News

News

• May 17, 2017 17 May'17

  Q&A: Talking bug bounty programs with Bugcrowd's Casey Ellis

  As bug bounty programs become more mainstream, Bugcrowd founder and CEO Casey Ellis offers insights into rewards, best practices and tips for getting the most bang for the buck.

• May 12, 2017 12 May'17

  Trump cyber executive order focuses on cyber-risk management

  The Trump cyber executive order arrived, with a focus on cyber-risk management and reports. But key details are missing in terms of implementing changes.

• May 10, 2017 10 May'17

  Windows zero days squashed in May 2017 Patch Tuesday

  Microsoft's May 2017 Patch Tuesday fixed multiple Windows zero-day vulnerabilities, two of which have reportedly been exploited by groups linked to Russia.

• May 09, 2017 09 May'17

  Microsoft out-of-band patch hits the day before Patch Tuesday

  The evening before Patch Tuesday, Microsoft released an emergency out-of-band patch for a dangerous Windows flaw teased by the Google Project Zero team just days earlier.

• May 05, 2017 05 May'17

  New types of ransomware innovate to find opportunity

  There is no shortage of new types of ransomware, many with unique features, and experts say it's an exercise in innovation and finding revenue opportunity.

• May 05, 2017 05 May'17

  TLS client authentication ensures secure IoT connection

  The TLS client authentication protocol has been part of the security standard for years, but it's just now coming into its own in certifying secure IoT connections.

• May 05, 2017 05 May'17

  SS7 vulnerability allows attackers to drain bank accounts

  News roundup: Attackers exploit SS7 vulnerability and drain bank accounts. Plus, Trump signs government IT executive order, an Intel AMT flaw threatens millions and more.

• May 04, 2017 04 May'17

  Risk & Repeat: Symantec offers plan to restore certificate trust

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss Symantec's continued struggles with certificate trust, and what Mozilla and Google are doing about it.

• May 04, 2017 04 May'17

  Google Docs phishing attack grants attacker full Gmail access

  A Google Docs phishing attack abused OAuth to give malicious actors full access to a victim's Gmail account and contacts, but Google claims to have blocked the attacks.

• May 03, 2017 03 May'17

  Verizon DBIR 2017 loses international contributors

  Looking at the overall numbers for the contributors to the Verizon Data Breach Investigations Report (DBIR) from the past five years, it would seem like the amount of partners is hitting a plateau, ...

• May 02, 2017 02 May'17

  NATO cyberwar games show the U.S. needs more practice

  The NATO Locked Shields cyberwar games had the U.S. team winning most improved, but experts say the U.S. still needs more practice.

• April 28, 2017 28 Apr'17

  Symantec certificate authority offers counter-proposal to Google

  Symantec certificate authority proposal takes the pain out of sanctions for misissued certs, offers more audits, greater transparency and promise of "continuous improvement."

• April 28, 2017 28 Apr'17

  Verizon DBIR 2017: Basic cybersecurity focus misplaced

  Basic cybersecurity measures like limiting password reuse and implementing multifactor authentication could be big benefits, according to the Verizon DBIR 2017.

• April 28, 2017 28 Apr'17

  Still waiting for a cybersecurity executive order from Trump

  News roundup: A cybersecurity executive order overdue, but 'close and nearby.' Plus, the USPTO says it will stop using HTTPS; a teenage hacker sentenced to prison; and more.

• April 28, 2017 28 Apr'17

  Risk & Repeat: More Equation Group cyberweapons leaked

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the latest round of Equation Group cyberweapons and how Microsoft patched them.

• April 27, 2017 27 Apr'17

  AWS promises to be GDPR compliant by May 2018 deadline

  Amazon promises all AWS cloud services will be GDPR compliant before enforcement of the new EU data privacy regulation starts in 2018, offers customers assistance.

• April 25, 2017 25 Apr'17

  Symantec certificate authority issues, answered

  Google and Mozilla weigh the proper response to Symantec certificate authority issues, as the CA giant prepares an alternative proposal for reinstating trust.

