News

December 14, 2017 14 Dec'17
Mirai creators and operators plead guilty to federal charges

The Department of Justice announced guilty pleas from the three Mirai creators and operators behind the massive worldwide botnet DDoS attacks in 2016.
December 14, 2017 14 Dec'17
Risk & Repeat: The Bitcoin boom and its infosec effects

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the recent bitcoin boom and how the cryptocurrency's rising value could affect the cybersecurity landscape.
December 13, 2017 13 Dec'17
Breach awareness low among executives, CA Veracode survey says

According to a new survey from CA Veracode, breach awareness regarding recent major cyber incidents was low among executives, managers and directors, surprising some experts.
December 12, 2017 12 Dec'17
1.4 billion stolen credentials found on dark web

A massive repository containing more than 1.4 billion stolen credentials was found on the dark web with special features for malicious actors.
December 08, 2017 08 Dec'17
Emergency Microsoft patch out for Malware Protection Engine

A critical vulnerability found in the Windows Malware Protection Engine required an emergency Microsoft patch, but one expert said Microsoft hasn't handled the announcement well.
Sponsored News
- Riding the Wave to Enterprise AI at Scale: The Transformation of Client Solutions
  
  Sponsored by Dell Technologies - While it’s true that AI is moving rapidly toward universal adoption, it is in the enterprise where AI is having its greatest impact. Enterprise AI certainly is an area of massive resource investment: Research pegs the size of the 2025 global enterprise AI market at $97 billion, growing to an astonishing $229 billion by 2030. All forms of AI—agentic AI, generative AI, machine learning, and predictive AI, to name a few—are transforming how, when, where, and why work is done. See More
- The “Personal Touch” of AI is Undeniable, Thanks for Impressive Advances in Client Solutions
  
  Sponsored by Dell Technologies - The trend toward personal—and personalized—artificial intelligence (AI) has swiftly moved from interesting idea to undeniable market transformational catalyst. Research points out that 61% of U.S. adults have used AI in the past six months, with a growing number of those using it daily. This not only is an expected byproduct of widespread AI use in businesses and other enterprises, but the rapidly accelerating number of consumer-oriented use cases. See More
- The Deepening Impact of “AI Everywhere” is Revolutionizing Client Solutions
  
  Sponsored by Dell Technologies - Artificial intelligence (AI) has rapidly become the technical development with the most profound impact on how we work, play, live, and interact. Although AI has been around for decades, earlier generations of expert systems, knowledge systems, and decision-support systems pale in comparison to the capabilities of the AI of today…and tomorrow. See More
View All Sponsored News
December 08, 2017 08 Dec'17
Hacker behind Uber data breach was paid off through bug bounty

News roundup: The man responsible for the 2016 Uber data breach is a 20-year-old from Florida. Plus, Ethiopia reportedly targeted dissidents with Israeli spyware, and more.
December 07, 2017 07 Dec'17
Risk & Repeat: Analyzing the accidental data breach

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the rise of accidental data breaches following a series of enterprise exposures of user data online.
December 07, 2017 07 Dec'17
Army cyber officer hiring to build the future of warfare

A new initiative plans Army cyber officer hiring over the course of five years, but experts are skeptical it can attract the best candidates away from the private sector.
December 05, 2017 05 Dec'17
Keyboard data leak exposes millions of personal records

A keyboard data leak by mobile developer Ai.type exposed millions of personal records through misconfigured MongoDB database settings.
December 05, 2017 05 Dec'17
Apple High Sierra patch undone by macOS update

Apple released a High Sierra patch to fix a serious macOS authentication vulnerability discovered last week, but users could accidentally undo the patch with a routine OS update.
December 01, 2017 01 Dec'17
Proposed data breach legislation could put executives in jail

Democratic senators have proposed data breach legislation that could lead to jail time for some executives who conceal breaches and fail to disclose them to consumers.
November 30, 2017 30 Nov'17
The CASB market is (nearly) gone but not forgotten

A series of acquisitions have drastically reduced the number of stand-alone cloud access security brokers and reshaped the CASB market for years to come.
November 30, 2017 30 Nov'17
Risk & Repeat: Uber data breach has implications for infosec

