ITS Information Security Bulletins http://blog.case.edu/its-security/ en-us Wed, 16 Jul 2008 11:12:08 EST Wed, 16 Jul 2008 11:12:08 EST thomas.siu@case.edu thomas.siu@case.edu http://blogs.law.harvard.edu/tech/rss Movable Type v3.121 Spear Phish Phry http://blog.case.edu/its-security/2008/07/16/spear_phish_phry A new spear phish has graced the inboxes of various Case users with a spoofed return address of 'case-daily AT... http://blog.case.edu/its-security/2008/07/16/spear_phish_phry case cwru Case Western Case Western Reserve University IT Security Wed, 16 Jul 2008 11:12:08 EST A new spear phish has graced the inboxes of various Case users with a spoofed return address of 'case-daily AT case.edu'. The Case Daily site messages are media rich, so users should not be fooled by this simple text email. This message has evaded spam filtering mechanisms.

As with most phish messages, this one also attempts to direct users to email their password and reply via email.

The savvy Case User knows that ITS will never ask for such information.
Please continue to report any phishing events to the Case Help Desk.

]]> New Science Phishing http://blog.case.edu/its-security/2008/07/07/new_science_phishing The Case mailing lists server received a phishing scam message from an entity spoofing themselves to be Elsevier with a... http://blog.case.edu/its-security/2008/07/07/new_science_phishing case cwru Case Western Case Western Reserve University IT Security Mon, 07 Jul 2008 08:36:39 EST The Case mailing lists server received a phishing scam message from an entity spoofing themselves to be Elsevier with a "Call for Papers" in the subject line. If you are a mailing list subscriber with an open list on the server, you may have received the bogus message with these keywords:

*ELSEVIER:*

*BUILDING INSIGHTS; BREAKING BOUNDARIES*

*MANUSCRIPTS SUBMISSION*

The spoofed message is gathering technical papers and asking for documents to be sent to an email address ending with "...@live.co.uk"

The real Elsevier does not solicit publications via email, and their email address ends with "...@elsevier.com."

Unlike the general phishing messages that are trying to dupe users into giving up sensitive information (e.g. userID and passwords), this phish will likely land the user on a spam list of persons with research interests.

As ususal, phish can be reported to pirt@castlecops.com or simply used to tune your spam filters.

]]> Apple Releases New Security Update http://blog.case.edu/its-security/2008/07/01/apple_releases_new_security_update Apple released a new security update today, 2008-004, that covers a range of security issues with both OS-X 10.4 and... http://blog.case.edu/its-security/2008/07/01/apple_releases_new_security_update Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Tue, 01 Jul 2008 15:15:21 EST Apple released a new security update today, 2008-004, that covers a range of security issues with both OS-X 10.4 and 10.5.

Mac users are advised to update operating systems via the Software Update function as soon as practicable.

The Apple Article HT2163 provides additional details.

]]> Adobe Flash Vulnerability Warrants Prompt User Action http://blog.case.edu/its-security/2008/05/29/adobe_flash_vulnerability_warrants_prompt_user_action Adobe has been investigating an active Zero-Day exploit of the Adobe Flash Player (see Adobe's PSIRT blog for details). According... http://blog.case.edu/its-security/2008/05/29/adobe_flash_vulnerability_warrants_prompt_user_action case cwru Case Western Case Western Reserve University IT Security Thu, 29 May 2008 08:49:02 EST Adobe has been investigating an active Zero-Day exploit of the Adobe Flash Player (see Adobe's PSIRT blog for details). According to the SANS Internet Storm Center, compromised web sites are hosting maliciously crafted Adobe Flash files (SWF files) that exploit the vulnerability. Getting exploited may result in your user desktop becoming a 'bot, getting a root-kit, or worse (ransom-ware). Apparently,

Due to the significant use of Adobe Flash in many academic and research pursuits, Case users are strongly encouraged to immediately update to the latest version of Adobe Flash, v. 9.0.124.0.