• April 21, 2017 21 Apr'17

  Hajime worm fights the forces of evil IoT malware, maybe

  News roundup: The Hajime worm is the nicer, sneakier brother of Mirai malware. Plus, the FBI and CIA hunt for the Vault 7 whistleblower, Symantec adds to Zscaler lawsuit, and more.

• April 20, 2017 20 Apr'17

  Oracle patches Apache Struts exploits, Equation Group vulnerability

  There were 299 Oracle patches in the April Critical Patch Update, including a fix for the Apache Struts exploits found in the wild and a vulnerability from the Equation Group dump.

• April 19, 2017 19 Apr'17

  Risk & Repeat: Mozilla joins the Symantec certificate authority debate

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss mounting pressure on the Symantec certificate authority business to provide answers about its practices.

• April 18, 2017 18 Apr'17

  Shadow Brokers' Windows exploits target unsupported systems

  A new release of NSA cyberweapons falls flat, as Windows exploits from the Shadow Brokers have mostly been patched. But unsupported systems are still at risk.

• April 14, 2017 14 Apr'17

  Shadow Brokers release SWIFT banking and Windows exploits

  The Shadow Brokers released another cache of cyberweapons linked to the Equation Group, including Windows exploits and attack details for the SWIFT banking system.

• April 14, 2017 14 Apr'17

  DARPA's SSITH program takes aim at hardware vulnerabilities

  News roundup: DARPA's SSITH program tackles hardware vulnerabilities for better security. Plus, new risks placed in OWASP Top 10, SWIFT launches new anti-fraud tool, and more.

• April 13, 2017 13 Apr'17

  U.S. election hacking not an act of cyberwarfare, experts say

  The government needs a better definition for an act of cyberwarfare, says ex-CIA Director Michael Hayden, because he doesn't think the U.S. election hacking applies.

• April 12, 2017 12 Apr'17

  Symantec CA woes debated by browser community

  Compliance with CA/B Forum Baseline Requirements was debated after Symantec CA posted responses to 14 issues raised by Mozilla developers.

• April 12, 2017 12 Apr'17

  Security Update Guide brings growing pains to Patch Tuesday

  Microsoft fundamentally changes how IT pros will consume Patch Tuesday releases with the Security Update Guide and brings fixes for an actively exploited Word zero-day.

• April 11, 2017 11 Apr'17

  CIA Vault 7 tools attributed to hacking group for years

  Security researchers said the CIA Vault 7 tools and techniques are linked to cyberattacks over the past six years targeting various foreign entities.

• April 07, 2017 07 Apr'17

  State Department hack and APT29 prove attacker resilience

  News Roundup: 'Hand-to-hand' combat in State Department hack, APT29 has a stealth backdoor, the creator of the internet backs strong encryption, and more.

• April 06, 2017 06 Apr'17

  Chinese hacking group APT10 linked to global trade target

  Evidence points to Chinese hacking group APT10 conducting economic espionage in the breach of a trade policy group prior to U.S.-China trade summit talks in Florida.

• April 05, 2017 05 Apr'17

  Risk & Repeat: Strong encryption under fire again

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the latest round of the encryption debate and what it means for apps that use strong encryption.

• April 05, 2017 05 Apr'17

  Pegasus malware expands from iOS to Android

  One of the more malicious iOS threats -- Pegasus malware -- has made its way to Android devices and it has some dangerous new tricks in its arsenal.

• April 05, 2017 05 Apr'17

  Internet security protocol bodies ISOC, OTA announce merger

  The two leading internet security protocol bodies, Online Trust Alliance and Internet Society, merge to work for improved IoT security and online security.

• April 04, 2017 04 Apr'17

  Symantec certificate authority issues listed by Mozilla developers

  Mozilla developers respond to questionable Symantec certificate authority practices, as the security provider questions Google's proposed solutions.

• March 31, 2017 31 Mar'17

  Risk & Repeat: Google slams Symantec certificates

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss Google's proposed plan to distrust Symantec certificates following more allegations of mis-issuance.

