SecurityWeek

A coordinated effort by security companies has struck a blow against malware tools used by a cyber-espionage group known as Hidden Lynx.

Remember the days when security awareness programs only had to warn employees about website spoofing? Unfortunately, cyber-attack methods have advanced to the point where even trusted, well-known websites can silently infect users via drive-by download attacks. Last year’s NBC.com incident is a good example of this growing Internet threat.

Risk I/O, a vulnerability intelligence platform designed to help organizations report and mitigate security vulnerabilities, announced this week that it has raised an additional $4 million as part of its Series A financing round, which the company originally announced in November 2012. 

Microsoft and Oracle customers will have their hands full applying a spate of security updates that were issued today.

While There are Exceptions, Most Business Executives View Security as a Necessary Evil...

It is a busy day in the world of Microsoft security.

In most Web attacks, malware is downloaded to victims' machines from a malicious or a compromised server. However, a researcher has uncovered a new attack vector where the malicious file is downloaded without actually being uploaded anywhere.

On Monday, a group of hackers posted a message on Pastebin claiming they have "hacked" nearly 7 million Dropbox accounts. The cloud storage giant said the data was stolen from other services, not from its own systems.

Attackers exploited a zero-day vulnerability in Windows to spy on NATO, the European Union, Poland, Ukraine, private energy organizations, and European telecommunications companies, according to cyber-intelligence firm iSight Partners.

WASHINGTON, D.C. - MIRCON - Organizations understand the importance of incident response planning, but they remain woefully unprepared when it comes to giving investigators the information they need to deal with a breach.

In recent years, point-of-sale (PoS) systems have become a point of emphasis for attackers looking to steal credit and debit card information.

SAN FRANCISCO - The head of the agency entrusted to essentially run the Internet said Monday that the group is on course to break free of US oversight late next year.

Polycom has published a security advisory listing several products that are vulnerable to the recently disclosed GNU Bash vulnerability dubbed "ShellShock."

The Oregon Employment Department (OED) is working with law enforcement to investigate an incident that caused the department to temporarily shut down a service used by job seekers. According to the department, an anonymous tip alerted OED to a security vulnerability affecting the WorkSource Oregon Management Information System (WOMIS), an application used by customers to register for job search help and other services.

Cybercriminals are expanding the Linux botnet dubbed "Mayhem" by leveraging the recently discovered vulnerabilities in the GNU Bash shell, according to researchers.

MOSCOW - US fugitive Edward Snowden, who was granted asylum by Moscow after revealing the extent of US global surveillance, has been reunited with his girlfriend in Russia, his lawyer said Saturday. Snowden's longtime partner, American dancer Lindsay Mills, joined him in Moscow in July, it emerged Friday.

Several sophisticated threat groups have breached the systems of a major critical manufacturing company, the Department of Homeland Security (DHS) revealed last week in a report.

The past decade of Cybersecurity has been relentlessly focused on stopping threats at the network edge. The implicit assumption of this approach is that the interior of your network is a trusted zone, and everything outside is untrusted. With this idea in mind, vendors began offering more and more ways to scan traffic at this logical boundary, attempting to detect known threats and hopefully taking some type of blocking action against them.

View the ICS Cyber Security Conference mobile app