Search results for: zero trust

Many Fed smartphones have zero password protection

A new report showcases increased security risks with mobile device usage within Federal government as adoption of smartphones and other mobile devices becomes more widespread. Sponsored by EMC, VMware, Cisco, and Carahsoft, the report reveals that more than half of smartphone users in the Federal government use their personal smartphone for job-related tasks. Out of this group, one in three workers do not have password protection. The Digital Government Strategy calls for embracing the opportunity … More

Looking back at a year of Microsoft patches

Last year Microsoft’s Patch Tuesdays featured a total of 83 bulletins, which is a decline from previous years. Since their security efforts impact countless security professionals, we wanted to see what IT security leaders, and Microsoft, think about the patches released in 2012. Here are some of the comments received by Help Net Security. Amol Sarwate, Director of Qualys Vulnerability Labs “In 2012, not only did the number of security bulletins released by Microsoft decreased … More

Week in review: SANS’ real-world cyber city, and the return of an aggressive autorun worm

Here’s an overview of some of last week’s most interesting news and articles: eBay patches two critical security flaws on US website Two critical vulnerabilities in eBay’s US website ( have been closed by the company, preventing attackers from accessing and modifying one of its databases as well as steal eBay users’ login credentials. Shredded police documents showered down on Macy’s parade spectators A Tufts University freshman made a troubling discovery while watching Macy’s Thanksgiving … More

Week in review: Facebook to educate new users on privacy, PayPal, Symantec targeted in hacking spree

Here’s an overview of some of last week’s most interesting news, videos, reviews, podcasts and articles: Life cycle and detection of an exploit kit This talk examines how some popular exploit kits work, from lure through payload; and discuss detection and prevention methodologies, with a focus on IDS/IPS. PayPal, Symantec, ImageShack, NBC targeted in hacking spree The last week has witnessed a flurry of activity and data leaks from several hacker groups. New Facebook users … More

Week in review: New and improved TDL4 rootkit, and the danger behind low-volume email attacks

Here’s an overview of some of last week’s most interesting news, reviews and articles: Info-stealing Trojan posing as Panda Cloud Antivirus The file – named 2.4.exe – is equipped with the well-known Panda icon but, once run, installs the DarkAngle Trojan on the victim’s computer. The danger behind low-volume email attacks Broad campaigns often spoof notifications from well-known businesses, establishments, organizations, and agencies, and are very widespread these days. However, smaller volume campaigns sometimes can … More

Week in review: Malware served form SourceForge mirror, Adobe breach and compromised certificate

Here’s an overview of some of last week’s most interesting news, interviews, videos and articles: Facebook turns off facial recognition in Europe Facebook has assented to keeping the facial recognition feature (“Tag Suggest”) for its European users off until European regulators allow it to be reinstated, and to delete collected templates for those users by 15 October, says in the latest report of a re-audit conducted by Ireland’s Data Protection Commissioner’s Office. How to recognize … More

Microsoft patches IE zero-day and Flash flaws in IE 10

Microsoft has delivered on its promise and has issued a security update for Internet Explorer to address the zero-day memory-corruption vulnerability in versions 9 and earlier that is currently being exploited in attacks. The update also takes care of four privately disclosed vulnerabilities that are currently not being exploited. In addition to this, Microsoft has also released an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and … More

Microsoft offers Fix it for IE zero-day, announces security update

Microsoft has released the Fix it solution for the IE zero-day memory-corruption vulnerability that is currently being exploited in attacks, and has promised a security update for IE to solve the problem. “While the vast majority of people are not impacted by this issue, today Microsoft provided a temporary fix that can be downloaded with one easy click and offers immediate protection. We will also provide a permanent solution for customers that will be automatically … More

Microsoft promises fast fix for IE zero-day as new attacks are discovered

The problem of the remotely-exploitable IE zero-day memory-corruption vulnerability that is being misused in current attacks has reached a critical enough level for Microsoft to confirm the issuing of a “Fix it” tool ahead of a badly needed patch. “While we have only seen a few attempts to exploit the issue, impacting an extremely limited number of people, we are taking this proactive step to help ensure Internet Explorer customers are protected and able to … More

Dynamic hacking risks target web application security

Web applications remain the third most common attack vector overall, with hacking still on the increase, from organized criminal groups, amateurs and political activists. Complex technology, growing adoption of web 2.0 functionality and powerful features of HTML5 have enhanced the opportunity for hackers to exploit vulnerabilities. The consequences of a compromised web application can go way beyond the web server: a number of high-profile attacks with prestigious companies caused millions USD in losses. All organizations … More

Compromised website serving “state-sponsored” 0-day exploit

The still unpatched Microsoft XML Core Services vulnerability (CVE-2012-1889) that allows attackers to gain the same user rights as the logged on user and execute malicious code remotely is being actively exploited in the wild. According to Sophos, the website of a European aeronautical parts supplier has been recently compromised and found serving a file infected with the code that tries to exploit the aforementioned zero-day. Given that the vulnerability was recently tied to Google’s … More

DLP with real-time artificial intelligence

BeyondTrust announced PowerBroker DLP v4.0, its data loss prevention solution with real-time, distributed artificial intelligence, which provides organizations a “zero-touch” solution to secure critical data without writing a single rule. This major release includes Active Profiler DX, BeyondTrust’s patent-pending technology that intelligently monitors and profiles ongoing user behavior and activity, in order to then identify suspicious activity. Active Profiler DX learns the normal behavior of each user in the enterprise, automatically detecting and preventing data … More