• March 31, 2017 31 Mar'17

  EU encryption backdoor options for messaging apps set for June

  Messaging app developers will be offered 'three or four' legislative and non-legislative options for encryption backdoor access for EU law enforcement.

• March 31, 2017 31 Mar'17

  Obama-era cyber executive order extended by Trump

  A cyber executive order from the Obama era has been extended by President Trump to allow sanctions placed on cybercriminals who attack the U.S.

• March 31, 2017 31 Mar'17

  HTTPS traffic has yet to surpass HTTP traffic, Fortinet study shows

  News roundup: HTTPS traffic has yet to surge, despite its security benefits, according to a report. Plus, the latest in the Apple extortion; a Mirai attack lasted 54 hours; and more.

• March 30, 2017 30 Mar'17

  Google's Project Zero Prize uncovers zero Android remote exploits

  After six months, Google's Project Zero Prize competition uncovered zero Android remote exploits: no bugs, no prizes, no entries.

• March 29, 2017 29 Mar'17

  Potential SSL API flaw could reveal private keys

  A researcher claims to have found Symantec SSL API issues with extremely dangerous consequences, but a lack of evidence causes confusion.

• March 24, 2017 24 Mar'17

  Encryption debate needs to be nuanced, FBI's Comey says

  FBI Director James Comey brought the encryption debate back to the forefront by asking for a 'nuanced and thoughtful' conversation on the topic before there is a serious attack.

• March 24, 2017 24 Mar'17

  Google considers options on Symantec certificate authority 'failures'

  Symantec certificate authority cries foul, as Google considers severe options following the company allegedly misissuing as many as 30,000 digital certificates.

• March 24, 2017 24 Mar'17

  Cisco issues fix for Vault 7 vulnerability without help from WikiLeaks

  News roundup: Cisco fixes a Vault 7 flaw unaided, despite WikiLeaks' pledge to work with vendors. Plus, LastPass flaws leak user data; Apple held hostage by hackers; and more.

• March 23, 2017 23 Mar'17

  DV certificates abused, but policing may not be possible

  Research shows DV certificates can be a prime target for phishing and malware operators, but experts are unsure how certificate authorities should deal with the issue.

• March 22, 2017 22 Mar'17

  Risk & Repeat: Accused Yahoo hackers indicted

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the indictments of the alleged Yahoo hackers and how the attackers minted Yahoo authentication cookies.

• March 22, 2017 22 Mar'17

  HTTPS interception, middlebox models under fire

  HTTPS interception in security products and services may be reducing security rather than improving it, according to US-CERT, which puts middleboxes in a precarious position.

• March 17, 2017 17 Mar'17

  Will the Yahoo breach indictments be an effective hacker deterrent?

  The Department of Justice indicted suspects in the 2014 Yahoo breach, but experts are unsure if this will prove to be an effective hacker deterrent moving forward.

• March 15, 2017 15 Mar'17

  DOJ indicts suspected Yahoo hackers from Russia; extradition unclear

  The U.S. Department of Justice indicted four men -- including two Russian Federal Security Service officers -- accused of being the Yahoo hackers, but only one person was arrested.

• March 15, 2017 15 Mar'17

  Risk & Repeat: Leak of CIA hacking tools creates confusion

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the confusion around WikiLeaks' release of government documents regarding CIA hacking tools.

• March 14, 2017 14 Mar'17

  Nine critical Windows security bulletins in Patch Tuesday

  After its cancelled February Patch Tuesday, Microsoft's March 2017 Patch Tuesday includes nine critical Windows security bulletins targeting remote code execution flaws.

• March 14, 2017 14 Mar'17

  Deprecated SHA-1 certificates trip up SAP Ariba

  SHA-1 certificates are still in play, despite browser deprecation, as SAP Ariba advises legacy users to use unpatched browsers to avoid error messages, blocked access.

• March 14, 2017 14 Mar'17

  Android ransomware and more pre-installed on devices

  Security researchers found Android ransomware and malware pre-installed on popular devices, putting users at risk for information theft, tracking and more.

