Dark Reading Daily -- June 10, 2020

Vulnerability in Plug-and-Play Protocol Puts Billions of Devices at Risk

"CallStranger" flaw in UPnP allows attackers to launch DDoS attacks and scan internal ports, security researcher says.

Hack-for-Hire Firm Connected to Attacks on Nonprofits, Journalists

The Dark Basin group behind thousands of phishing and malware attacks is likely an India-based "ethical hacking" firm that works on behalf of commercial clients.

Microsoft Fixes 129 Bugs in Largest Patch Tuesday Release

The June release of security updates addresses several remote code execution vulnerabilities in SharePoint, Excel, Windows OLE, and other services.

Will Vote-by-App Ever Be Safe?

Even with strong security measures, Internet voting is still vulnerable to abuse from state-sponsored actors and malicious insiders.

DHS Warns on New Exploit of Windows 10 Vulnerability

The vulnerability was patched in March, but a new proof of concept raises the stakes for organizations that haven't yet updated their software.

Honda Pauses Production Due to Cyberattack

The attack reportedly infected internal servers and forced Honda to halt production at plants around the world on Monday.

COVID-19: Latest Security News & Commentary

Check out Dark Reading's updated, exclusive news and commentary surrounding the coronavirus pandemic.

Many Exchange Servers Are Still Vulnerable to Remote Exploit

A privilege-escalation vulnerability patched in February by Microsoft continues to affect Exchange servers, with more than 80% of Internet-connected servers remaining vulnerable, one firm reports.

New 'Tycoon' Ransomware Strain Targets Windows, Linux

Researchers say Tycoon ransomware, which has targeted software and educational institutions, has a few traits they haven't seen before.

Q&A: Eugene Spafford on the Risks of Internet Voting

Allowing people to cast their ballots online to circumvent coronavirus-related health concerns introduces problems that we simply don't know how to manage, says the Purdue University professor and security leader.

EDITORS' CHOICE

What Usability Means to Security Pros

The last thing cybersecurity executives and practitioners need are even more tools that are difficult to operate. Here's what they look for when assessing new tools.

CSO's Guide to 'Employee-First' Security Operations During COVID-19 & Beyond

As the work-at-home environment continues to inform new ways of doing business, it's important that security teams remain flexible and ready for change.

NEW FROM THE EDGE

Name That Toon: Sign of the Tides

Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

How Cybersecurity Incident Response Programs Work (and Why Some Don't)