News

News

• March 08, 2017 08 Mar'17

  Vault 7 CIA hacking weapons include iOS, Android and Windows zero days

  WikiLeaks released a massive dump of files it claims to be CIA hacking tools, codenamed Vault 7, which includes iOS and Android zero-day exploits.

• March 06, 2017 06 Mar'17

  FBI chooses to protect Tor vulnerability and dismiss child porn case

  The Department of Justice dropped a child pornography case in order to avoid disclosing a Tor vulnerability; dozens more cases potentially affected.

• March 06, 2017 06 Mar'17

  New cybersecurity report gets the hacker perspective

  A new cybersecurity report used a hacker survey to offer a perspective on IT that can often be overlooked and found there may not be any easy answers.

• March 02, 2017 02 Mar'17

  Employees knew about Yahoo security breach years ago, per new SEC filing

  A new SEC filing details who knew about the major Yahoo security breach in 2014, but experts are confused by the repercussions of the announcement.

• February 27, 2017 27 Feb'17

  Chrome backs out of TLS 1.3 support after proxy issues

  After Google rolled out the latest version of Chrome, Blue Coat proxy software issues prompt rollback of TLS 1.3 support in latest version of Chrome browser.

• February 24, 2017 24 Feb'17

  Experts: Government Vulnerabilities Equities Process should be law

  Experts say codifying the Vulnerabilities Equities Process into law would increase transparency and trust regarding vulnerability disclosure by the government.

• February 23, 2017 23 Feb'17

  SHA-1 deprecation more important after hash officially broken

  SHA-1 deprecation in browsers comes as researchers create hash collisions and Google offers website and developer tools to protect against malicious uses.

• February 22, 2017 22 Feb'17

  Risk & Repeat: RSA Conference 2017 highlights and trends

  In this episode of SearchSecurity's Risk & Repeat podcast, editors recap RSA Conference 2017 and discuss how the show addressed many security problems, but had very few answers.

• February 22, 2017 22 Feb'17

  Understanding of security remediation differs for CISOs, researchers

  One expert warned there can be a disconnect between what security remediation means to CISOs and what researchers announce because of divergent objectives.

• February 22, 2017 22 Feb'17

  Microsoft commits to GDPR compliance in the cloud by 2018 deadline

  Microsoft vows GDPR compliance in all cloud services when enforcement of the new EU data privacy regulation begins in May 2018, but companies still must take action to avoid fines.

• February 17, 2017 17 Feb'17

  Microsoft Patch Tuesday February release delayed by a month

  News roundup: Microsoft Patch Tuesday was canceled in February without a clear reason. Plus, APT28 is linked to new Mac malware; Lazarus targets more banks and more.

• February 17, 2017 17 Feb'17

  Q&A: Digging into darknet technology with Farsight's Andrew Lewman

  At RSAC, former Tor Project CEO Andrew Lewman explains the latest research into darknet technology and how that tech continues to evolve as an attack vector.

• February 16, 2017 16 Feb'17

  Connected medical devices spark debate at RSA Conference session

  An RSA Conference session on a new attack on connected medical devices led to a spirited debate on vulnerability disclosure and manufacturer responsibility.

• February 16, 2017 16 Feb'17

  Experts debate national cybersecurity policy suggestions at RSAC 2017

  Experts at RSAC 2017 discussed national cybersecurity policy suggestions for the new presidential administration, including what to do about encryption and the DHS mission.

• February 16, 2017 16 Feb'17

  Q&A: Yubico brings FIDO authentication protocol to the masses

  Yubico founder and CEO Stina Ehrensvard spoke with SearchSecurity at RSAC 2017 about FIDO authentication and how Google uses it to secure logins and cut costs.

• February 16, 2017 16 Feb'17

  RSA Conference speakers tackle tech immigration reform, travel ban

  Several speakers made pro-immigration remarks at RSA Conference 2017 and called for tech immigration reform following President Trump's controversial executive order.

• February 15, 2017 15 Feb'17

  Do IoT security risks require new legislation or will standards suffice?