For Mac users, the Apple Security Update 2008-03, released May 28, 2008, includes this update. Running the Software Update from the System Preferences panel will address this vulnerability, along with a number of other fixes that have been bundled into this software udpate.

Overall protection of the browser is the high-level recommendation to prevent the casual compromise of a user workstation due to web browsing. The SANS Institute recommends some simple configuration fixes that would prevent such an exploit:
* In Firefox, you can use either of the following add-ons, NoScript (one of our favorites, found here or here) or FlashBlock (here or here).
* In IE, see here for how to set the "killbit", the CLSID is BD96C556-65A3-11D0-983A-00C04FC29E36.

The US-CERT provides some great guidelines for Browser Security which Case recommends for all users.

]]> SSH Attacks on Unix Systems http://blog.case.edu/its-security/2008/05/22/ssh_attacks_on_unix_systems According to SANS News Bytes, brute force secure shell (SSH) attacks have increased significantly over the last two weeks. "An... http://blog.case.edu/its-security/2008/05/22/ssh_attacks_on_unix_systems case cwru Case Western Case Western Reserve University IT Security Thu, 22 May 2008 09:13:20 EST According to SANS News Bytes, brute force secure shell (SSH) attacks have increased significantly over the last two weeks. "An SSH attack is a type of dictionary attack that aims to guess secure shell client usernames and passwords." On Monday, May 12, statistics from denyhosts.net indicated close to 10,000 SSH attacks; normally that figure would be 2,000. Some of the attacks were coming through botnets so attackers could stay beneath detection thresholds; others were using a "low and slow" approach to avoid detection and locking out accounts. We have noticed the same uptick.

Case Unix admins and Linux users are advised to review their SSH logs and report any attempted exploits, successful or not, to the Case Help Desk, 368-HELP.

The SANS Internet Storm Center (ISC) provides specific guidance on how to protect their systems (the first url below).
-http://isc.sans.org/diary.html?storyid=4408
-http://www.scmagazine.com/uk/news/article/809222/brute-force-ssh-attacks-surge/
-http://www.securityfocus.com/news/11518

]]> Phish Kits Impact .edu http://blog.case.edu/its-security/2008/05/07/phish_kits_impact_edu An increasing number of phishing events are being propagated at university users around the country. Case has received several in... http://blog.case.edu/its-security/2008/05/07/phish_kits_impact_edu Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Wed, 07 May 2008 19:31:30 EST An increasing number of phishing events are being propagated at university users around the country.

Case has received several in the past few weeks. As usual, keep in mind the modus operandi is to collect your credentials (userID and password). These items are Tier III information and should not be disclosed to anybody.

Case will never ask you for such information, especially via email. Email is like a postcard. You should never send sensitive information via email.

]]> Account Termination Policy Changes http://blog.case.edu/its-security/2008/04/30/account_termination_policy_changes The new Case Account Closure Policy was approved in early April 2008, and it specifies a change in processes for... http://blog.case.edu/its-security/2008/04/30/account_termination_policy_changes Practices case cwru Case Western Case Western Reserve University IT Security Wed, 30 Apr 2008 13:50:03 EST The new Case Account Closure Policy was approved in early April 2008, and it specifies a change in processes for account closure when faculty, staff, and students leave Case Western Reserve University.

The new practice involves a closure of network accounts within one business day of termination of employment status. This window applies to faculty and staff. Students will retain their current 180-day grace period. The policy has been coordinated with HR procedures and defines the extent of IT privileges based on the individual's relationship with the University.

Supervisors and managers are advised to take notice of the changes, and coordinate in advance when staff depart. Once accounts are closed, no incoming email or access is available for that terminated staff. The use of a mailing list alias at lists.case.edu is recommended for ensuring the consistency of incoming email communications.

