ITS Information Security Bulletins http://blog.case.edu/its-security/ en-us Wed, 24 Nov 2010 13:33:55 EST Wed, 24 Nov 2010 13:33:55 EST thomas.siu@case.edu thomas.siu@case.edu http://blogs.law.harvard.edu/tech/rss Movable Type v3.121 Information Security Has Moved http://blog.case.edu/its-security/2010/11/24/information_security_has_moved The CWRU Information Security Site has moved to the new ITS site. Please follow the link to the new site... http://blog.case.edu/its-security/2010/11/24/information_security_has_moved Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Wed, 24 Nov 2010 13:33:55 EST The CWRU Information Security Site has moved to the new ITS site.

Please follow the link to the new site > http://www.case.edu/its/infosec/


Articles pertaining to information security in higher education will be moved to the new Blogger site and announcements for future topics will move to the ITS Announcements feed.

Older entries will remain available at the blog archive.

]]> Adobe Flash Update Fixes 0-Day Exploit http://blog.case.edu/its-security/2010/06/13/adobe_flash_update_fixes_0day_exploit Adobe Systems has released an update last week to the popular Flash browser plug-in to address vulnerabilities that have been... http://blog.case.edu/its-security/2010/06/13/adobe_flash_update_fixes_0day_exploit case cwru Case Western Case Western Reserve University IT Security Sun, 13 Jun 2010 23:14:17 EST Adobe Systems has released an update last week to the popular Flash browser plug-in to address vulnerabilities that have been targeted by a "0-day" attack, as reported by the SANS Internet Storm Center. The exploits also affect Adobe Reader and Acrobat 9.1.2, which both use the Flash Player to animate videos embedded into PDF files.

Vulnerabilities in applications such as Adobe Acrobat and its related product line are not readily patched by operating system updates (such as Microsoft AutoUpdate), and represent an open pathway to computer exploit. According to the IBM X-Force 2009 Trend and Risk Report, the number one web-based exploit was against the Microsoft Office Web Components Spreadsheet ActiveX, and then then next 4 of the top 5 involved Adobe Acrobat, Adobe Reader, and Adobe Flash Player. The most pressing threat to the user is in malicious Flash videos or compromised web sites that use Flash for banners. Here is a Flash video from Symantec that explains the "drive-by" attack.

The university community makes extensive use of Adobe Flash, and this problem is significant in that it affects Windows, MacOS, and linux platforms. The Adobe Flash Player release version 10.1 is available and recommended for all users at the Adobe update site. Systems administrators are advised to plan to push an update as soon as you complete your testing of version 10.1.

]]> iPhone Software Update http://blog.case.edu/its-security/2010/02/06/iphone_software_update This past week Apple released a security update to the iPhone and iPod operating systems. This release addresses some key... http://blog.case.edu/its-security/2010/02/06/iphone_software_update Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Sat, 06 Feb 2010 06:49:08 EST This past week Apple released a security update to the iPhone and iPod operating systems. This release addresses some key security weaknesses in the way the iPhone and iPod processe mp4 audio files, maliciously crafted TIFF images, a problem in how FTP sites are navigated from the device, and a memory corruption issue which permits someone to bypass the device password when connected via the iPhone/iPod USB cable interface. These problems pose the risk of malicious attacks on user data via the devices. Details are avaialable from Apple.

The Information Security Office recommendation is to update your device to OS 3.1.3 as soon as possible. The user must connect to iTunes to complete the updates.

Note that we recommend user first update to the latest version of iTunes (9.0.3) before connecting the iPhone/iPod to update the device through iTunes.

]]> Phishing Scam and Password Interception http://blog.case.edu/its-security/2010/01/04/phishing_scam_and_password_interception A host of phishing attacks underway on the .edu domain, where phishers seeking to trip up users to divluging their... http://blog.case.edu/its-security/2010/01/04/phishing_scam_and_password_interception case cwru Case Western Case Western Reserve University IT Security Mon, 04 Jan 2010 15:07:46 EST A host of phishing attacks underway on the .edu domain, where phishers seeking to trip up users to divluging their userID and passwords. Case users should take heed of this video in composing and not disclosing their userID and passwords:

Users are still advised to notify the Case Help Desk with any messages that smell "phishy."