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the Uber data breach, which was concealed by company officials, and the ethics of data breach disclosure.
November 30, 2017 30 Nov'17
NSA data leak exposed Army INSCOM project information

Yet another publicly accessible cloud storage bucket exposed government data; this time it was an NSA data leak which included information on an Army intelligence project.
November 29, 2017 29 Nov'17
Serious macOS flaw in High Sierra allows attackers to log in as root

An Apple macOS flaw in High Sierra could allow an attacker to bypass any authentication dialog, including signing in to a system as a full root user.
November 22, 2017 22 Nov'17
Uber breach affected 57 million users, covered up for a year

A 2016 Uber breach affecting data for 57 million users was covered up by the company, including a $100,000 payment to the attackers to keep the incident quiet.
November 22, 2017 22 Nov'17
Uber data breach raises unsettling questions for infosec

The Uber data breach episode is another black eye for the ride sharing company, but the cover up raises troubling implications for the infosec community.
November 21, 2017 21 Nov'17
Multiple Intel firmware vulnerabilities in Management Engine

Security researchers tested the controversial Intel Management Engine and other products, finding multiple Intel firmware vulnerabilities.
November 21, 2017 21 Nov'17
Risk & Repeat: Vulnerabilities Equities Process gets an update

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the new charter for the Vulnerabilities Equities Process and what it means for the infosec community.
November 17, 2017 17 Nov'17
Google bug bounty pays $100,000 for Chrome OS exploit

An anonymous security researcher has once again earned the top Google bug bounty prize in the Chrome Reward Program for a Chrome OS exploit chain.
November 16, 2017 16 Nov'17
Kaspersky sheds more light on Equation Group malware detection

A lengthy Kaspersky report offers more insight into how the antivirus company discovered Equation Group malware and came to possess classified U.S. government data.
November 16, 2017 16 Nov'17
Federal vulnerability review under new VEP still has questions

Experts are still unsure about the Vulnerabilities Equities Process, but admit the new VEP Charter could be a good step toward improving federal vulnerability review.
November 15, 2017 15 Nov'17
New VEP Charter promises vulnerability transparency

The White House wants a more open Vulnerabilities Equities Process and has unveiled a new VEP Charter in order to promote transparency in bug reviews.
November 15, 2017 15 Nov'17
Risk & Repeat: App store security measures falling short

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the recent discovery of a fake WhatsApp app in the Google Play Store and what that means for app store security.
November 14, 2017 14 Nov'17
AVGater abuses antivirus software for local system takeover

A new proof-of-concept exploit, called AVGater, has found a way to abuse antivirus quarantines to attack systems and gain full control.
November 10, 2017 10 Nov'17
Following Equifax breach, CEO doesn't know if data is encrypted

News roundup: Following the massive Equifax breach, the CEO said he doesn't know if customer data is encrypted or not. Plus, flaws were found in IEEE's P1735 standard, and more.
November 09, 2017 09 Nov'17
FBI hacking may have crossed international borders

New court documents indicate an FBI hacking operation may have crossed international borders and infected systems in Russia, China and Iran.
November 08, 2017 08 Nov'17
Android KRACK flaw patched in latest security update

The latest security release from Google patched the Android KRACK vulnerability affecting Wi-Fi's WPA2 protocol, but update confusion leaves users unsure if they are safe.
November 08, 2017 08 Nov'17
Risk & Repeat: Sale of Symantec Website Security completed

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the sale of Symantec Website Security to DigiCert and what it means for Symantec's troubled certificate business.
November 03, 2017 03 Nov'17
Researchers hack iOS 11 at Mobile Pwn2Own 2017

Security researchers competing at Mobile Pwn2Own 2017 used multiple vulnerabilities to hack iOS 11 in order to execute code and win prizes.
November 02, 2017 02 Nov'17
SAVE Act attempts to bolster election security

Two senators introduced a bipartisan election security bill called the SAVE Act, which aims to improve voting infrastructure and harden state systems against attack.
November 01, 2017 01 Nov'17
Risk & Repeat: Responsible encryption ramps up

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the recent push from law enforcement officials for responsible encryption and what that may mean.
October 31, 2017 31 Oct'17
The Equation Group malware mystery: Kaspersky offers an explanation

Kaspersky Lab finally explained how it came to possess Equation Group malware, but does the company's latest statement answer enough questions about the ongoing drama?
October 31, 2017 31 Oct'17
Is "responsible encryption" the new answer to "going dark"?

