Lucian Constantin

CSO Senior Writer

Lucian Constantin writes about information security, privacy, and data protection for CSO.

Cobalt cybercrime group might be launching Magecart skimming attacks

Cobalt cybercrime group might be launching Magecart skimming attacks

Researchers link Magecart-based skimming attacks to Cobalt (a.k.a. Carbanak), whose cyber attacks have netted millions of dollars.

Chinese cyberespionage group PKPLUG uses custom and off-the-shelf tools

Chinese cyberespionage group PKPLUG uses custom and off-the-shelf tools

A previously unknown group or collective associated with China is targeting victims in Asia, possibly for geopolitical gain.

Magecart web skimming group targets public hotspots and mobile users

Magecart web skimming group targets public hotspots and mobile users

IBM researchers discover new Magecart scripts suggest planned advertisement injection through Wi-Fi and supply chain attacks.

Secrets of latest Smominru botnet variant revealed in new attack

Secrets of latest Smominru botnet variant revealed in new attack

Researchers gained access to a Smominru command-and-control server to get details on compromised devices and scope of the attack.

Misconfigured WS-Discovery in devices enable massive DDoS amplification

Misconfigured WS-Discovery in devices enable massive DDoS amplification

Researchers were able to achieve amplification rates of up to 15,300%. Some mitigations are possible.

What is PSD2? And how it will impact the payments processing industry

What is PSD2? And how it will impact the payments processing industry

The EU’s revised Payment Services Directive (PSD2), which include multifactor authentication for online European payment card transactions, will have a ripple effect on the payments processing industry in the U.S. and elsewhere.

New NetCAT CPU side-channel vulnerability exploitable over the network

New NetCAT CPU side-channel vulnerability exploitable over the network

NetCAT takes advantage of Intel DDIO technology to remotely execute keystroke timing attacks.

SMS-based provisioning messages enable advanced phishing on Android phones

SMS-based provisioning messages enable advanced phishing on Android phones

Attackers can use this vulnerability to send highly credible phishing messages. Victims' internet traffic is then routed through the attacker's proxy.

Insecure virtual USB feature in Supermicro BMCs exposes servers to attack

Insecure virtual USB feature in Supermicro BMCs exposes servers to attack

Security researchers have found a way to attach virtual USB devices remotely to Supermicro servers, including over the internet, by abusing a feature in their baseband management controller software.

What is Wireguard? Secure, simple VPN still in development

What is Wireguard? Secure, simple VPN still in development

The Wireguard VPN offers better performance and a simpler, effective approach to cryptography. Is it ready for the enterprise?

More critical Remote Desktop flaws expose Windows systems to hacking

More critical Remote Desktop flaws expose Windows systems to hacking

Microsoft finds and fixes multiple RDS and RDP vulnerabilities in Windows, but new research on BlueKeep patch rates suggests many machines could remain exposed.

ICS security: Popular building management system vulnerable to takeover

ICS security: Popular building management system vulnerable to takeover

Remotely exploitable vulnerability in internet-connected devices gives attackers a means to cause disruption and damage in a wide range of industries.

Popular Avaya enterprise VoIP phones are vulnerable to hacking

Popular Avaya enterprise VoIP phones are vulnerable to hacking

Attackers can use the vulnerability to gain complete control of the phone. It underscores the risks of using old open-source code in IoT devices.

New Spectre-like CPU vulnerability bypasses existing defenses

New Spectre-like CPU vulnerability bypasses existing defenses

The SWAPGS vulnerability can allow attackers to access contents of kernel memory addresses. Microsoft and Intel have coordinated on a mitigation.

Critical VxWorks flaws expose millions of devices to hacking

Critical VxWorks flaws expose millions of devices to hacking

Researchers have found 11 serious vulnerabilities in VxWorks, the world's most popular real-time operating system (RTOS) that powers over 2 billion devices including enterprise network firewalls and routers, industrial controllers and...

11 top DEF CON and Black Hat talks of all time

11 top DEF CON and Black Hat talks of all time

Hacker summer camp in Vegas is almost upon us again. Here are some of the best talks of all time. Will this year's talks measure up to these legends?

31 hardware and firmware vulnerabilities: A guide to the threats

31 hardware and firmware vulnerabilities: A guide to the threats

Meltdown and Spectre raised the alarm over vulnerabilities that attackers can exploit in popular hardware and its firmware. Here's a roundup of the ones that present the most significant threats.

Companies with zero-trust network security move toward biometric authentication

Companies with zero-trust network security move toward biometric authentication

According to new research, more companies are enabling biometric authentication on devices to verify access requests.

What is adware? How it works and how to protect against it

What is adware? How it works and how to protect against it

Adware is deceptive software that earns its creators money through fraudulent user clicks. Fortunately, it's one of the the most detectable types of malware.

OpenSSH to protect keys in memory against side-channel attacks

OpenSSH to protect keys in memory against side-channel attacks

The new OpenSSH patch makes it harder to execute attacks such as Spectre, Meltdown, Rowhammer and Rambleed.

Load More