  In a panel discussion about current IoT security risks, experts at RSA Conference 2017 weigh government legislation options against industry self-regulation.

• February 15, 2017 15 Feb'17

  Bruce Schneier: It's time for internet-of-things regulation

  Speaking at RSA Conference 2017, security expert Bruce Schneier called for the creation of a new government agency to oversee internet-of-things regulation.

• February 15, 2017 15 Feb'17

  Christopher Young: Don't sleep on the Mirai botnet

  RSA Conference 2017 was full of talk about future IoT attacks, but Intel Security's Christopher Young said the Mirai botnet is still an enormous threat and demonstrated why that is.

• February 14, 2017 14 Feb'17

  RSA panel covers cryptography trends, elections and more

  Panel at RSAC on cryptography trends offers views on AI's coming domination of cybersecurity, quantum computing and quantum cryptography, politics and elections and more.

• February 14, 2017 14 Feb'17

  Microsoft: Nation-state cyberattacks have changed the security game

  Microsoft's Brad Smith spoke at RSA Conference 2017 about the effects of nation-state cyberattacks and what businesses and governments can do about them.

• February 14, 2017 14 Feb'17

  RSA President Rohit Ghai details new cybersecurity platform at RSAC 2017

  Michael Dell introduces RSA's newly appointed president, Rohit Ghai, who is set to lead the cybersecurity firm as it implements its new Business Driven Security platform.

• February 14, 2017 14 Feb'17

  Nation-state cyberattacks rising, warns former NSA director

  Speaking at RSA Conference 2017, former NSA Director Keith Alexander warned of increased nation-state cyberattacks and called for an overhaul of U.S. government cybersecurity.

• February 13, 2017 13 Feb'17

  Ransomware threat continues to evolve, defense needs to catch up

  With the rapid expansion of the ransomware threat landscape, defenders are scrambling to find ways to fight back. RSAC 2017 dedicated a full day for a ransomware seminar.

• February 10, 2017 10 Feb'17

  Trump tells White House cybersecurity officer, 'You're fired'

  Rumors have been confirmed that President Trump has fired the White House cybersecurity officer in charge of making sure he and his staff are not hacked.

• February 10, 2017 10 Feb'17

  Corero: Telecom carriers have fallen behind on DDoS defense

  Corero Network Security's Dave Larson talks with SearchSecurity about how DDoS defense has changed and why telecom service providers have struggled to keep up with new threats.

• February 10, 2017 10 Feb'17

  NSA contractor indicted for stealing elite cyberweapons over 20 years

  The NSA contractor accused of stealing elite cyberweapons over the course of 20 years, but his connection to the Shadow Brokers auction of similar hacking tools is still unclear.

• February 10, 2017 10 Feb'17

  Is the Ticketbleed flaw the new Heartbleed vulnerability?

  News roundup: F5 virtual server flaw, dubbed Ticketbleed, is similar to Heartbleed. Plus, DHS is considering requiring social media passwords on visa applications, and more.

• February 09, 2017 09 Feb'17

  IoT security threat to become real post-Mirai at RSA Conference 2017

  IoT security tops the list of RSA Conference 2017 submissions after IoT devices were abused by threat actors, but the topics experts worry about are much more far-reaching.

• February 08, 2017 08 Feb'17

  Five things to watch at RSA Conference 2017

  With no single trend or theme dominating at RSA Conference 2017, this year's show will still have plenty of material on machine learning, IoT security and much more.

• February 08, 2017 08 Feb'17

  Rapid7's Brown and Beardsley address IoT security issues

  Rapid7's Rebekah Brown and Tod Beardsley talk about IoT security issues, including new cars, blaming users for poor implementations and why NAT is the best firewall ever.

• February 07, 2017 07 Feb'17

  Corero Network Security on why DDoS mitigation strategy must improve

  Corero Network Security's Dave Larson talks with SearchSecurity about how the Mirai botnet attacks have forced companies to change their DDoS mitigation strategy.

• February 07, 2017 07 Feb'17

  Google to appeal after loss in cloud data privacy case

  Further battle over cloud data privacy is imminent, as a court decides against Google and declines to consider Microsoft's recent appeal victory as precedent.