"Three may keep a Secret, if two of them are dead." So wrote Benjamin Franklin, in Poor Richard's Almanack, in 1735. Franklin knew a thing or two about secrets, as well as about cryptography, given ...
October 30, 2017 30 Oct'17
Bad Rabbit ransomware data recovery may be possible

Security researchers found a way to recover data locked by the Bad Rabbit ransomware without paying, and others said money might not have been the driver of the attacks.
October 30, 2017 30 Oct'17
Grossman: Cyberinsurance market is like the 'Wild West'

Jeremiah Grossman, chief of security strategy at SentinelOne, talks with SearchSecurity about the value of cyberinsurance and why the rapidly growing market needs to mature.
October 27, 2017 27 Oct'17
DUHK attack puts random number generators at risk

News roundup: Researchers find DUHK attacks can get around encrypted communications. Plus, FBI Director Wray criticizes mobile device encryption, and more.
October 27, 2017 27 Oct'17
Warning for Equifax security issues came months before breach

A security researcher reportedly disclosed a number of Equifax security issues to the company months before the major data breach, and none of the problems were fixed.
October 26, 2017 26 Oct'17
Risk & Repeat: Is vulnerability marketing problematic?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss vulnerability marketing and compare how the recent KRACK attack and ROCA flaw were publicized and promoted.
October 26, 2017 26 Oct'17
The art of the cyber warranty and guaranteeing protection

Jeremiah Grossman, chief of security strategy at SentinelOne, talks with SearchSecurity about the science of developing a cyber warranty for threat detection products.
October 26, 2017 26 Oct'17
Windows XP patches: Did Microsoft make the right decision?

Microsoft had to make several tradeoffs when developing patches for Windows XP. Expert Nick Lewis explains what these tradeoffs were and how enterprises should respond.
October 25, 2017 25 Oct'17
NSA cyberweapons report follows Kaspersky transparency plan

A Kaspersky transparency initiative and a full code review of its products are on the way, and a new Kaspersky statement explained how NSA cyberweapons were uploaded to its servers.
October 20, 2017 20 Oct'17
Google Play bug bounty hunts RCE vulnerabilities

A Google Play bug bounty program, run by Google and HackerOne, asks testers to hunt for remote code execution vulnerabilities in some of the top Android apps.
October 20, 2017 20 Oct'17
Latest Kaspersky controversy brings new questions, few answers

The Kaspersky controversy continued this week as the antivirus company responded to several explosive news stories about its relationship with the Russian government.
October 20, 2017 20 Oct'17
Advanced Protection Program locks down Google accounts

Google's Advanced Protection Program greatly increases the security of user accounts, but the usability tradeoffs may not be worth it for average users.
October 20, 2017 20 Oct'17
Microsoft mum on 2013 database breach of bug tracking system

News roundup: Former employees reveal a 2013 database breach exposed Microsoft's bug tracking system, DHS sets new rules for federal agencies on web, email security, and more.
October 20, 2017 20 Oct'17
Risk & Repeat: DEFCON tackles voting machine security

In this week's Risk & Repeat podcast, SearchSecurity editors discuss DEFCON's efforts to improve voting machine security in the wake of hacking threats during the 2016 election.
October 17, 2017 17 Oct'17
KRACK WPA2 flaw might be more hype than risk

Researchers discover a WPA2 vulnerability and brand it KRACK, but some experts say the early reports overstate the risk of the flaw and downplay the difficulty of an exploit.
October 17, 2017 17 Oct'17
Risk & Repeat: Kaspersky antivirus scans implicated in NSA breach