]]> Affiliate Accounts Return http://blog.case.edu/its-security/2009/12/08/affiliate_accounts_return Effective December 9, 2009, Affiliate Account processing has been returned to service. All affiliate accounts require an approved Case sponsor,... http://blog.case.edu/its-security/2009/12/08/affiliate_accounts_return case cwru Case Western Case Western Reserve University IT Security Tue, 08 Dec 2009 23:36:44 EST Effective December 9, 2009, Affiliate Account processing has been returned to service.

All affiliate accounts require an approved Case sponsor, so access to the affiliate request form requires a login with a valid Case Network ID and password.

We thank our customers for their patience while this process was fully reworked to improve the security needs of the university. The request process no longer requires sensitive personal information for the affiliate user. Sponsors can expect approximately 24-hours turn around time from request to account creation.

Additionally, the sponsor is still responsible for ensuring the affiliate user is in compliance with the Case Acceptable Use Policy.

]]> Affiliate Account Processing Suspended http://blog.case.edu/its-security/2009/11/23/affiliate_account_processing_suspended Until further notice, all affiliate account creation has been suspended. Information Technology Services staff are currently working to redesign and... http://blog.case.edu/its-security/2009/11/23/affiliate_account_processing_suspended case cwru Case Western Case Western Reserve University IT Security Mon, 23 Nov 2009 12:50:37 EST Until further notice, all affiliate account creation has been suspended.

Information Technology Services staff are currently working to redesign and deploy an updated process to create affiliate user accounts that does not require the gathering, storage, or maintenance of sensitive personally identifiable information for the account users. Affiliate account users are not current faculty, staff, or students at the university.

This necessary interruption in service has been driven by the security risk associated with handling sensitive information for non-employees, and to comply with recent updates to the University SSN Use Policy.

Questions about the process may be directed to Case Help Desk at 368-HELP (4357). Until a solution has been implemented, requests for affiliate account creation will be queued in the Help Desk.

]]> Password Reminders http://blog.case.edu/its-security/2009/11/09/password_reminders It is approximately one year ago, in November 2008, when Case's password change campaign began. Case faculty, staff, and students... http://blog.case.edu/its-security/2009/11/09/password_reminders Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Mon, 09 Nov 2009 23:31:17 EST It is approximately one year ago, in November 2008, when Case's password change campaign began. Case faculty, staff, and students who began changing their passwords at this time last year will be receiving their annual change notifications soon, via email. It is our sincere hope that users will recognize the "real thing" the flurry of phishing messages we receive.

If in doubt, users can check their password ages online at the Password Verification utility.

Case users should never send passwords or other sensitive information via email.

]]> SSN Abatement: Identity Finder Sessions http://blog.case.edu/its-security/2009/10/26/ssn_abatement_identity_finder_sessions The SSN Abatement program continues with additional Town Hall Meetings this week to learn about the use of Identity Finder.... http://blog.case.edu/its-security/2009/10/26/ssn_abatement_identity_finder_sessions case cwru Case Western Case Western Reserve University IT Security Mon, 26 Oct 2009 09:23:00 EST The SSN Abatement program continues with additional Town Hall Meetings this week to learn about the use of Identity Finder. Three of the meetings are online to permit staff from around campus to learn about the "why" and "how" of this campus-wide program from their desktops.

The online presentations are at 11:00 AM, Monday 10/26, Tuesday 10/27, and Wednesday 10/28 at

https://connect.case.edu/identity

A valid Case NetworkID and password are required to attend.

The next larger presentation is scheduled for 12:00, Thursday, 10/28, in the MSASS Mandel Center room 108.

Additional details can be found at http://securityaware.case.edu

]]> Security Awareness Month http://blog.case.edu/its-security/2009/10/16/security_awareness_month Information about Security Awareness Month activities are available at http://securityaware.case.edu. Case is unveiling a program to clean up old sensitive... http://blog.case.edu/its-security/2009/10/16/security_awareness_month case cwru Case Western Case Western Reserve University IT Security Fri, 16 Oct 2009 10:10:47 EST Information about Security Awareness Month activities are available at http://securityaware.case.edu. Case is unveiling a program to clean up old sensitive data from the working IT environment. Case CISO Tom Siu will present briefings on the "SSN Abatement" initiative throughout the month.

