Dark Reading

Security and the Electric Vehicle Charging Infrastructure

01/24/2023
When EVs and smart chargers plug in to critical infrastructure, what can go wrong? Plenty.

Wallarm Aims to Reduce the Harm From Compromised APIs

01/23/2023
API Leak Management software discovers exposed API keys and other secrets, blocks their use, and monitors for abuse, the company says.

Pair of Galaxy App Store Bugs Offer Cyberattackers Mobile Device Access

01/23/2023
Devices running Android 12 and below are at risk of attackers downloading apps that direct users to a malicious domain.

Organizations Likely to Experience Ransomware Threat in the Next 24 Months, According to Info-Tech Research Group

01/23/2023
Security leaders must build resiliency against these complex attacks immediately.

FanDuel Sportsbook Bettors Exposed in Mailchimp Breach

01/23/2023
Amid all the NFL playoff action, FanDuel has sent an email warning to gamblers that their data was exposed in its third-party breach, putting them at risk for phishing attacks.

No One Wants to Be Governed, Everyone Wants to Be Helped

01/23/2023
Here's how a security team can present itself to citizen developers as a valuable resource rather than a bureaucratic roadblock.

TSA No-Fly List Snafu Highlights Risk of Keeping Sensitive Data in Dev Environments

01/23/2023
A Swiss hacker poking around in an unprotected Jenkins development server belonging to CommuteAir accessed the names and birthdates of some 1.5 million people on a TSA no-fly list from 2019.

Hunting Insider Threats on the Dark Web

01/23/2023
Use threat intelligence to reduce chance of success for malicious insider and Dark Web threats.

Cybersecurity Worries Around Hybrid Working Drop, but Many IT Leaders Still Concerned Over Cyber-Skills Gap

01/23/2023
S-RM reports show that cybersecurity concerns surrounding hybrid work prevail for 37% of organizations.

T-Mobile Breached Again, This Time Exposing 37M Customers' Data

01/20/2023
This time around, weak API security allowed a threat actor to access account information, the mobile phone giant reported.

Ransomware Profits Decline as Victims Dig In, Refuse to Pay

01/20/2023
Two new reports show ransomware revenues for threat actors dropped sharply in 2022 as more victims ignored ransom demands.

Compromised Zendesk Employee Credentials Lead to Breach

01/20/2023
Zendesk has alerted customers to a successful SMS phishing campaign that has exposed "service data," but details remain scarce.

GPT Emerges as Key AI Tech for Security Vendors

01/20/2023
Orca Security is one of the companies integrating conversational AI technology into its products.

Critical Manufacturing Sector in the Bull's-eye

01/20/2023
Serious security flaws go unpatched, and ransomware attacks increase against manufacturers.

The Evolution of Account Takeover Attacks: Initial Access Brokers for IoT

01/20/2023
Head off account takeover attacks by being proactive about IoT security. Start with designing and building better security protocols into IoT devices, always change weak default configurations, and regularly apply patches to ensure that IoT devices are secure.

PayPal Breach Exposed PII of Nearly 35K Accounts

01/19/2023
The credential-stuffing attack, likely fueled by password reuse, yielded personal identifiable information that can be used to verify the authenticity of previously stolen data.

EmojiDeploy Attack Chain Targets Misconfigured Azure Service

01/19/2023
Multiple misconfigurations in a service that underpins many Azure features could have allowed an attacker to remotely compromise a cloud user's system.

Massive Adware Campaign Shuttered

01/19/2023
Mainly Apple iOS in-app ads were targeted, injecting malicious JavaScript code to rack up phony views.

Attackers Crafted Custom Malware for Fortinet Zero-Day

01/19/2023
The "BoldMove" backdoor demonstrates a high level of knowledge of FortiOS, according to Mandiant researchers, who said the attacker appears to be based out of China.

Shift Identity Left: Preventing Identity-Based Breaches

01/19/2023
Traditional compliance and IAM are insufficient to secure the modern enterprise. We must shift left with modern access controls to avoid costly data breaches.