Robert Lemos

A study of 21.8 million comments submitted to the U.S. Federal Communications Commission on the Trump administration’s plan to remove regulations from cable, telecom and broadband providers found that the lack of any user authentication left the system open to abuse and left any conclusions based on the data about public sentiments on the issue […]

The popular Unity game platform—used by professionals and hobbyists alike—is vulnerable to remote compromise because of a flaw in the Windows game editor, the company warned on Aug. 18. Unity advised developers who use the Windows version of its editor to update immediately. Users of the Mac version of the editor are not affected, but […]

Industrial control systems and the Internet-of-Things are the industries most likely to have unknown vulnerabilities in their products, because their development processes are the least mature, according to data from more than 4.8 billion automated tests conducted by clients of security-services firm Synopsys. The data comes from fuzz testing, or fuzzing, an automated process that […]

Companies that scan binaries using VirusTotal — or other cloud scanning services — may expose sensitive data to the public, especially when developers scan internally-developed applications using the service, managed security firm DirectDefense warned on Aug. 9. The problem came to light when the company found information belonging to clients of endpoint detection and response […]

Malware authors and operators are increasingly using Secure Sockets Layer (SSL) encryption to hide their communications and escape detection, with the use of SSL for malware communications doubling in the first six months of 2017, security-in-the-cloud firm Zscaler said in its latest threat report. On average, the company has seen 600,000 “encrypted malicious activities” every […]

Locked down networks with no direct Internet access could still be infected with malware and have data exfiltrated through a brazen technique that uses the environment’s own security software as a channel to the Internet, according to a presentation two researchers delivered at the Black Hat Security Briefings on July 27. The technique exploits some […]

Business email compromise, ransom-seeking criminals and questionable programs that collect information are three of the major threats facing companies in 2017, according to Cisco’s Midyear Cybersecurity Report, published on July 20. Malware and denial-of-service attacks aimed at forcing victims to pay a ransom—known as ransomware and ransom denial-of-service (RDoS), respectively—affect 49 percent of companies, according […]

Companies are continuing to struggle with quickly shutting out former employees from accessing systems once they leave the company, according a survey conducted by Arlington Research and commissioned by OneLogin. The survey of 500 IT workers found that, while one-in-five companies have experienced a data breach caused by an ex-employee, 32 percent of companies take […]

Companies focused on securing their web applications have slightly reduced the number of flaws in their software, but about half of all applications continue to remain vulnerable for 365 days a year, according to web security firm WhiteHat Security’s latest annual report. The report, based on data from both dynamic and static analyses conducted by […]

Two separate European security authorities have concluded that the widespread Petya ransomware attack, also known as NonPetya, was not about money, but rather an assault conducted by a nation-state. On June 30, four researchers at the NATO Cooperative Cyber Defense Centre of Excellence (CCD COE) attributed both NotPetya and its predecessor, WannaCry, “most likely … […]

European companies and government agencies are reporting a widespread attack by a ransomware program that arrives in email and uses a leaked exploit to infect users’ systems, according to multiple accounts on June 27. The attack appears to be a year-old ransomware threat, known at Petya, created originally in 2016 but updated to use the […]

Developers continue to leave the vast majority of Web applications open to attack by leaving behind unused code, working with vulnerable third-party libraries and by allowing code frameworks to make requests for content from third-party sites, according to a report released this week. The data, collected by application-security firm tCell by observing real attacks on […]