Content by Jeremy Kirk

How a Big Rock Revealed a Tesla XSS Vulnerability

Jeremy Kirk  •  July 16, 2019

Software vulnerabilities sometimes have an uncanny knack of revealing themselves, even when a bug hunter is looking someplace else. Sam Curry's probing eventually revealed a cross-site scripting flaw in a Tesla service, which netted him a $10,000 bounty.

The Future SOC: Harmonizing Detection and Response

Jeremy Kirk  •  July 12, 2019

The success of security operations centers will depend on how well they blend key technologies - including detection, user behavior analytics and orchestration, says Haiyan Song of Splunk, who offers strategic insights.

Apple Issues Silent Update to Remove Old Zoom Software

Jeremy Kirk  •  July 11, 2019

Apple has taken an extraordinary move to protect its users from a yet-to-be-disclosed vulnerability that could compromise Macs that have the Zoom video conferencing software installed. It released a silent update to remove a vulnerable left-behind local web server, which likely has a remote code execution flaw.

Zoom Reverses Course, Removes Local Web Server

Jeremy Kirk  •  July 10, 2019

Video conferencing vendor Zoom has opted to make major changes to its Mac application after a security researcher found several weaknesses in it. The changes come after the researcher refused a bug bounty and instead went public after 90 days, putting pressure on Zoom.

Threat Intelligence: Why Sharing Is Difficult

Jeremy Kirk  •  July 9, 2019

Cyber adversaries are resilient and move quickly, so it'st critical that organizations share threat intelligence in an automated way, says Shawn Henry of CrowdStrike Services. But that sharing has been hampered by a lack of understanding of why it's important and how organizations can benefit, he says.

Mozilla Nominated for 'Internet Villain' by Angry ISPs

Jeremy Kirk  •  July 5, 2019

Together with President Donald Trump and the EU Copyright Directive, the U.K's Internet Services Providers' Association has nominated Mozilla as one of its three nominees for "internet villain" of the year. Its purported crime has been to advance a more secure version of the domain name system.

Automated Peril: Researchers Hack 'Smart Home' Hubs

Jeremy Kirk  •  July 4, 2019

Findings from researchers who hacked Croatia-based vendor Zipato's smart hub controllers, which can manage networked locks, lights and security cameras, underscore the risks that can accompany home automation devices. "Smart home" vendor Zipato says it's fixed the flaws.

D-Link Settles With FTC Over Alleged IoT Security Failures

Jeremy Kirk  •  July 3, 2019

D-Link has reached a proposed settlement with the U.S. Federal Trade Commission, which alleged the IoT device developer left consumers vulnerable to hackers through inadequate security practices. The terms of the settlement may serve as a warning to IoT makers to get their security checks in order.

Italy Fines Facebook $1 Million Over Cambridge Analytica

Jeremy Kirk  •  July 1, 2019

Italy's data protection regulator has slapped a $1 million fine on Facebook for mismanaging user data and precipitating the Cambridge Analytica debacle. But that pales by comparison to the the fine that's reportedly still being weighed by the U.S. Federal Trade Commission.

Report: Huawei's Firmware Riddled With Problems

Jeremy Kirk  •  June 28, 2019

The firmware of more than 500 Huawei networking products is riddled with security weaknesses that make the vendor risky to use for 5G networks, a new report contends. The study analyzed more than 9,000 firmware images in 558 enterprise products from the Chinese company.

Cloud Hopper: Major Cloud Services Victims Named

Jeremy Kirk  •  June 27, 2019

Six major cloud services providers apparently were victims of Cloud Hopper, an umbrella name for deep cyber intrusions suspected to originate in China, Reuters reports. The report also alleges Cloud Hopper-affected companies withheld information from their clients for reasons of liability and bad publicity.

Cloudflare Criticizes Verizon Over Internet Outage

Jeremy Kirk  •  June 26, 2019

Cloudflare was unsparing in its criticism of Verizon over a BGP snafu that hampered 15 percent of its global traffic, as well as traffic of Amazon and Google. Verizon's error underscores that much heavy lifting remains to make critical internet infrastructure secure.

DHS: Conflict With Iran Could Spur 'Wiper' Attacks

Jeremy Kirk  •  June 24, 2019

Iran is increasing its malicious cyber activity against the U.S, which could manifest in attacks that render computers unusable, a top U.S. cybersecurity official says. The warning comes after the U.S. reportedly targeted Iranian computer systems in response to the downing of a surveillance drone.

Instagram Shows Kids' Contact Details in Plain Sight

Jeremy Kirk  •  June 14, 2019

Tens of thousands of minors on Instagram expose their email addresses and phone numbers, which child-safety and privacy experts say is worrisome. The kids have turned their profiles from personal ones to business ones, which Instagram mandates must have contact details. But is that appropriate for a child?

OK Computer: Did Radiohead Get Hacked?

Jeremy Kirk  •  June 12, 2019

Hacking and extortion attempts against organizations have unfortunately become all too commonplace these days. On Tuesday, an unlikely victim went public: the British band Radiohead. But was the band really a hacking and extortion victim?