• March 10, 2017 10 Mar'17

  WikiLeaks vows to disclose CIA hacking tools; CIA to investigate

  WikiLeaks founder Julian Assange promised to work with vendors to help patch products vulnerable to CIA hacking tools, while the FBI and CIA will investigate the leak.

• March 09, 2017 09 Mar'17

  Operation Rosehub patches Java vulnerabilities in open source projects

  Google employees recently completed Operation Rosehub, a grass roots effort that patches a set of serious Java vulnerabilities in thousands of open source projects.

• March 08, 2017 08 Mar'17

  Responsible vulnerability disclosure lacking by CIA and WikiLeaks

  Experts criticize both WikiLeaks and the CIA for failing responsible vulnerability disclosure around the Vault 7 documents, and question the CIA's use of the VEP.

• March 08, 2017 08 Mar'17

  Vault 7 CIA hacking weapons include iOS, Android and Windows zero days

  WikiLeaks released a massive dump of files it claims to be CIA hacking tools, codenamed Vault 7, which includes iOS and Android zero-day exploits.

• March 06, 2017 06 Mar'17

  FBI chooses to protect Tor vulnerability and dismiss child porn case

  The Department of Justice dropped a child pornography case in order to avoid disclosing a Tor vulnerability; dozens more cases potentially affected.

• March 06, 2017 06 Mar'17

  New cybersecurity report gets the hacker perspective

  A new cybersecurity report used a hacker survey to offer a perspective on IT that can often be overlooked and found there may not be any easy answers.

• March 02, 2017 02 Mar'17

  Employees knew about Yahoo security breach years ago, per new SEC filing

  A new SEC filing details who knew about the major Yahoo security breach in 2014, but experts are confused by the repercussions of the announcement.

• February 27, 2017 27 Feb'17

  Chrome backs out of TLS 1.3 support after proxy issues

  After Google rolled out the latest version of Chrome, Blue Coat proxy software issues prompt rollback of TLS 1.3 support in latest version of Chrome browser.

• February 24, 2017 24 Feb'17

  Experts: Government Vulnerabilities Equities Process should be law

  Experts say codifying the Vulnerabilities Equities Process into law would increase transparency and trust regarding vulnerability disclosure by the government.

• February 23, 2017 23 Feb'17

  SHA-1 deprecation more important after hash officially broken

  SHA-1 deprecation in browsers comes as researchers create hash collisions and Google offers website and developer tools to protect against malicious uses.

• February 22, 2017 22 Feb'17

  Risk & Repeat: RSA Conference 2017 highlights and trends

  In this episode of SearchSecurity's Risk & Repeat podcast, editors recap RSA Conference 2017 and discuss how the show addressed many security problems, but had very few answers.

• February 22, 2017 22 Feb'17

  Understanding of security remediation differs for CISOs, researchers

  One expert warned there can be a disconnect between what security remediation means to CISOs and what researchers announce because of divergent objectives.

• February 22, 2017 22 Feb'17

  Microsoft commits to GDPR compliance in the cloud by 2018 deadline

  Microsoft vows GDPR compliance in all cloud services when enforcement of the new EU data privacy regulation begins in May 2018, but companies still must take action to avoid fines.

• February 17, 2017 17 Feb'17

  Microsoft Patch Tuesday February release delayed by a month

  News roundup: Microsoft Patch Tuesday was canceled in February without a clear reason. Plus, APT28 is linked to new Mac malware; Lazarus targets more banks and more.

• February 17, 2017 17 Feb'17

  Q&A: Digging into darknet technology with Farsight's Andrew Lewman

  At RSAC, former Tor Project CEO Andrew Lewman explains the latest research into darknet technology and how that tech continues to evolve as an attack vector.

• February 16, 2017 16 Feb'17

  Connected medical devices spark debate at RSA Conference session

  An RSA Conference session on a new attack on connected medical devices led to a spirited debate on vulnerability disclosure and manufacturer responsibility.

