips for Infosec Pros Considering a Lateral Career Move
Slideshows  |  1/21/2020  | 
Looking to switch things up but not sure how to do it? Security experts share their advice for switching career paths in the industry.
Mobile Banking Malware Up 50% in First Half of 2019
News  |  1/17/2020  | 
A new report from Check Point recaps the cybercrime trends, statistics, and vulnerabilities that defined the security landscape in 2019.
Google Lets iPhone Users Turn Device into Security Key
News  |  1/15/2020  | 
The iPhone can now be used in lieu of a physical security key as a means of protecting Google accounts.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.