Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Zero-Day Malvertising Attack Went Undetected For Two Months
Newest First  |  Oldest First  |  Threaded View
SgS125
50%
50%
SgS125,
User Rank: Ninja
4/22/2015 | 10:23:03 AM
So all the way to day 2 at RSA before anything to write about?

Wondered how far the value of the RSA conference  had fallen.

Thanks for reinforcing my decision to never go again.  I had trouble finding anything of value last year and it seems that the content has gone to an even lower standard.  I guesss last Decembers news is good enough for the RSA crowd.

 

Maybe they got a few people to attend the guy who gets kicked off the United flight speech.

 

Hang in there only a few more hours till cocktail time in Frisco where the real RSA action happens.

RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/22/2015 | 8:46:14 AM
Hiding in plain site
It's amazing how the malvertising attacks were injected in ads hosted by such well known websites. Many I would have considered reputable and trustworthy. Its scary to see that these things are hiding in such widely trafficked areas.

I remember reading an article stating that ad space is difficult to lock down as everyone, not only people with genuine need, can buy ad space.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
4/22/2015 | 7:12:27 AM
Scary
Ransomware creeps me out. Even though I have multiple back ups of my important files, folders and images, I really would rather the people that put the software together just stole money from my bank account. I can always earn that back, but personal files and images are totally irreplaceable. 

It's a great reason for people to make sure their files are well protected. 


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
CVE-2020-12525
PUBLISHED: 2021-01-22
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVE-2020-12511
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.