Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content tagged with Vulnerabilities / Threats
Page 1 / 2   >   >>
Illegal Booter Connected with DDoSes Sentenced to Prison, Fine
Quick Hits  |  11/15/2019  | 
The Illinois-based man operated a criminal service that launched millions of DDoS attacks and brought in hundreds of thousands of dollars.
Attackers' Costs Increasing as Businesses Focus on Security
News  |  11/15/2019  | 
Based on penetration tests and vulnerability assessments, attackers' costs to compromise a company's network increases significantly when security is continuously tested, a report finds.
DevSecOps: The Answer to the Cloud Security Skills Gap
Commentary  |  11/15/2019  | 
There's a skills and resources gap industrywide, but a DevSecOps approach can go a long way toward closing that gap.
Symantec, McAfee Patch Privilege Escalation Bugs
News  |  11/14/2019  | 
All versions of endpoint protection software from both vendors were susceptible to near identical issue, SafeBreach says.
BSIMM10 Shows Industry Vertical Maturity
Commentary  |  11/14/2019  | 
The Building Security In Maturity Model is the only detailed measuring stick for software security initiatives, and it continues to evolve.
Capture the Flag Planned to Find Missing Persons Information
Quick Hits  |  11/14/2019  | 
The competition, launched by SANS and Trace Labs, will put to use open source information in search of new clues.
Attacks on Healthcare Jump 60% in 2019 - So Far
News  |  11/14/2019  | 
Well-known Trojans Emotet and Trickbot are cybercriminals' favorite weapons in their campaigns.
5 Cybersecurity CISO Priorities for the Future
Commentary  |  11/14/2019  | 
Seven chief information security officers share their pain points and two-year spending plans.
US-CERT Warns of Remotely Exploitable Bugs in Medical Devices
Quick Hits  |  11/14/2019  | 
Vulnerabilities in key surgical equipment could be remotely exploited by a low-skill attacker.
How Does Your Cyber Resilience Measure Up?
Commentary  |  11/14/2019  | 
The security measures companies take today may not be enough for tomorrow's cyber assault, but switching to a proactive, risk-based framework may better protect your organization.
Self-Cleaning Payment Card-Skimmer Infects E-Commerce Sites
News  |  11/13/2019  | 
'Pipka' JavaScript skimmer has infected at least 16 e-commerce websites so far, according to Visa's Payment Fraud Disruption Group.
Cybersecurity: An Organizationwide Responsibility
Commentary  |  11/13/2019  | 
C-suite execs must set an example of good practices while also supporting the IT department with enough budget to protect the organization from next-generation cyberattacks.
The Ripple Effect of Data Breaches: How Damage Spreads
News  |  11/13/2019  | 
The financial loss from so-called 'ripple events' is thirteen times greater than the cost of single-party security incidents.
Breaches Are Inevitable, So Embrace the Chaos
Commentary  |  11/13/2019  | 
Avoid sinking security with principles of shipbuilding known since the 15th century.
Unreasonable Security Best Practices vs. Good Risk Management
Commentary  |  11/13/2019  | 
Perfection is impossible, and pretending otherwise just makes things worse. Instead, make risk-based decisions.
Microsoft Patches IE Zero-Day Among 74 Vulnerabilities
News  |  11/12/2019  | 
The November Patch Tuesday update fixed 13 critical flaws, including a zero-day bug in Internet Explorer.
The Myths of Multifactor Authentication
Commentary  |  11/12/2019  | 
Organizations without MFA are wide open to attack when employees fall for phishing scams or share passwords. What's holding them back?
Researchers Disclose New Vulnerabilities in Windows Drivers
News  |  11/12/2019  | 
Attackers could take advantage of simple design flaws in widely distributed drivers to gain control over Windows systems.
SHAKEN/STIR: Finally! A Solution to Caller ID Spoofing?
Commentary  |  11/12/2019  | 
The ubiquitous Caller ID hasn't changed much over the years, but the technology to exploit it has exploded. That may be about to change.
DDoS Attack Targets UK Labour Party Weeks Ahead of Election
Quick Hits  |  11/12/2019  | 
Cybercriminals tried to take the Labour Party's digital platforms offline weeks before the election on December 12.
Why Cyber-Risk Is a C-Suite Issue
Commentary  |  11/12/2019  | 
Organizations realize the scale of cyber-risk but lack counter-actions to build resilience.
Researchers Find New Approach to Attacking Cloud Infrastructure
News  |  11/11/2019  | 
Cloud APIs' accessibility over the Internet opens a new window for adversaries to gain highly privileged access to cloud assets.
Joker's Stash Puts $130M Price Tag on Credit Card Database
Quick Hits  |  11/11/2019  | 
A new analysis advises security teams on what they should know about the underground payment card seller.
5 Security Processes You Shouldn't Overlook During M&A
Commentary  |  11/11/2019  | 
Security needs to be a central element of due diligence if a merger or acquisition is to succeed
Bugcrowd Pays Out Over $500K in Bounties in One Week
News  |  11/8/2019  | 
In all, bug hunters from around the world submitted over 6,500 vulnerabilities in October alone.
