SecurityWeek

Building automation products from American Auto-Matrix are affected by a couple of high-severity vulnerabilities that allow remote hackers to compromise the affected system, ICS-CERT warned on Thursday.

The RIG exploit kit recently stopped distributing Tofsee and cybercriminals have decided to use the botnet’s own spamming capabilities to deliver the malware, Cisco’s Talos team reported on Thursday.

ZERODIUM, a leading zero-day exploit broker, has published its revised bounty figures for the amount it will pay for new zero-days. The highest figure is reserved for iOS - now up to $1.5 million for "fully functional/reliable exploits meeting ZERODIUM's requirements". It was 'only' $500,000 in September 2015.

The infamous Dridex banking Trojan has adopted new tactics and more advanced encryption and obfuscation to better avoid detection and to hinder security analysis, researchers warn.

If you live in the United States or one of several Nordic countries, your payment card data might be of interest to a duo of cybercriminals that FireEye refers to as the “Vendetta Brothers.”

Companies are spending millions on bug bounty programs whose goal is to identify vulnerabilities, but it might be more efficient to take a proactive approach and focus on identifying flaws in the development phase.

On Demand Webinar

A member of the Syrian Electronic Army hacker group arrested earlier this year in Germany has pleaded guilty to hacking and extortion charges before a judge in the Eastern District of Virginia.

Vulnerabilities, Backdoor Found in D-Link DWR-932B LTE Router

Two Russia-linked threat groups have been targeting citizen journalists investigating Moscow’s involvement in the downing of Malaysia Airlines flight MH17 in July 2014 as it was crossing Ukraine.

Many organizations have some level of threat detection and incident response capabilities. But building out these capabilities to take a proactive stance against an evolving threat landscape is often expensive and difficult. It requires additional and significant investment in people, intelligence, technology, and analytics. And, you want to make sure that investment delivers full value. 

Apple can’t tap into iMessage conversations, thanks to end-to-end encryption, but the iPhone maker does know who you message or attempt to message with.

An investigation conducted into the two Yahoo security incidents disclosed recently revealed the existence of a connection and led researchers to believe that the claim of 200 million accounts being stolen in 2012 is likely false.

The RIG exploit kit (EK) might be moving up the social ladder to become the top threat in its segment and leave Neutrino behind, recently observed malvertising campaigns suggest.

A firmware update released by Siemens this month for some of its industrial network security products fixes a vulnerability that could expose potentially sensitive information.

Secure Video Conferencing Solution Protects Content and Metadata in Voice and Video Communication

Facebook announced on Tuesday the availability of an osquery version that can be used by security teams to quickly identify and analyze threats on their Windows networks.

A Norwegian court on Wednesday dismissed a fresh bid by fugitive whistleblower Edward Snowden to win assurances he would not be extradited to the US should he come to Norway to collect an award.

Updates released this week by the Internet Systems Consortium (ISC) for the DNS software BIND address two vulnerabilities, including a new high-severity issue that can be exploited remotely.

Where does SWEET32 rank against other SSL vulnerabilities?