Every quarter, Fortinet publishes a set of findings based on threat intelligence gathered from hundreds of Cyber Threat Assessments we have performed across the globe. This report provides analysis and insight into the threats we’ve experienced within certain industry segments and regions. This quarter’s report, published just this week, includes some interesting trends that every security professional ought to be reviewing in order to keep ahead of the ever-shifting threat landscape. Unprecedented Attack Volumes This past quarter,... [Read More]
by RSS Bill McGee  |  Sep 26, 2016  |  Filed in: Industry Trends
Last week, the Internet Systems Consortium (ISC) released a critical update to its popular software, BIND. BIND is almost everywhere on the Internet, acting as a DNS name server. DNS is a network service used to translate human-readable domain names to numeric identifiers called IP addresses and vice-versa. The update was in response to a recently discovered DoS vulnerability (CVE-2015-5477), which can be exploited to take down the vulnerable BIND server remotely. ISC released an urgent patch for this vulnerability due to its severity. Only... [Read More]
by RSS Dehui Yin  |  Aug 12, 2015  |  Filed in: Security Research
If the Point of Sale (POS) system in your retail business is still running on an older operating system, e.g., Microsoft Windows XP or anything else pre-Win 7, there are a number of compelling reasons why it's long past time to change that. And while most of these reasons are gotchas, there are also positive reasons. Newer systems are simply richer in features and easier to use. It's understandable that businesses want to hang onto systems that are still working and that employees are familiar with. But it's a bad idea that will... [Read More]
by RSS Daniel Dern  |  May 07, 2015  |  Filed in: Industry Trends
Microsoft announced today that an attacker or attackers are exploiting a previously known exploit in virtually all versions of Internet Explorer. Microsoft has released an out of bound Fix-It patch for users to implement as soon as possible while they work on a permanent fix. The exploit is CVE-2013-3893 and allows an attacker to execute code remotely - this means that simply by visiting a hacked or malicious website, you will likely have malware installed on your system. To install the Fix-It patch, visit this page. Simply click on the "Enable... [Read More]
by RSS Richard Henderson  |  Sep 17, 2013  |  Filed in: Industry Trends
Patch management is as fundamental to your security posture and health of your network as changing the oil on your car. It's also as easy to overlook until it's too late. Simply defined, patch management is the process of repairing security flaws and vulnerabilities found in various IT infrastructure discovered after the components have been released on the market. Organizations with dedicated IT management and security teams sport network administrators that oversee patch distribution and other management activities via Web-based interface. A... [Read More]
by RSS Stefanie Hoffman  |  Jul 16, 2013  |  Filed in: Industry Trends
Oracle published an announcement today that a large update to their Java platform this coming Tuesday. Forty vulnerabilities are set to be patched with Tuesday's patch, of which almost all of them can be exploited remotely without a username or password. Oracle said that "[d]ue to the threat posed by a successful attack, [we] strongly recommend that customers apply Critical Patch Update fixes as soon as possible." This patch affects: - JDK and JRE 7 Update 21 and earlier - JDK and JRE 6 Update 45 and earlier - JDK and JRE 5.0 Update 45 and earlier -... [Read More]
by RSS Richard Henderson  |  Jul 30, 2012  |  Filed in: Industry Trends
Tags: oracle java patch
Microsoft released bulletin MS09-067 on Nov 10, 2009. Same as in 2008, this last bulletin for Microsoft Office Excel in 2009 gives a total number of 17 vulnerabilities for this popular product. As the biggest contributor, Fortinet is credited for seven of these vulnerabilities in 2009. Our topic today is the vulnerability referred as CVE-2009-3127. It is one of the eight vulnerabilities that were fixed in Bulletin MS09-067. I found this vulnerability by fuzzing (automatic crafted files creation) in April and when I analyzed it I found it is different... [Read More]
by RSS Bin Liu  |  Jan 06, 2010  |  Filed in: Security Research