The first two Town Hall Meetings about the use of Identity Finder for campus users will be held today:

12:30 PM - 1:30 PM Strosacker Auditorium
3:00 PM - 4:00 PM Biomedical Research Building Room 105

]]> Successfully Phished Account Spawns Spam Attack http://blog.case.edu/its-security/2009/09/15/successfully_phished_account_spawns_spam_attack A large scale spam attack on Case mailing lists was successfully perpetrated in the early morning hours today. It appears... http://blog.case.edu/its-security/2009/09/15/successfully_phished_account_spawns_spam_attack Information Security Alerts case cwru Case Western Case Western Reserve University IT Security Tue, 15 Sep 2009 09:58:29 EST A large scale spam attack on Case mailing lists was successfully perpetrated in the early morning hours today. It appears that a Case user had their userID and password phished, and the attackers used the stolen credentials to launch a spam attack, with "Mailbox Upgrade" in the subject line and "...from our Helpdesk Team" in the message, which included a link to another phishing site.

Unfortunately, the spam also included the user's name as the sender's signature, and in the from: field.

If you mistakenly clicked on the phishing link, you should have received a message about this being a suspected phishing site.
phish_warning.jpg

This event highlights the need for end users to be extremely conscious of fraudulent communications. The university receives regular phishing attacks, but the magnitude is amplified when a single user is phished, and that user's account is used as the source of more spam and phishing messages.

]]> Phishers of What? http://blog.case.edu/its-security/2009/07/18/phishers_of_what It looks like phishing groups are doing their best to be more creative this summer, but fraud always looks like... http://blog.case.edu/its-security/2009/07/18/phishers_of_what case cwru Case Western Case Western Reserve University IT Security Sat, 18 Jul 2009 15:40:23 EST It looks like phishing groups are doing their best to be more creative this summer, but fraud always looks like fraud. A recent example of a phish received by Case users appears to be sent from an internal campus notice. However, because it asks for Restricted information, a key element Case will never request via email, the fraud is evident.

A recent attack at North Carolina State University described in the Chronicle of Higher Education illustrates how far thieves will go. In this case, they created a bogus web page to collect UserID and passwords from people. This is an interesting attack I've seen discussed in security circles, and even done as security tests. It is amazing to see that somebody actually tried it in the real world against a university. I recommend users of web-based email clients install the McAfee Site Advisor utility in their browsers. If you click on a link of questionable nature, this will alert you to what could be a potential drive-by attack (you browse to a malicous site or a site with hidden malicous content).

The question that remains is, how do we stop phishing? Perhaps if we plead,

"Yo, phisher dudes! Chill!"

No, I don't think that will work. Phishing is a type of sales cold call. If you answer it, you open the door to larger theft and online misuse that leads to bigger security problems. Case users certainly have received enough of them over the 2007-2009 timeframe that they have been well-educated by the experience.

I recommend two things for users to do when they get a phish message:

1. Report phishing
2. Tell your friends and colleagues.

We used to request that Case users send phishing messages to Castlecops, but with their demise in 2008, I recommend you report them directly to the US-CERT Phishing Group by sending email to phishing-report@us-cert.gov. Of course, please remember to view the full headers to make the message investigation possible.

There still seem to be unwary users in our community who fall victim to phishing, so I suggest users make this a conversation topic. What a way to break the ice, "Hey, did you get that latest phishing message from..."

When they become ineffective, the phish will cease.

]]> It's not just Patch Tuesday: It's SUPER Patch Tuesday! http://blog.case.edu/its-security/2009/06/10/its_not_just_patch_tuesday_its_super_patch_tuesday Not since the epic patch release of December of 2008 has Microsoft addressed so many vulnerabilities at one time: This... http://blog.case.edu/its-security/2009/06/10/its_not_just_patch_tuesday_its_super_patch_tuesday case cwru Case Western Case Western Reserve University IT Security Wed, 10 Jun 2009 21:56:59 EST Not since the epic patch release of December of 2008 has Microsoft addressed so many vulnerabilities at one time: This month's batch of security updates for Windows (Operating Systems and components) and Microsoft Office suites and software totals 31 individual patches.

Internet Explorer remains a particularly exploitable application; the Critical patch released in this month's collection applies to various versions, including IE 8.

