Use of Insufficiently Random Values in penggle:kaptcha

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random rather than SecureRandom function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictio...

Threat Hunting: Adoption, Expertise Grow, but Work Remains

Threat hunting, an often misunderstood but powerful security practice, is gaining traction, as more organizations reap benefits from it and get better at it. However, there is still a lot of room for adoption to increase and for practices to improve. Those were key findings from the SANS...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...

California, U.S. Government Battle Over Net Neutrality State Law

The U.S. government and the state of California are butting heads over a newly-passed state law that enforces net neutrality regulations on internet service providers ISPs. And experts say that the outcome of the feud between federal and state law has long-standing implications for the future of...

Browser Extensions: Are They Worth the Risk?

Popular file-sharing site Mega.nz is warning users that cybercriminals hacked its browser extension for Google Chrome so that usernames and passwords submitted through the browser were copied and forwarded to a rogue server in Ukraine. This attack serves as a fresh reminder that legitimate browse...

Partnering with the industry to minimize false positives

Every day, antivirus capabilities in Windows Defender Advanced Threat Protection Windows Defender ATP protect millions of customers from threats. To effectively scale protection, Windows Defender ATP uses intelligent systems that combine multiple layers of machine learning models, behavior-based...

Protecting the protector: Hardening machine learning defenses against adversarial attacks

Harnessing the power of machine learning and artificial intelligence has enabled Windows Defender Advanced Threat Protection Windows Defender ATP next-generation protection to stop new malware attacks before they can get started often within milliseconds. These predictive technologies are central...

Black Hat 2018: Google’s Tabriz Talks Complex Security Landscapes

LAS VEGAS – The complexity of the cybersecurity landscape is at an all-time high, with security researchers, vendors, third-party ecosystems and even governments all trying to come to a consensus for making the cyber-world a safer place. For security experts, navigating these choppy and crowded...

Partner Perspectives: Security Orchestration as a Catalyst for Proactive Incident Response

Meny Har is the VP of Product for Siemplify. Benjamin Franklin famously advised the fire-threatened residents of Philadelphia, “An ounce of prevention is worth a pound of cure.” And while being proactive may have been effective for fire prevention, the approach does not translate into the impendi...

Keeping False Positives in Check

In 2017, seven out of ten organizations said their security risks increased significantly, according to a Ponemon Institute study. This is no surprise given that last year organizations suffered the largest ransomware outbreak in history WannaCry and vulnerabilities such as Meltdown and Spectre...

Perspectives of a former CISO: Disrupted security in digitalization

My passion is the connection of security to the business objectives, and it has been a part of my work with many CISOs across industries as well as my experience as a CISO. This blog series a compilation of my learnings as a CISO, as well as learnings from peers and customers who are actively...

Trend Micro a Leader in Forrester Wave Endpoint Security Report

The results are in from another independent analyst report and it’s great news for Trend Micro’s endpoint security. We achieved the highest score possible for the “strategy” category, were top ranked for “current offering” category, and among the second-highest scores in the market presence...

Default credentials

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

Design/Logic Flaw

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak...

Yin and Yang of the Zero Trust Model

It may seem strange to apply concepts from Chinese philosophy to an IT security model, but representing complex ideas in simple terms can be a powerful tool for understanding and communicating. By viewing zero trust through the lens of Yin and Yang, we see that to be complete, the scope of the...

Oracle Financial Services Applications Financial Services Basel Regulatory Capital Internal Ratings Based Approach component unauthorized operation vulnerability (CNVD-2018-11043 )

Oracle Financial Services Applications is a suite of financial services software from Oracle that combines core banking, online banking, and property management.Financial Services Basel Regulatory Capital Internal Ratings Based Approach is one of the components of the Basel Regulatory Capital...

Turning the Tables on Cyber Attackers

Today, Carbon Black joins the community of public companies NASDAQ: CBLK. While we are humbled and excited by this milestone, we also acknowledge there’s plenty of progress still to be made. For Carbon Black as a company and the industry as a whole, that progress starts with shifting the balance ...

Securing the Connected Industrial World with Trend Micro

At Trend Micro we’ve made it our business over the past 30 years to anticipate where technology is taking the world. That’s why our message has evolved over that time from Peace of Mind Computing to Your Internet Firewall and most recently Securing Your Journey to the Cloud. Well, we know that...

CVE-2018-2856

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications subcomponent: Portfolio, Attribution. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged...