SecurityWeek

The Internet Systems Consortium (ISC) announced this week that updates released for the DNS software BIND patch several denial-of-service (DoS) vulnerabilities that can be exploited remotely.BIND versions 9.9.9-P8, 9.10.4-P8 and 9.11.0-P5 address three new security holes that could lead to an assertion failure.

In the incident response world, we used to draw a clear line between the capabilities of attackers affiliated with nation-states and those not affiliated with any nation-state. Nation-state attackers always seemed to be the most well equipped and the most sophisticated attackers.  Then, over the last few years, that line began to blur.  

Psycho-Analytics Could Help Detect Future Malicious Behavior

Tens of thousands of vulnerable home routers have been hacked and abused to launch attacks on WordPress websites, security firm Wordfence reported on Tuesday.

One year after the exploit kit (EK) landscape was shaken by the sudden disappearance of the Angler and Nuclear kits, another change is happening in the segment. While the Sundown EK has been inactive for the past month or so, the recent Terror EK is being used in new campaigns, researchers say.

Security Cannot Exist in a Vacuum – it Must be Integrated With the Entirety of an Organization’s Strategy

Adobe released security updates for several of its products on Tuesday to address a total of 59 vulnerabilities, including flaws disclosed last month at the Pwn2Own 2017 hacking competition.

Microsoft’s security updates for April 2017 address more than 40 critical, important and moderate severity vulnerabilities, including three zero-day flaws that have been exploited in attacks.

A Canadian court on Tuesday denied bail to a man accused of carrying out devastating cyberattacks on Yahoo as he awaits possible extradition to the United States to face criminal charges. Karim Baratov, 22, an immigrant from Kazakhstan, was arrested on a US warrant in March for alleged hacking, commercial espionage and related crimes.

The issuance of SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificates is expected to become a more secure process this September, after the implementation of mandatory Certificate Authority Authorization (CAA) checks.

A recently revealed zero-day vulnerability in Microsoft Office is being exploited by the Dridex banking Trojan to compromise unsuspecting victims’ computers, Proofpoint security researchers warn.

Cyber criminals are re-using stolen passwords to access the accounts of third-party sellers on Amazon. They then change the bank account details and simply redirect customer payments to their own bank accounts. Where they find an old and disused account, they promote non-existent deals with heavy discounts, and again divert the proceeds to their own bank account.

The Open Web Application Security Project (OWASP) announced on Monday the first release candidate for the 2017 OWASP Top 10, which proposes two new vulnerability categories.The new categories proposed for OWASP Top 10 - 2017 are “insufficient attack detection and prevention” and “unprotected APIs.”

A newly observed variant of the Mirai malware is abusing infected Internet of Things (IoT) devices for Bitcoin crypto-currency mining, IBM X-Force security researchers warn.

I love watching reality shows about paramedics. It is thrilling to see the EMTs rush to a scene and take immediate action to save the life of some unfortunate victim. They are often forced to guess the trauma or ailment of the patient and hope that the treatment they administer is the correct one. 

Cisco’s Talos intelligence and research group has conducted a two-week analysis of an industrial wireless access point (AP) from Taiwan-based Moxa and discovered more than a dozen vulnerabilities, including ones that can be exploited to take full control of a device.

Researchers at Symantec have analyzed the Vault 7 files published in recent weeks by WikiLeaks and determined that they are very similar to ones used by a cyberespionage group tracked by the security firm as “Longhorn.”

U.S. Authorities Take Down Kelihos Botnet as Alleged Creator is Arrested in Spain

Video gaming retail company GameStop appears to have been breached, with an unknown number of customers' payment card details stolen. Those details are thought to include customer card number, expiration date, name, address and card verification value (CVV2), usually a 3-digit security code printed on the back of the card.