In this week's Risk & Repeat podcast, SearchSecurity editors discuss reports implicating Kaspersky antivirus scans in the recently disclosed breach at the National Security Agency.
October 13, 2017 13 Oct'17
DOJ's 'responsible encryption' is the new 'going dark'

News roundup: The DOJ calls for 'responsible encryption' to comply with court orders. Plus, there's more bad cybersecurity news for banks, and Accenture data in AWS gets exposed.
October 12, 2017 12 Oct'17
DEFCON hopes voting machine hacking can secure systems

The first official report on voting machine hacking from DEFCON suggests the need for pen testing, basic security guidelines and cooperation from local and federal governments.
October 11, 2017 11 Oct'17
October 2017 Patch Tuesday includes Windows zero-day fix

The top priority for Microsoft's October 2017 Patch Tuesday goes to a Windows zero-day vulnerability, but IT should also beware of two publicly disclosed flaws.
October 11, 2017 11 Oct'17
Risk & Repeat: Scope of Equifax, Yahoo breaches expands

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the expanding scope of the Equifax and Yahoo breaches and the long-term effects of these major security incidents.
October 11, 2017 11 Oct'17
Windows 10 patching could make older systems vulnerable

Microsoft's practice of automatic Windows 10 patching could be uncovering vulnerabilities in older systems that can be exploited by attackers, Google researchers said.
October 07, 2017 07 Oct'17
NSA breach leads to theft of government spy software

An NSA contractor became the target of a cyberattack after storing agency spying software on a personal device, and this NSA breach has caused a rise in fears regarding Russia.
October 06, 2017 06 Oct'17
Dnsmasq server flaws unmasked and patched by Google

News roundup: Google researchers find and patch vulnerabilities in the Dnsmasq server that are used widely in routers and IoT devices. Plus, EU-U.S. Privacy Shield challenge and more.
October 05, 2017 05 Oct'17
Equifax breach impact expands, blame game continues

The Equifax breach impact expanded and the company's former CEO answered questions in a congressional hearing, but experts were not satisfied by the answers.
October 05, 2017 05 Oct'17
Risk & Repeat: Are hacking victims taking too much blame?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss comments from the FBI's Donald Freese on the practice of blaming and shaming hacking victims and its effects.
October 05, 2017 05 Oct'17
Yahoo data breach found to affect all 3 billion users

Newly uncovered information indicated that all 3 billion users were affected by the 2013 Yahoo data breach, but Oath claimed passwords and credit card info was safe.
October 03, 2017 03 Oct'17
DHS cyberinsurance research could improve security

A longitudinal cyberinsurance study performed by the Department of Homeland Security could improve enterprise security but the effects depend on the data collected, said experts.
September 29, 2017 29 Sep'17
Government data requests on the rise for Apple and Google

One expert is concerned about the large increase of government data requests received by Apple and the effects this surveillance activity has on user privacy.
September 29, 2017 29 Sep'17
FBI's Freese: It's time to stop blaming hacking victims

The FBI's Don Freese spoke at the (ISC)2 Security Congress this week about the need to end the practice of blaming hacking victims. But will infosec professionals listen?
September 29, 2017 29 Sep'17
Deloitte hack compromised sensitive emails, client data

News roundup: During the Deloitte hack, attackers had access to client data and internal email servers. Plus, the U.S. asks China not to enforce its Cybersecurity Law, and more.
September 29, 2017 29 Sep'17
Proof-of-concept iOS exploit released by Google's Project Zero

Google's Project Zero released a proof-of-concept iOS exploit similar to the Broadpwn Wi-Fi flaw that could allow an attacker to run code or implant a backdoor.
September 28, 2017 28 Sep'17
Network lateral movement from an attacker's perspective

A security researcher describes the network lateral movement process from an attacker's perspective and a few key points of focus for IT pros, at DerbyCon.
September 27, 2017 27 Sep'17
Ransomware attackers using more sophisticated techniques

At the (ISC)2 Security Congress, infosec professionals warned of sophisticated ransomware attackers that are using more advanced techniques to encrypt entire networks.
September 27, 2017 27 Sep'17
Risk & Repeat: Kaspersky ban turns ugly