]]> New Phish- April 17, 2008 http://blog.case.edu/its-security/2008/04/18/new_phish_april_17_2008 A new phishing message is making its way to Case users: "IMPORTANT NOTICE FROM THE CWRU SUPPORT TEAM" The message... http://blog.case.edu/its-security/2008/04/18/new_phish_april_17_2008 case cwru Case Western Case Western Reserve University IT Security Fri, 18 Apr 2008 08:47:24 EST A new phishing message is making its way to Case users:

"IMPORTANT NOTICE FROM THE CWRU SUPPORT TEAM"

The message purports to ask users for passwords to, "...secure from Hacker."

Users should delete the message or use the techniques to forward the message to the Phishing Incident Response Team (PIRT) at castlecops.com.

]]> Security Update: April 8 http://blog.case.edu/its-security/2008/04/08/security_update_april_8 Case users are reminded about three security updates events today. Applications, such as Adobe Acrobat or Flash, are not updated... http://blog.case.edu/its-security/2008/04/08/security_update_april_8 Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Tue, 08 Apr 2008 17:07:00 EST Case users are reminded about three security updates events today. Applications, such as Adobe Acrobat or Flash, are not updated by means of Microsoft Windows Update, so users need to take extra steps to protect their machines and systems from some current threats.

1. The Adobe Flash viewer, a core component to many media rich applications such as YouTube and AdobeConnect, has a security update according to US CERT. This has a large potential impact due to the high incidence of Case users accessing Flash-based content, and affects all operating systems.

2. An update to the Adobe Acrobat is available to address a security vulnerability in version 8.0. This vulnerability could result in remote code execution if a victim opens a specially crafted Adobe Acrobat (.pdf) document in an affected version of Adobe Reader or Adobe Acrobat. Case users can upgrade to 8.1.2 to patch this vulnerability.

3. Microsoft Patch Tuesday: Micosoft today released 8 new updates, 5 of which are deemed by the vendor to be critical in nature.

That old GDI vulnerability is back as well.

Users should run Microsoft software updates immediately. Happy Patching!

]]> Spear Phishing Season http://blog.case.edu/its-security/2008/03/17/spear_phishing_season The month of march seems to be 'spear phishing season' for Case and other universities, which may be a variant... http://blog.case.edu/its-security/2008/03/17/spear_phishing_season case cwru Case Western Case Western Reserve University IT Security Mon, 17 Mar 2008 16:57:07 EST The month of march seems to be 'spear phishing season' for Case and other universities, which may be a variant of March Madness.

Today some Case users received a "Dear Webmail Subscriber..." email message from an address called 'support case.edu' that is a fraudulent email requesting users to send their userID and password.

Users should disregard this message, or call the Case Help Desk at 368-HELP to request further assistance.

Read on to see and example of the message.

]]> Phishing Emails March 5, 2008 http://blog.case.edu/its-security/2008/03/05/phishing_emails_march_5_2008 Case users today received a fraudulent email message which constitutes a phishing scam. This scam is an attempt trick users... http://blog.case.edu/its-security/2008/03/05/phishing_emails_march_5_2008 Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Wed, 05 Mar 2008 16:51:20 EST Case users today received a fraudulent email message which constitutes a phishing scam. This scam is an attempt trick users to provide userid/passwords to the criminals who will use your account to log into the Case web email service and further spam the university.

This scam has been weaving its way around other universities worldwide and appears to originate from other countries, but the phish received by case users today was from a host at another university. People who have responded to the phish in other universities have had their accounts used by the attackers within minutes of becoming victims.

If you were taken in by this scam and sent your CaseID and Password to the return address, please immediately notify the Case Help Desk (http://help.case.edu) you will need to change your Case password immediately with the Case Password Change Utility. Users also need to check their secret questions, which can be changed by someone with your password.

Users are reminded that Case will never request such information via email, and commend all those many users who have recognized the 'phishyness' of the message and forwarded these messages to our attention.