• February 07, 2017 07 Feb'17

  SQL Slammer worm makes a comeback 14 years later

  The SQL Slammer worm returned to take down systems that have been left unpatched for the past 14 years, but experts are unsure if the attacks will continue.

• February 03, 2017 03 Feb'17

  Microsoft delays Windows zero-day patch; researcher drops exploit code

  Microsoft decided to delay a Windows zero-day patch by two months, prompting the researcher who found it to post the proof-of-concept exploit code.

• February 03, 2017 03 Feb'17

  Experts debate effects of government cybersecurity executive order

  A leaked version of a draft of a government cybersecurity executive order from President Trump has experts debating the effects such an order would have.

• February 03, 2017 03 Feb'17

  Google G Suite updates aim to improve phishing protection

  News roundup: Google updates G Suite with stronger authentication. Plus, WordPress secretly patches vulnerabilities, malware is likely to infect entire OSes, and more.

• February 02, 2017 02 Feb'17

  Pentagon hack possible due to bad vulnerability management

  A researcher finds unpatched flaws in DOD systems that may have already allowed a Pentagon hack, and the government is doing nothing to remediate the issue.

• February 01, 2017 01 Feb'17

  In 2017, cybersecurity attacks will follow your data

  Thanks to a polarizing election, the potential ramifications of cybersecurity attacks are front and center. Your friends and relatives probably have some concept of what it is that you actually do and its importance. But the daily challenges of ...

• January 31, 2017 31 Jan'17

  RSA Conference 2017 "not impacted" by Trump's executive order

  RSA Conference 2017 hasn't been affected by President Trump's recent executive order, but the travel ban has still send shockwaves through the tech industry.

• January 31, 2017 31 Jan'17

  RSAC 2017 Innovation Sandbox highlights top 10 cyber startups

  RSAC 2017: Innovation Sandbox competition pits this year's top 10 cybersecurity startups against each other in a bid to win top honors as most innovative.

• January 31, 2017 31 Jan'17

  Hacked CCTV cameras in DC before inauguration leave unanswered questions

  The Washington, D.C., Police Department spotted hacked CCTV cameras before the inauguration and has remediated the ransomware, but questions still surround the attack.

• January 31, 2017 31 Jan'17

  Q&A: Rapid7's Beardsley and Brown dish on Mirai botnet, pen testing

  Rapid7's Beardsley and Brown offer insight on Mirai botnet attacks, while also sharing some of their craziest penetration testing and incident response experiences.

• January 30, 2017 30 Jan'17

  RSA 2017: Special conference coverage

  Follow breaking news from the SearchSecurity team at RSA 2017 in San Francisco to learn the latest developments in the information security industry.

• January 27, 2017 27 Jan'17

  Symantec CA report offers more clarity on certificate transparency catch

  One week after certificate transparency revealed a Symantec CA improperly issued over 100 digital certificates, Symantec offers more details on the incident.

• January 27, 2017 27 Jan'17

  Google creates its own root certificate authority

  Google is expanding its certificate authority capabilities by creating its own root certificate authority, but experts are unsure of Google's plans moving forward.

• January 27, 2017 27 Jan'17

  How improper SSH key management is putting enterprises at risk

  In part two of his interview with SearchSecurity, SSH creator Tatu Ylonen explains why proper SSH key management is crucial and how attackers can use lost or exposed keys.

• January 27, 2017 27 Jan'17

  Americans split on federal government security, encryption attitudes

  News roundup: Half of Americans don't trust federal government security. Plus, a Kaspersky Lab manager was arrested; an internal DOD network was found vulnerable; and more.

• January 26, 2017 26 Jan'17

  More than 200 vulnerabilities found in Trend Micro security products

  Researchers uncovered more than 200 vulnerabilities across Trend Micro products, but experts said the company brand won't take a hit.

• January 26, 2017 26 Jan'17

  Microsoft defeats DOJ appeal in cloud data privacy case

  Microsoft notches another win in its battle to protect cloud data privacy, as an appeals court quashes the DOJ appeal over a warrant for data stored in an Ireland data center.