In this week's 'Risk & Repeat' podcast, SearchSecurity editors discuss the U.S. government's Kaspersky ban and how competitors like McAfee are trying to capitalize on it.
September 27, 2017 27 Sep'17
Windows digital signature bypassed with two registry edits

The DerbyCon keynote covered why security research is an approachable field, as well as how to bypass a Windows digital signature check to run unwanted code.
September 25, 2017 25 Sep'17
Freese: Cyber-risk management is the key to good infosec hygiene

Speaking at the (ISC)2 Security Congress, FBI Deputy Assistant Director Don Freese spoke about need for security pros to replace fear and emotion with proper cyber-risk management.
September 22, 2017 22 Sep'17
DerbyCon cybersecurity conference is unique and troubling

Walking up to DerbyCon 7.0 cybersecurity conference it immediately has a very different feel from the "major" infosec conferences. Attendees would never be caught loitering outside of the Black Hat ...
September 22, 2017 22 Sep'17
Users plagued by iOS app security issues, according to new research

News roundup: Researchers uncovered a large number of iOS app security risks. Plus, Viacom exposed its critical data through a misconfigured AWS S3 bucket, and more.
September 21, 2017 21 Sep'17
Undisclosed SEC breach may have led to illegal stock trades

The U.S. Securities and Exchange Commission admitted a 2016 breach that was previously undisclosed may have enabled threat actors to engage in illegal stock trades.
September 21, 2017 21 Sep'17
Undocumented Word feature could lead to system information theft

An undocumented Word feature found by Kaspersky Lab could lead to system information theft and affects users on both PCs and mobile devices.
September 21, 2017 21 Sep'17
Risk & Repeat: Equifax data breach fallout continues

In this week's Risk & Repeat podcast, SearchSecurity editors continue discussing the Equifax data breach and examine new details about an Apache Struts flaw tied to the attack.
September 19, 2017 19 Sep'17
CCleaner malware spread via supply chain attack

CCleaner malware was spread to users via an infected software update for close to one month, highlighting the dangers of supply chain attacks and the need for code signing.
September 15, 2017 15 Sep'17
Fearmongering around Apple Face ID security announcement

As fears grow over government surveillance, the phrase "facial recognition" often triggers a bit of panic in the public, and some commentators are exploiting that fear to overstate any risks ...
September 15, 2017 15 Sep'17
Apache Struts vulnerability blamed for Equifax data breach

Equifax has confirmed an unpatched critical Apache Struts vulnerability was exploited in the breach that compromised the personal data of 143 million U.S. citizens.
September 14, 2017 14 Sep'17
BlueBorne Bluetooth vulnerabilities affect billions of devices

A set of eight Bluetooth vulnerabilities, branded together as BlueBorne, affect billions of devices and could be one of the most dangerous issues, according to experts.
September 13, 2017 13 Sep'17
Equifax breach response deemed insufficient in multiple ways

Experts criticized the Equifax breach response as insufficient, given the size and scope of the data loss, and they said the company was likely not prepared for such an incident.
September 13, 2017 13 Sep'17
Risk & Repeat: Equifax data breach response called into question

In this week's Risk & Repeat podcast, SearchSecurity editors tackle the massive Equifax data breach and how the credit bureau's response to the security incident is creating more problems.
September 13, 2017 13 Sep'17
Apple claims iPhone X Face ID has better security than Touch ID

Apple announced the new iPhone X Face ID system, which replaces Touch ID in favor of facial recognition and may offer 20 times fewer false positives than fingerprint scanning.
September 08, 2017 08 Sep'17
Equifax breach exposes 143 million consumers' personal data

A massive Equifax breach, which was discovered in July, exposed the personal information, including names, birth dates and Social Security numbers, of 143 million Americans.
September 08, 2017 08 Sep'17
Six new vulnerabilities in Android bootloaders uncovered

News roundup: Researchers used the new BootStomp tool to uncover six vulnerabilities in Android bootloaders. Plus, a new wave of AWS S3 bucket data leaks strikes and more.
September 08, 2017 08 Sep'17
Apache Struts vulnerability affects versions since 2008