• February 16, 2017 16 Feb'17

  Experts debate national cybersecurity policy suggestions at RSAC 2017

  Experts at RSAC 2017 discussed national cybersecurity policy suggestions for the new presidential administration, including what to do about encryption and the DHS mission.

• February 16, 2017 16 Feb'17

  Q&A: Yubico brings FIDO authentication protocol to the masses

  Yubico founder and CEO Stina Ehrensvard spoke with SearchSecurity at RSAC 2017 about FIDO authentication and how Google uses it to secure logins and cut costs.

• February 16, 2017 16 Feb'17

  RSA Conference speakers tackle tech immigration reform, travel ban

  Several speakers made pro-immigration remarks at RSA Conference 2017 and called for tech immigration reform following President Trump's controversial executive order.

• February 15, 2017 15 Feb'17

  Do IoT security risks require new legislation or will standards suffice?

  In a panel discussion about current IoT security risks, experts at RSA Conference 2017 weigh government legislation options against industry self-regulation.

• February 15, 2017 15 Feb'17

  Bruce Schneier: It's time for internet-of-things regulation

  Speaking at RSA Conference 2017, security expert Bruce Schneier called for the creation of a new government agency to oversee internet-of-things regulation.

• February 15, 2017 15 Feb'17

  Christopher Young: Don't sleep on the Mirai botnet

  RSA Conference 2017 was full of talk about future IoT attacks, but Intel Security's Christopher Young said the Mirai botnet is still an enormous threat and demonstrated why that is.

• February 14, 2017 14 Feb'17

  RSA panel covers cryptography trends, elections and more

  Panel at RSAC on cryptography trends offers views on AI's coming domination of cybersecurity, quantum computing and quantum cryptography, politics and elections and more.

• February 14, 2017 14 Feb'17

  Microsoft: Nation-state cyberattacks have changed the security game

  Microsoft's Brad Smith spoke at RSA Conference 2017 about the effects of nation-state cyberattacks and what businesses and governments can do about them.

• February 14, 2017 14 Feb'17

  RSA President Rohit Ghai details new cybersecurity platform at RSAC 2017

  Michael Dell introduces RSA's newly appointed president, Rohit Ghai, who is set to lead the cybersecurity firm as it implements its new Business Driven Security platform.

• February 14, 2017 14 Feb'17

  Nation-state cyberattacks rising, warns former NSA director

  Speaking at RSA Conference 2017, former NSA Director Keith Alexander warned of increased nation-state cyberattacks and called for an overhaul of U.S. government cybersecurity.

• February 13, 2017 13 Feb'17

  Ransomware threat continues to evolve, defense needs to catch up

  With the rapid expansion of the ransomware threat landscape, defenders are scrambling to find ways to fight back. RSAC 2017 dedicated a full day for a ransomware seminar.

• February 10, 2017 10 Feb'17

  Trump tells White House cybersecurity officer, 'You're fired'

  Rumors have been confirmed that President Trump has fired the White House cybersecurity officer in charge of making sure he and his staff are not hacked.

• February 10, 2017 10 Feb'17

  Corero: Telecom carriers have fallen behind on DDoS defense

  Corero Network Security's Dave Larson talks with SearchSecurity about how DDoS defense has changed and why telecom service providers have struggled to keep up with new threats.

• February 10, 2017 10 Feb'17

  NSA contractor indicted for stealing elite cyberweapons over 20 years

  The NSA contractor accused of stealing elite cyberweapons over the course of 20 years, but his connection to the Shadow Brokers auction of similar hacking tools is still unclear.

• February 10, 2017 10 Feb'17

  Is the Ticketbleed flaw the new Heartbleed vulnerability?

  News roundup: F5 virtual server flaw, dubbed Ticketbleed, is similar to Heartbleed. Plus, DHS is considering requiring social media passwords on visa applications, and more.

• February 09, 2017 09 Feb'17

  IoT security threat to become real post-Mirai at RSA Conference 2017

  IoT security tops the list of RSA Conference 2017 submissions after IoT devices were abused by threat actors, but the topics experts worry about are much more far-reaching.