• January 26, 2017 26 Jan'17

  Heartbleed bug still found to affect 200,000 services on the web

  Researchers found the infamous Heartbleed bug is still unpatched on as many as 200,000 services connected to the internet and experts don't expect that number to change.

• January 25, 2017 25 Jan'17

  Risk & Repeat: Windows SMB warning raises questions, concerns

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the Shadow Brokers' alleged exploit for Windows SMB and what it means for both enterprises and Microsoft.

• January 25, 2017 25 Jan'17

  Project Zero finds Cisco WebEx vulnerability in browser extensions

  A critical Cisco WebEx vulnerability in the service's browser extensions was discovered and patched, though some disagree the patch goes far enough to protect against attack.

• January 24, 2017 24 Jan'17

  Certificate Transparency snags Symantec CA for improper certs

  Symantec CA could be in for more trouble after a security researcher, using Certificate Transparency logs, discovered more than 100 improperly issued certificates.

• January 23, 2017 23 Jan'17

  SEC to investigate the Yahoo breach disclosures

  The SEC has requested more information for potential cases concerning whether the Yahoo breach disclosures could have come sooner.

• January 20, 2017 20 Jan'17

  Future of the federal CISO position in question as Touhill steps down

  Retired Brig. Gen. Gregory Touhill stepped down as the federal CISO, leaving questions surrounding the future of the position and the work he has done.

• January 20, 2017 20 Jan'17

  Carbanak gang using Google services for command and control

  Researchers find the Carbanak gang has evolved its attacks on financial institutions to use Google services for command and control infrastructure in malware.

• January 20, 2017 20 Jan'17

  Vulnerable Adobe extension downloads covertly to Chrome

  News roundup: A flawed Adobe extension was secretly installed on 30 million Chrome browsers. Plus, the Mirai author has been identified; Google releases security details; and more.

• January 19, 2017 19 Jan'17

  Windows 10 security tackles exploits, while Windows 7 gets a warning

  As Microsoft touted its Windows 10 security features defeating unpatched zero-day vulnerabilities, it also warned customers about security issues with Windows 7.

• January 19, 2017 19 Jan'17

  US-CERT reminds users that Windows SMB v1 needs to die

  Experts say US-CERT is taking advantage of a potential -- but unverified -- vulnerability in Windows SMB v1 to remind enterprise users the outdated service should be disabled.

• January 17, 2017 17 Jan'17

  Gmail phishing campaign uses real-time techniques to bypass 2FA

  Researchers saw a Gmail phishing campaign in the wild using clever tricks to access accounts including a difficult 2FA bypass only possible in real time.

• January 13, 2017 13 Jan'17

  Microsoft privacy tools give users control over data collection

  New Microsoft privacy tools will give users control over the data collected on the web and within Windows. Experts hope the tools will offer data privacy transparency.

• January 13, 2017 13 Jan'17

  St. Jude Medical finally patches vulnerable medical IoT devices

  News roundup: St. Jude Medical patches vulnerable medical IoT devices after a five-month controversy. Plus, the Email Privacy Act is reintroduced; Juniper warns of a firewall flaw; and more.

• January 12, 2017 12 Jan'17

  Google Cloud KMS simplifies the key management service, but lacks features

  Experts are impressed with the simplicity of Google's Cloud KMS even if it doesn't separate itself from the key management service competition.

• January 11, 2017 11 Jan'17

  Insecure MongoDB configuration leads to boom in ransom attacks

  Poor authentication in MongoDB configurations has led to a sharp increase in ransom attacks, and experts say tens of thousands of databases could be at risk.

• January 10, 2017 10 Jan'17

  January Patch Tuesday sparse before Windows security updates change

  Microsoft offers up a meager January 2017 Patch Tuesday release before bigger changes planned for Windows security update announcements, which are set to take effect in February.

• January 10, 2017 10 Jan'17

  What are the potential pros and cons of a Cyber National Guard?