A researcher discovered a remotely exploitable Apache Struts vulnerability being actively exploited in the wild. A patch was released, and users were urged to update software immediately.
September 07, 2017 07 Sep'17
Dragonfly 2.0 hacker group seen targeting U.S. power grid

Security researchers claim to be tracking a threat group called Dragonfly 2.0 hacker group that has been attacking critical infrastructure and setting up persistent infections on ICS networks.
September 07, 2017 07 Sep'17
SHA-1 hashes recovered for 320M breached passwords

Security researchers once again proved how easy it can be to recover SHA-1 hashes by cracking the hashes on nearly 320 million passwords related to data breaches.
September 06, 2017 06 Sep'17
Risk & Repeat: Payment card security a growing concern

In this week's Risk & Repeat podcast, SearchSecurity editors discuss new research from Verizon on payment card security and the effectiveness of PCI DSS compliance for enterprises.
September 01, 2017 01 Sep'17
Enterprise compliance with PCI DSS is up, says Verizon

News roundup: More than half of enterprises are in compliance with PCI DSS, according to a Verizon report. Plus, Turla is on the attack again with a new campaign, and more.
September 01, 2017 01 Sep'17
Risk & Repeat: Alternative infosec conferences on the rise

In this week's Risk & Repeat podcast, SearchSecurity editors discuss how smaller, more targeted infosec conferences are making a name for themselves in the shadow of much larger events.
August 31, 2017 31 Aug'17
Spambot email leak compromises 711M records

An email leak containing 711 million records was found in a breach of a spambot list stored in the Netherlands and included both addresses and passwords used to access email accounts.
August 29, 2017 29 Aug'17
Kaspersky-Russian ties still unclear, despite FBI push

The specter of Kaspersky-Russian ties has reportedly led to an FBI campaign urging private organizations to drop Kaspersky Lab products; experts urge the FBI to share more evidence.
August 25, 2017 25 Aug'17
U.S. government cybersecurity is a mess, according to officials

News roundup: John McCain, NIAC and others called out the administration for not doing enough on U.S. government cybersecurity. Plus, the Ropemaker exploit alters emails, and more.
August 24, 2017 24 Aug'17
Google Chrome Enterprise adds management options

The Google Chrome Enterprise offering officially allows organizations to manage Google Play Store apps, extensions, Microsoft Active Directory and integrate VMware on Chromebooks.
August 23, 2017 23 Aug'17
Project Treble is another attempt at faster Android updates

Google has historically had a problem with getting mobile device manufacturers to push out Android updates, which has left hundreds of millions in the Android ecosystem at risk. Google hopes that ...
August 21, 2017 21 Aug'17
iPhone Secure Enclave firmware encryption key leaked

Experts and Apple say despite the leak of the iPhone Secure Enclave Processor encryption key that can be used to decrypt firmware code, user data and biometric information are still safe.
August 18, 2017 18 Aug'17
Valerie Plame: U.S. government cyberdefense must be improved

Former CIA officer Valerie Plame discusses why America's cyberdefense is lagging behind -- and what the government and private sector should do to reverse the trend.
August 18, 2017 18 Aug'17
Offensive cyberweapons from enemies may be re-engineered

The U.S. Defense Intelligence Agency wants to isolate, study, customize and re-engineer malware from adversaries to be used as its own offensive cyberweapons.
August 18, 2017 18 Aug'17
Hijacked Chrome extensions infect millions of users

News roundup: Hackers leveraged eight hijacked Chrome extensions to attack 4.8 million browser users. Plus, Cloudflare stopped protecting a neo-Nazi website from DDoS attacks, and more.
August 17, 2017 17 Aug'17
NotPetya ransomware impact costs Maersk hundreds of millions

Danish shipping giant A.P. Moller-Maersk said the NotPetya ransomware attacks severely damaged business processes and the impact has been estimated at as much as $300 million in lost revenue.
August 17, 2017 17 Aug'17
Authorities can't force smartphone access in iOS 11

IOS 11 will allow users to avoid authorities attempting to force smartphone access by temporarily disabling biometric unlocking of mobile devices.

News

Sponsored News