]]> Super Patch Tuesday http://blog.case.edu/its-security/2008/02/13/super_patch_tuesday Yesterday Microsoft released a series of patches for 11 Windows vulnerabilities, which included 6 critical vulnerabilities. The most critical are... http://blog.case.edu/its-security/2008/02/13/super_patch_tuesday Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Wed, 13 Feb 2008 16:35:46 EST Yesterday Microsoft released a series of patches for 11 Windows vulnerabilities, which included 6 critical vulnerabilities. The most critical are the three related to the Internet Explorer 7 browser. The risk of remote code execution is definitely the elephant in the room for these updates, so users who are not on Automatic Updates need to take heed.

Note that the recently Tier I baseline controls require security updates to be applied in a timely fashion. Thes are best applied in the form of Automatic Updates of the operating system. Case users are advised to apply these updates immediately.

Some common applications are not typically updated when the operating system updates are applied, so Case users need to be diligent in addressing vulnerabilities in major applications. Applications pertinent to Case users that also require current updates this week are:

Adobe Acrobat Reader version 8.1.2 has updates for all operating systems.

Apple's iPhoto
for the MacOS and QuickTime
for all operating systems.

]]> Tier I Controls in Final Draft http://blog.case.edu/its-security/2008/01/20/tier_i_controls_in_final_draft The Case Tier I Information baseline security configurations are in final draft phase. The listing can be found at the... http://blog.case.edu/its-security/2008/01/20/tier_i_controls_in_final_draft Practices case cwru Case Western Case Western Reserve University IT Security Sun, 20 Jan 2008 16:45:57 EST The Case Tier I Information baseline security configurations are in final draft phase. The listing can be found at the Information Technology Policy Site under "Standard network host configurations for Tier I information".

These controls are the baseline suite for all information tiers, and are the most risk tolerant. As information sensitivity increases, (Tier III is the highest) the controls add increasing depth to assure information confidentiality. Tier II and III controls are built upon these Tier I controls, and thus Tier I controls apply to all networked hosts in the Case environment.

The implementation phase will begin with all new hosts registered in the network, and administrators will be contacted for random audits of hosts in their areas. A majority of the managed environments meet these standards at present.

]]> Microsoft Critical Patch Update http://blog.case.edu/its-security/2008/01/08/microsoft_critical_patch_update Today Microsoft released two system software updates, one of which is rated as a critical severity. The MS08-001: "Vulnerabilities in... http://blog.case.edu/its-security/2008/01/08/microsoft_critical_patch_update Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Tue, 08 Jan 2008 14:17:52 EST Today Microsoft released two system software updates, one of which is rated as a critical severity.

The MS08-001: "Vulnerabilities in Windows TCP/IP Could Allow Remote Code
Execution (941644)" is the first Microsoft vulnerability of the calendar year. This permits remote exploit of the host computer, and affects all versions of Windows 2000, Windows XP, Windows Vista, and Windows Server 2003.

Users are advised to apply the updates immediately.

]]> Network Quarantine Process Revision http://blog.case.edu/its-security/2007/10/20/network_quarantine_process_revision Case ITS has revised the Network Quarantine Process workflow, and users are advised to take notice of the changes. In... http://blog.case.edu/its-security/2007/10/20/network_quarantine_process_revision case cwru Case Western Case Western Reserve University IT Security Sat, 20 Oct 2007 09:20:27 EST Case ITS has revised the Network Quarantine Process workflow, and users are advised to take notice of the changes. In the case of a computer that is quarantined, the Case Help Desk will call and send email to the registered owner. If the owner has not responded to the Help Desk notifications within 30 days of the quarantine, the computer will be permanently removed from the network.


To restore network services, a full security assessment and configuration mitigation of the host will be necessary. Upon determination that the system is clean of malware and the user is aware of safe computing practices, the system will receive network service after payment of a $100.00 return-to-service fee. This fee covers the additional resource usage incurred in reconnecting a host.

This change is effective November 8, 2007.

The driver for this change is that users have been unresponsive to Help Desk calls to address quarantined systems, and thus we have network availability outages. This is especially a problem for multiple users who use the same network faceplate (e.g. roommates). The availability of the CaseGuest wireless infrastructure also is seen as a cause for users to ignore the quarantine process.

]]>