  A congressman proposed adding a Cyber National Guard to the military to protect the U.S. from cyber adversaries. Expert Mike O. Villegas examines the potential drawbacks of this branch.

• January 09, 2017 09 Jan'17

  In a post-Mirai world, the FTC wants more secure routers from D-Link

  The Federal Trade Commission filed a lawsuit against D-Link, and experts said the move was likely to push more secure routers in the wake of the Mirai botnet attacks.

• January 06, 2017 06 Jan'17

  FTC launches competition to improve IoT device security

  News roundup: FTC starts a contest to create a better IoT device security tool. Plus, ransomware is now illegal in California; Google patches 29 critical Android flaws; and more.

• January 06, 2017 06 Jan'17

  Doxware: New ransomware threat, or just extortionware rebranded?

  The threat of ransomware continues to evolve, with a new spin on extortionware, called doxware, that's designed to target and potentially expose sensitive data of ransomware victims.

• January 04, 2017 04 Jan'17

  SSL certificate validation flaw discovered in Kaspersky AV software

  Google Project Zero discovers more antivirus vulnerabilities. This time, the issues are with how Kaspersky Lab handles SSL certificate validation and CA root certificates.

• January 03, 2017 03 Jan'17

  Decades-old bug in the libpng open source graphics library patched

  A low-severity vulnerability dating back to 1995 in libpng, the official reference library implementation for PNG, may have enabled remote DoS attacks.

• November 17, 2016 17 Nov'16

  Chinese company caught preinstalling Android spyware on budget devices

  A Chinese company was found to be preinstalling Android spyware on budget smartphones and collecting phone call and messaging data without consent.

• August 29, 2016 29 Aug'16

  Pegasus iOS exploit uses three zero days to attack high-value targets

  A new remote iOS exploit called Pegasus leverages three zero days in what appear to be state-sponsored targeted attack campaigns against political dissidents.

• December 15, 2015 15 Dec'15

  Old Microsoft Kerberos vulnerability gets new spotlight

  A new blog post detailed authentication vulnerabilities in Microsoft Kerberos that cannot be patched and could lead to attackers having free rein over systems.

• December 01, 2015 01 Dec'15

  Amex credit card hack predicts replacement card number

  Samy Kamkar found a weakness in the algorithm American Express uses to generate replacement card information and created a credit card hack as a proof-of-concept.

• April 28, 2015 28 Apr'15

  Comparing the top SSL VPN products

  Expert Karen Scarfone examines the top SSL VPN products available today to help enterprises determine which option is the best fit for them.

• March 03, 2015 03 Mar'15

  Amid Apple Pay fraud, banks scramble to fix Yellow Path process

  Banks are rushing to fix sloppy authentication processes at the heart of rising Apple Pay fraud. Experts also worry about potential fraud with other mobile payment systems.

• April 10, 2014 10 Apr'14

  NSA TAO: What Tailored Access Operations unit means for enterprises

  The NSA's top-secret Tailored Access Operations offensive hacking unit offers enterprise defense strategy lessons. Expert Nick Lewis discusses.

• February 05, 2014 05 Feb'14

  Amid Microsoft MD5 deprecation, experts warn against SHA-1 algorithm

  With Microsoft's MD5 deprecation set for next week, experts say companies must be careful to avoid other weak protocols, like SHA-1.

• September 20, 2013 20 Sep'13

  HP introduces 'self-healing' BIOS protection with SureStart

  HP's new SureStart feature detects and 'heals' corrupted BIOS code.

• June 19, 2013 19 Jun'13

  RSA Silver Tail improves online fraud detection, enterprise security

  Fraud prevention for the Web: RSA Silver Tail sets stage for enterprise-level security with big data and brand new interface.

• November 01, 2012 01 Nov'12

  Protecting Intellectual Property: Best Practices

  Organizations need to implement best practices to protect their trade secrets from both internal and external threats.

• May 18, 2010 18 May'10

  Should there be PCI security requirements for bank account data?

  Gartner analyst wonders why no PCI-like standard exists for bank account information, which online criminals are targeting.