• February 08, 2017 08 Feb'17

  Five things to watch at RSA Conference 2017

  With no single trend or theme dominating at RSA Conference 2017, this year's show will still have plenty of material on machine learning, IoT security and much more.

• February 08, 2017 08 Feb'17

  Rapid7's Brown and Beardsley address IoT security issues

  Rapid7's Rebekah Brown and Tod Beardsley talk about IoT security issues, including new cars, blaming users for poor implementations and why NAT is the best firewall ever.

• February 07, 2017 07 Feb'17

  Corero Network Security on why DDoS mitigation strategy must improve

  Corero Network Security's Dave Larson talks with SearchSecurity about how the Mirai botnet attacks have forced companies to change their DDoS mitigation strategy.

• February 07, 2017 07 Feb'17

  Google to appeal after loss in cloud data privacy case

  Further battle over cloud data privacy is imminent, as a court decides against Google and declines to consider Microsoft's recent appeal victory as precedent.

• February 07, 2017 07 Feb'17

  SQL Slammer worm makes a comeback 14 years later

  The SQL Slammer worm returned to take down systems that have been left unpatched for the past 14 years, but experts are unsure if the attacks will continue.

• February 03, 2017 03 Feb'17

  Microsoft delays Windows zero-day patch; researcher drops exploit code

  Microsoft decided to delay a Windows zero-day patch by two months, prompting the researcher who found it to post the proof-of-concept exploit code.

• February 03, 2017 03 Feb'17

  Experts debate effects of government cybersecurity executive order

  A leaked version of a draft of a government cybersecurity executive order from President Trump has experts debating the effects such an order would have.

• February 03, 2017 03 Feb'17

  Google G Suite updates aim to improve phishing protection

  News roundup: Google updates G Suite with stronger authentication. Plus, WordPress secretly patches vulnerabilities, malware is likely to infect entire OSes, and more.

• February 02, 2017 02 Feb'17

  Pentagon hack possible due to bad vulnerability management

  A researcher finds unpatched flaws in DOD systems that may have already allowed a Pentagon hack, and the government is doing nothing to remediate the issue.

• February 01, 2017 01 Feb'17

  In 2017, cybersecurity attacks will follow your data

  Thanks to a polarizing election, the potential ramifications of cybersecurity attacks are front and center. Your friends and relatives probably have some concept of what it is that you actually do and its importance. But the daily challenges of ...

• January 31, 2017 31 Jan'17

  RSA Conference 2017 "not impacted" by Trump's executive order

  RSA Conference 2017 hasn't been affected by President Trump's recent executive order, but the travel ban has still send shockwaves through the tech industry.

• January 31, 2017 31 Jan'17

  RSAC 2017 Innovation Sandbox highlights top 10 cyber startups

  RSAC 2017: Innovation Sandbox competition pits this year's top 10 cybersecurity startups against each other in a bid to win top honors as most innovative.

• January 31, 2017 31 Jan'17

  Hacked CCTV cameras in DC before inauguration leave unanswered questions

  The Washington, D.C., Police Department spotted hacked CCTV cameras before the inauguration and has remediated the ransomware, but questions still surround the attack.

• January 31, 2017 31 Jan'17

  Q&A: Rapid7's Beardsley and Brown dish on Mirai botnet, pen testing

  Rapid7's Beardsley and Brown offer insight on Mirai botnet attacks, while also sharing some of their craziest penetration testing and incident response experiences.

• January 30, 2017 30 Jan'17

  RSA 2017: Special conference coverage

  Follow breaking news from the SearchSecurity team at RSA 2017 in San Francisco to learn the latest developments in the information security industry.

• January 27, 2017 27 Jan'17

  Symantec CA report offers more clarity on certificate transparency catch

  One week after certificate transparency revealed a Symantec CA improperly issued over 100 digital certificates, Symantec offers more details on the incident.

• January 27, 2017 27 Jan'17

  Google creates its own root certificate authority

  Google is expanding its certificate authority capabilities by creating its own root certificate authority, but experts are unsure of Google's plans moving forward.