Threats & Vulnerabilities: Page

Is the Ticketbleed flaw the new Heartbleed vulnerability?

News roundup: F5 virtual server flaw, dubbed Ticketbleed, is similar to Heartbleed. Plus, DHS is considering requiring social media passwords on visa applications, and more.

By Madelyn Bacon • Feb. 10, 2017

IoT security threat to become real post-Mirai at RSA Conference 2017

IoT security tops the list of RSA Conference 2017 submissions after IoT devices were abused by threat actors, but the topics experts worry about are much more far-reaching.

By Michael Heller • Feb. 9, 2017

How did a Signal app bug let attackers alter encrypted attachments?

The Signal app, used for end-to-end encrypted mobile messaging, contained a bug that allowed data to be added to attachments. Expert Michael Cobb explains the flaw.

By Michael Cobb • Feb. 7, 2017

SQL Slammer worm makes a comeback 14 years later

The SQL Slammer worm returned to take down systems that have been left unpatched for the past 14 years, but experts are unsure if the attacks will continue.

By Michael Heller • Feb. 7, 2017

Microsoft delays Windows zero-day patch; researcher drops exploit code

Microsoft decided to delay a Windows zero-day patch by two months, prompting the researcher who found it to post the proof-of-concept exploit code.

By Michael Heller • Feb. 3, 2017

Pentagon hack possible due to bad vulnerability management

A researcher finds unpatched flaws in DOD systems that may have already allowed a Pentagon hack, and the government is doing nothing to remediate the issue.

By Michael Heller • Feb. 2, 2017

Hacked CCTV cameras in DC before inauguration leave unanswered questions

The Washington, D.C., Police Department spotted hacked CCTV cameras before the inauguration and has remediated the ransomware, but questions still surround the attack.

By Michael Heller • Jan. 31, 2017

How does a Netgear vulnerability enable command injection attacks?

A Netgear vulnerability exposed a number of wireless router models to command injection attacks. Expert Judith Myerson explains how the attack works and how to stop it.

By Judith Myerson • Jan. 27, 2017

Americans split on federal government security, encryption attitudes

News roundup: Half of Americans don't trust federal government security. Plus, a Kaspersky Lab manager was arrested; an internal DOD network was found vulnerable; and more.

By Madelyn Bacon • Jan. 27, 2017

More than 200 vulnerabilities found in Trend Micro security products

Researchers uncovered more than 200 vulnerabilities across Trend Micro products, but experts said the company brand won't take a hit.

By Michael Heller • Jan. 26, 2017

Heartbleed bug still found to affect 200,000 services on the web

Researchers found the infamous Heartbleed bug is still unpatched on as many as 200,000 services connected to the internet and experts don't expect that number to change.

By Michael Heller • Jan. 26, 2017

Project Zero finds Cisco WebEx vulnerability in browser extensions

A critical Cisco WebEx vulnerability in the service's browser extensions was discovered and patched, though some disagree the patch goes far enough to protect against attack.

By Peter Loshin • Jan. 25, 2017

Certificate Transparency snags Symantec CA for improper certs

Symantec CA could be in for more trouble after a security researcher, using Certificate Transparency logs, discovered more than 100 improperly issued certificates.

By Peter Loshin • Jan. 24, 2017

How does Stampado ransomware spread to external drives?

The Stampado ransomware is a low-cost threat to networks and external drives. Expert Matthew Pascucci explains how Stampado works and how enterprises should handle it.

By Matthew Pascucci • Jan. 23, 2017

How serious are the flaws in St. Jude Medical’s IoT medical devices?

MedSec and Muddy Waters Capital revealed serious flaws in IoT medical devices manufactured by St. Jude Medical. Expert Nick Lewis explains the severity of these vulnerabilities.

By Nick Lewis • Jan. 20, 2017

Carbanak gang using Google services for command and control

Researchers find the Carbanak gang has evolved its attacks on financial institutions to use Google services for command and control infrastructure in malware.

By Michael Heller • Jan. 20, 2017

Vulnerable Adobe extension downloads covertly to Chrome

News roundup: A flawed Adobe extension was secretly installed on 30 million Chrome browsers. Plus, the Mirai author has been identified; Google releases security details; and more.

By Madelyn Bacon • Jan. 20, 2017

Windows 10 security tackles exploits, while Windows 7 gets a warning

As Microsoft touted its Windows 10 security features defeating unpatched zero-day vulnerabilities, it also warned customers about security issues with Windows 7.

By Peter Loshin • Jan. 19, 2017

How does RIPPER ATM malware use malicious EMV chips?

RIPPER malware has been found responsible for the theft of $378,000 from ATMs in Thailand. Expert Nick Lewis explains how this ATM malware works.

By Nick Lewis • Jan. 19, 2017

St. Jude Medical finally patches vulnerable medical IoT devices

News roundup: St. Jude Medical patches vulnerable medical IoT devices after a five-month controversy. Plus, the Email Privacy Act is reintroduced; Juniper warns of a firewall flaw; and more.

By Madelyn Bacon • Jan. 13, 2017

Insecure MongoDB configuration leads to boom in ransom attacks

Poor authentication in MongoDB configurations has led to a sharp increase in ransom attacks, and experts say tens of thousands of databases could be at risk.

By Michael Heller • Jan. 11, 2017

Doxware: New ransomware threat, or just extortionware rebranded?

The threat of ransomware continues to evolve, with a new spin on extortionware, called doxware, that's designed to target and potentially expose sensitive data of ransomware victims.

By Michael Heller • Jan. 6, 2017

Decades-old bug in the libpng open source graphics library patched

A low-severity vulnerability dating back to 1995 in libpng, the official reference library implementation for PNG, may have enabled remote DoS attacks.

By Peter Loshin • Jan. 3, 2017

Hacking Web Intelligence

In this excerpt from chapter 8 of Hacking Web Intelligence, authors Sudhanshu Chauhan and Nutan Panda discuss how to be anonymous on the internet using proxy.

By SearchSecurity and Syngress • Dec. 30, 2016

Chinese company caught preinstalling Android spyware on budget devices

A Chinese company was found to be preinstalling Android spyware on budget smartphones and collecting phone call and messaging data without consent.

By Michael Heller • Nov. 17, 2016