For more details, see http://www.microsoft.com/technet/security/bulletin/ms09-jun.mspx

]]> New Phish Flavor-of-the-Month: Now Mentioning Password Changes! http://blog.case.edu/its-security/2009/06/09/new_phish_flavorofthemonth_now_mentioning_password_changes Observe this recent adaptive technique used by the Phish scammers: mentioning recent campus events, e.g., the implementation of the maximum... http://blog.case.edu/its-security/2009/06/09/new_phish_flavorofthemonth_now_mentioning_password_changes case cwru Case Western Case Western Reserve University IT Security Tue, 09 Jun 2009 15:24:54 EST Observe this recent adaptive technique used by the Phish scammers: mentioning recent campus events, e.g., the implementation of the maximum password age policy:

Reply-to security@case.edu,
"support@cwru.edu" [tsupportteam@gmail.com] <--alert! Off-campus Reply-to address!
to support@cwru.edu
date Tue, Feb 3, 2009 at 2:45 PM
subject Important Notice

Dear cwru.edu User,

We have noticed an unauthorized attempt to change your
cwru.edu password from a foreign IP. This was going to
result to your inability to access your account due to the
password change. If you know you are the authorized owner of
this account, kindly reply by providing your original
username (*******) and PASSWORD (*******) so as to protect
your ID and password from unauthorized access.

Failure to do this will violate the Case Western Reserve
University email terms & conditions.

Thanks for using Case Western Reserve University

The Case Western Reserve University® Help Support.
All content (c) Copyright Case Western Reserve University®

This phishing example is instructive, because it illustrates several of the ways phishers attempt to dress up their scams with trappings of authority and social-engineer their way past your Shenanigan detectors.

Specifically, any time a message demands that you enter a visible, clear-text password into the text of an email, that *always* indicates that the sender is up to no good. These requests should immediately activate your Delete-key trigger finger.

Any time a message claims to be an "official" communication from the University, yet the "Reply-To" field sends your response to an address outside of the Case domain, you should experience shivers of intuition that Something Is Not Right. Check the Reply-To field in this example, and do not be fooled: Even users provisioned for Case Google Apps will still have @case.edu as their top-level domain.

No Case employee should ever ask you to share your username and password, and we will especially never ask users to transmit credential info in the clear text body of an email. Any such request for credential information should be met with deep suspicion, or at least scoffed at, and deleted at your earliest opportunity.

]]> Adobe Releases Security Updates to Acrobat http://blog.case.edu/its-security/2009/06/01/adobe_releases_security_updates_to_acrobat In May 2009, a critical security vulnerability has been identified in the current versions of Adobe Acrobat and Acrobat Reader... http://blog.case.edu/its-security/2009/06/01/adobe_releases_security_updates_to_acrobat case cwru Case Western Case Western Reserve University IT Security Mon, 01 Jun 2009 21:43:02 EST In May 2009, a critical security vulnerability has been identified in the current versions of Adobe Acrobat and Acrobat Reader software (versions 9.1 and earlier).

Case users are advised to update their versions of Adobe Acrobat or the Acrobat Reader by following the instructions in the Adobe Security Bulletin for vulnerability APSB09-06.

Users should note that third party products are not updated by operating system auto updates. Case will continue to notify users when manual updates such as these present a risk to networked IT systems.

]]> Conficker C http://blog.case.edu/its-security/2009/03/31/conficker_c The University advises all users of Microsoft Windows systems to be on the alert for variations in the Conficker C/... http://blog.case.edu/its-security/2009/03/31/conficker_c case cwru Case Western Case Western Reserve University IT Security Tue, 31 Mar 2009 13:18:49 EST The University advises all users of Microsoft Windows systems to be on the alert for variations in the Conficker C/ Downadup malware which has exploited a Microsoft vulnerability from November 2008.

Update: if you browse to this web site at the University of Notre Dame, it will give you a visual indication if your computer has been affected by the Conficker worm. If you don't see the images at the top, you may be infected, and should call the Case Help Desk at 368-HELP.

Case users who have been using the mandated Symantec Endpoint Protection and performing automated updates as mandated by the Case Tier I Controls should not be affected, however the few hosts that are infected are predicted to attempt scanning and logins to windows shares on the Case network.

If your Symantec Endpoint Protection alerts you to an intrusion attempt, please call the Case Help Desk with the alert information.

Case users of MacOS and Linux variants are not expected to be affected by the attack.

]]>