SecurityWeek

LAS VEGAS - BLACK HAT USA 2015 - Researchers at Invincea have tested the effectiveness of an automated analysis system that focuses on the images embedded in malware.

Google on Wednesday that it has begun issuing over the air (OTA) security-focused updates to its Android-based Nexus devices, which the search giant says will happen on a monthly basis. The first security update of this kind began rolling out today, to Nexus 4, Nexus 5, Nexus 6, Nexus 7, Nexus 9, Nexus 10, and Nexus Player, Google said.

Samsung to Deliver Regular Security Updates Around Once a Month to Android-based Galaxy Devices

As more organizations become more comfortable with putting data in the cloud, they are aggressively applying varying levels of data protection to different types of information, according to data protection firm CipherCloud.

Domain name registrar Hover has reset user passwords after discovering that one of its systems might have been breached.Hover is a subsidiary of Canada-based Internet services and telecommunications company Tucows, one of the world’s largest ICANN-accredited domain registrars.

An engineer who hacked into a Chinese cable television system has been jailed for 12 years, state media reported, after he broadcast denunciations of the ruling Communist party -- including showing the Tiananmen Square "Tank Man" image.

Popular cloud storage services such as Google Drive and Dropbox can be abused by malicious actors in what experts call “Man-in-the-Cloud” (MITC) attacks.

Data breaches have become a daily occurrence. However, their cost to organizations goes far beyond reputational damage in the media. Boards and businesses are subject to regulatory mandates that carry fines and capital holds, and increasingly face litigation from class-action suits. Cyber security insurance has emerged as a stop-gap to protect stakeholders from the shortcomings of siloed risk management processes.

Flaws in Symantec Endpoint Protection Could Allow Hackers to Compromise Corporate Networks

Researchers at Trend Micro have reported finding a second denial-of-service (DoS) vulnerability in Android’s “mediaserver” component.

The developers of the WordPress content management system (CMS) today announced the release of version 4.2.4. This security release addresses six vulnerabilities and four bugs.

Enterprise technology provider CA Technologies said on Tuesday that it has signed a definitive agreement to acquire network security software maker Xceedium for an undisclosed sum.

Researchers at RSA have conducted an in-depth analysis of a Chinese virtual private network (VPN) service that has been used by advanced persistent threat (APT) groups to anonymize and obscure their activities.

As part of my day job, I have the distinct pleasure of studying enterprise security programs – or at least slices of them – in their native habitat. I spend time with CISOs and other security leaders at many different levels to understand, learn from and aggregate the successes, failures and lessons from these security program elements. Before I even embarked on this role, I was known to lament the difficulty of putting together a solid security program.

A large malvertising attack recently hit the Yahoo! advertising network, which leveraged Microsoft Azure websites and eventually redirected browsers to pages hosting the Angler Exploit Kit to compromise systems.

A critical denial-of-service (DoS) vulnerability in the Domain Name System (DNS) software BIND is being exploited in the wild, researchers have warned.

An unpatched local privilege escalation vulnerability in Apple’s OS X operating system has been exploited by malicious actors to install adware and other suspicious applications on vulnerable computers.

Version 3.0 of the notorious RIG exploit kit has been released. Researchers at Trustwave have determined that the crimeware has already been used to infect more than 1.3 million devices from all over the world.

The Xen Project has released patches to address two vulnerabilities affecting the Xen virtualization software.

The FBI is having trouble filling jobs for its cybersecurity programs because of comparatively low pay and rigorous background checks, an auditor's report says.