Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

News & Commentary
One in Five Manufacturing Firms Targeted by Cyberattacks
Robert Lemos, Contributing WriterNews
Information-stealing malware makes up about a third of attacks, a study finds, but companies worry most about ransomware shutting down production.
By Robert Lemos Contributing Writer, 6/17/2021
Comment0 comments  |  Read  |  Post a Comment
Google Launches SLSA, a New Framework for Supply Chain Integrity
Dark Reading Staff, Quick Hits
The "Supply chain Levels for Software Artifacts" aims to ensure the integrity of components throughout the software supply chain.
By Dark Reading Staff , 6/17/2021
Comment0 comments  |  Read  |  Post a Comment
Security Experts Scrutinize Apple, Amazon IoT Networks
Robert Lemos, Contributing WriterNews
Both companies have done their due diligence in creating connected-device networks, but the pervasiveness of the devices worries some security researchers.
By Robert Lemos Contributing Writer, 6/15/2021
Comment0 comments  |  Read  |  Post a Comment
Cyber Analytics Database Exposed 5 Billion Records Online
Dark Reading Staff, Quick Hits
In an ironic twist, Cognyte's data alerts customers to third-party data exposures.
By Dark Reading Staff , 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
Google Workspace Adds Client-Side Encryption
Dark Reading Staff, Quick Hits
Users given control over encryption keys, Google says.
By Dark Reading Staff , 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
New Top 20 Secure-Coding List Positions PLCs as Plant 'Bodyguards'
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Best practices guide encompasses integrity, hardening, resilience, and monitoring of PLCs in industrial networks.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
Name That Toon: Sight Unseen
John Klossner, CartoonistCommentary
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
By John Klossner Cartoonist, 6/14/2021
Comment9 comments  |  Read  |  Post a Comment
Many Mobile Apps Intentionally Using Insecure Connections for Sending Data
Jai Vijayan, Contributing WriterNews
A new analysis of iOS and Android apps released to Apple's and Google's app stores over the past five years found many to be deliberately breaking HTTPS protections.
By Jai Vijayan Contributing Writer, 6/11/2021
Comment0 comments  |  Read  |  Post a Comment
Deepfakes Are on the Rise, but Don't Panic Just Yet
John Donegan, Enterprise analyst at ManageEngineCommentary
Deepfakes will likely give way to deep suspicion, as users try to sort legitimate media from malicious.
By John Donegan Enterprise analyst at ManageEngine, 6/10/2021
Comment0 comments  |  Read  |  Post a Comment
New Security Event @Hack to Take Place in Saudi Arabia
Dark Reading Staff, Quick Hits
The Saudi Federation of Cybersecurity, Programming, and Drones (SAFCSP) and Informa Tech will launch a multi-day event in Riyadh this November.
By Dark Reading Staff , 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game DesignerCommentary
Arbitrarily powerful software -- applications, operating systems -- is a problem, as is preventing it from running on enterprise systems.
By Adam Shostack Consultant, Entrepreneur, Technologist, Game Designer, 6/9/2021
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Patches 6 Zero-Days Under Active Attack
Kelly Sheridan, Staff Editor, Dark ReadingNews
The June 2021 Patch Tuesday fixes 50 vulnerabilities, six of which are under attack and three of which were publicly known at the time of disclosure.
By Kelly Sheridan Staff Editor, Dark Reading, 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
Colonial Pipeline CEO: Ransomware Attack Started via Pilfered 'Legacy' VPN Account
Dark Reading Staff, Quick Hits
No multifactor authentication was attached to the stolen VPN password used by the attackers, Colonial Pipeline president & CEO Joseph Blount told a Senate committee today.
By Dark Reading Staff , 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
First Known Malware Surfaces Targeting Windows Containers
Jai Vijayan, Contributing WriterNews
Siloscape is designed to create a backdoor in Kubernetes clusters to run malicious containers.
By Jai Vijayan Contributing Writer, 6/7/2021
Comment0 comments  |  Read  |  Post a Comment
Cartoon Caption Winner: Road Trip
John Klossner, CartoonistCommentary
And the winner of Dark Reading's cartoon caption contest is ...
By John Klossner Cartoonist, 6/7/2021
Comment0 comments  |  Read  |  Post a Comment
Organizations Shift Further Left in App Development
Dark Reading Staff, Quick Hits
Most IT and security professionals surveyed think security is a critical enough reason to pause app development.
By Dark Reading Staff , 6/4/2021
Comment0 comments  |  Read  |  Post a Comment
Google Experts Explore Open Source Security Challenges & Fixes
Kelly Sheridan, Staff Editor, Dark ReadingNews
An open source security event brought discussions of supply chain security and managing flaws in open source projects.
By Kelly Sheridan Staff Editor, Dark Reading, 6/3/2021
Comment0 comments  |  Read  |  Post a Comment
Processor Morphs Its Architecture to Make Hacking Really Hard
Robert Lemos, Contributing WriterNews
Researchers create a processor that uses encryption to modify its memory architecture during runtime, making it very difficult for hackers to exploit memory-based vulnerabilities.
By Robert Lemos Contributing Writer, 6/2/2021
Comment0 comments  |  Read  |  Post a Comment
New Barebones Ransomware Strain Surfaces
Jai Vijayan, Contributing WriterNews
The authors of Epsilon Red have offloaded many tasks that are usually integrated into the ransomware -- such as Volume Shadow Copy deletion -- to PowerShell scripts.
By Jai Vijayan Contributing Writer, 6/1/2021
Comment0 comments  |  Read  |  Post a Comment
Plug-ins for Code Editors Pose Developer-Security Threat
Robert Lemos, Contributing WriterNews
There are two critical vulnerabilities in plug-ins for the popular Visual Studio Code editor, now patched, but security firm Snyk warns that popular plug-ins could put development environments in jeopardy.
By Robert Lemos Contributing Writer, 5/28/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33818
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVE-2021-33820
PUBLISHED: 2021-06-18
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
CVE-2021-33822
PUBLISHED: 2021-06-18
An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVE-2020-18442
PUBLISHED: 2021-06-18
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
CVE-2021-3604
PUBLISHED: 2021-06-18
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.