Hospital Cyberattacks Linked to Increase in Heart Attack Mortality
Quick Hits  |  11/8/2019  | 
Breach remediation processes adversely impact timeliness in patient care and outcomes, a new study finds.
Ring Flaw Underscores Impact of IoT Vulnerabilities
News  |  11/8/2019  | 
A vulnerability in Amazon's Ring doorbell cameras would have allowed a local attacker to gain access to a target's entire wireless network.
9 Principles to Simplify Security
Commentary  |  11/8/2019  | 
This isn't a one-size-fits-all situation. Simplify as much as you can, as the saying goes, but no more than that.
TA542 Brings Back Emotet with Late September Spike
News  |  11/7/2019  | 
Overall volumes of banking Trojans and RATs increased during the third quarter, when Emotet was suspiciously absent until mid-September.
To Prove Cybersecurity's Worth, Create a Cyber Balance Sheet
Commentary  |  11/7/2019  | 
How tying and measuring security investments to business impacts can elevate executives' understanding and commitment to cyber-risk reduction.
PayPal Upsets Microsoft as Phishers' Favorite Brand
Quick Hits  |  11/7/2019  | 
Several factors edged the world's most popular payment service into the top spot.
The Cold Truth about Cyber Insurance
Commentary  |  11/7/2019  | 
There is no premium that will recover the millions of dollars your company spends on R&D if your intellectual property is hacked and stolen.
Black Hat Q&A: Hacking a '90s Sports Car
News  |  11/7/2019  | 
Security researcher Stanislas Lejay offers a preview of his upcoming Black Hat Europe talk on automotive engine computer management and hardware reverse engineering.
Accounting Scams Continue to Bilk Businesses
News  |  11/6/2019  | 
Yes, ransomware is plaguing businesses and government organizations, but impersonators inserting themselves into financial workflows most often via e-mail continue to enable big paydays.
Google Announces App Defense Alliance
Quick Hits  |  11/6/2019  | 
The industry partnership will scan apps for malware before they're published on the Google Play Store.
Social Media: Corporate Cyber Espionage's Channel of Choice
Commentary  |  11/6/2019  | 
Proactive defense and automation can help your company deal with scale and prioritize risks in order to more efficiently fight cyber espionage.
California DMV Leak Spills Data from Thousands of Drivers
Quick Hits  |  11/6/2019  | 
Federal agencies reportedly had improper access to Social Security data belonging to 3,200 license holders.
The Uphill Battle of Triaging Alerts
Commentary  |  11/6/2019  | 
Prioritizing alerts is foundational to security, but almost every organization struggles to manage this process efficiently. Here's what you can do about it.
Siemens PLC Feature Can Be Exploited for Evil - and for Good
News  |  11/5/2019  | 
A hidden feature in some newer models of the vendor's programmable logic controllers leaves the devices open to attack. Siemens says it plans to fix it.
The State of Email Security and Protection
Commentary  |  11/5/2019  | 
Phishing and ransomware top the list of security risks that organizations are not fully prepared to deal with.
Enterprise Web Security: Risky Business
Commentary  |  11/5/2019  | 
Web development is at much more risk than commonly perceived. As attackers eye the enterprise, third-party code provides an easy way in.
Microsoft Security Setting Ironically Increases Risks for Office for Mac Users
News  |  11/4/2019  | 
Excel's handling of an old macro format gives unauthenticated remote attackers a way to take control of vulnerable systems, Carnegie Mellon's CERT/CC says.
First Bluekeep Exploit Found in the Wild
Quick Hits  |  11/4/2019  | 
Crashing honeypots alerted the researcher who found the Bluekeep vulnerability.
To Secure Multicloud Environments, First Acknowledge You Have a Problem
Commentary  |  11/4/2019  | 
Multicloud environments change rapidly. Organizations need a security framework that is purpose-built for the cloud and that aligns with their digital transformation strategy.
Details of Attack on Electric Utility Emerge
Quick Hits  |  11/1/2019  | 
The March 5 DDoS attack interrupted communications between generating facilities and the electrical grid in three western states.
Google Patches Chrome Zero-Day Under Active Attack
Quick Hits  |  11/1/2019  | 
The fix addresses CVE-2019-13720, a high-severity, use-after-free vulnerability discovered by Kaspersky Lab researchers.
32,000+ WiFi Routers Potentially Exposed to New Gafgyt Variant
News  |  10/31/2019  | 
Researchers detect an updated Gafgyt variant that targets flaws in small office and home wireless routers from Zyxel, Huawei, and Realtek.
Slow Retreat from Python 2 Threatens Code Security
News  |  10/31/2019  | 
The end of life is near for Python 2, and there will be no rising from the grave this time. So why are some companies and developers risking a lack of security patches to stay with the old version of the programming language?
Coalfire CEO Wants Criminal Charges Against His Employees Dropped
Quick Hits  |  10/31/2019  | 
Felony charges against two employees tasked with testing the physical security of the Dallas County, Iowa, courthouse have been lessened, but that's not enough, CEO says.
Quantifying Security Results to Justify Costs
Commentary  |  10/31/2019  | 
The CISO job isn't to protect the entire business from all threats for any budget. It's to spell out what level of protection executives can expect for a given budget.
Page 1 / 2   >   >>


Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.