Landmark Leadership Conferences for IT Executives
 

The IT Blog



by Fred F. Farkel, Monday, August 11th, 2014

 

Guest column by Citadel Information Group

Cyber Crime – Citadel On Security

With latest Russian hack, should we move beyond passwords for web security?: Stan Stahl Speaks on AirTalk with Larry Mantle. A Russian crime syndicate has apparently stolen over 1 billion internet usernames and passwords from hundreds of thousands of websites, the New York Times is reporting. Hold Security, a cybersecurity firm in Milwaukee, first made the discovery. According to the firm’s founder Alex Holden, the hackers targeted not only US companies that are household names, but pretty much any website they could break into. KPCC Radio, August 6, 2014

Cyber Crime

Target (TGT) stock tumbles; data breach will cost $148 million (+video): Target (TGT) lowered its second-quarter forecast Tuesday, saying it expects expenses tied to a massive data breach this past winter to come to $148 million. Target has been reeling since it announced in December that hackers stole millions of customers’ credit- and debit-card records. The Christian Science Monitor, August 5, 2014

P.F. Chang’s data breach hits 33 restaurants in 16 states (+video): P.F. Chang’s is providing more details on its ongoing investigation into a security breach first reported in June. The list of P.F. Chang’s restaurant locations where customers’ credit and debit card data may have been stolen includes 33 locations across the United States. The Christian Science Monitor, August 4, 2014

Cyber Privacy

Teens Are Waging a Privacy War on the Internet — Why Marketers Should Listen: Back in the early days of social media, Danah Boyd was asked to participate on a panel alongside some representatives from various consumer brands. A fellow panelist who worked at Coca-Cola commented with satisfaction that his company was the most popular brand on MySpace. Without meaning to, Boyd (who writes her name in all lowercase letters) laughed audibly. At the moderator’s prompting, she explained that she, too, had noticed how popular Coke was on the site, and investigated. The most popular “brand” turned out to be not the soft drink, but cocaine. Wharton University of Pennsylvania, August 5, 2014

Identity Theft

How to Keep Data Out of Hackers’ Hands: The numbers sound abstract: Hundreds of millions of email addresses and other types of personal identification found in the hands of Russian hackers. For people worried that they are caught in the mix, however, the discovery by Hold Security of a huge database of stolen data is very personal. But personal doesn’t mean helpless. There are common sense steps everyone can take to keep the impact of hackers to a minimum. The New York Times, August 5, 2014

Russian Hackers Amass Over a Billion Internet Passwords: A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say. The New York Times, August 5, 2014

Financial Cyber Security

Financial institutions and Cybercrime: It’s only just begun: A recent bout of high profile cyber-attacks on financial institutions across the UK, US and Canada has put the spotlight back on the importance of data security and the need to be diligent when it comes to cybersecurity within the banking industry, writes Alex Raistrick. BankingTech, July 28, 2014

Cyber Warning

Researcher says PayPal’s two-factor authentication is easily beaten: A security feature offered by PayPal to help prevent accounts from being taken over by hackers can be easily circumvented, an Australian security researcher has found. PC World, August 4, 2014

Stealthy, tricky ‘Poweliks’ malware hides in your system registry – but not your hard drive: A new malware program called Poweliks attempts to evade detection and analysis by running entirely from the system registry without creating files on disk, security researchers warn. PCWorld, August 4, 2014

U.S. government warns retailers about malicious software: BOSTON (Reuters) – The U.S. Department Of Homeland Security warned retailers about a type of malicious software attacking point-of-sales systems, dubbed “Backoff,” that it said is undetectable by most types of anti-virus software. MSN, August 1, 2014

Cyber Security Management

Securing the eCampus: Ten Observations About Cyber Security in Academia: I recently gave the keynote address at “Securing the eCampus,” a gathering of university CIOs and CISOs hosted by Dartmouth College. Drawing on my fifteen years of experience in the kinetic security world, running a security software company, and serving on the Board of Trustees at Dartmouth, I offered ten observations on the cyber landscape, especially as it pertains to academic environments: EndGame, August 2014

A Tough Corporate Job Asks One Question: Can You Hack It?: SAN FRANCISCO — Pity the poor chief information security officer. The profession barely existed a generation ago. But to combat the growing threat of online breaches, companies and governments are hiring executives whose main responsibility is to make sure data systems are secure. When things go wrong — and they often do — these executives expect to bear the blame. The New York Times, July 20, 2014

Don’t Be the Next Target — IT Security Spending Priorities 2014: Sound planning of the IT security budget requires a superficial look at market averages. Beware media hype, focus on business requirements and consider what peers in your industry and region are investing in. Gartner, April 8, 2014

Cyber Secuity Management – Cyber Defense

In Fight With Hackers, We Are on Our Own: Call it the hack whipsaw. A computer security company — it is rarely a government entity — comes out with a new report. Millions of stolen passwords. Tens of millions. No, hundreds of millions. The point is apparent: This is a big deal. Then it becomes clear this company is not simply informing the world out of some sort of noblesse oblige: It is trying to make money. The New York Times, August 7, 2014

New Site Recovers Files Locked by Cryptolocker Ransomware: Until today, Microsoft Windows users who’ve been unfortunate enough to have the personal files on their computer encrypted and held for ransom by a nasty strain of malware called CryptoLocker have been faced with a tough choice: Pay cybercrooks a ransom of a few hundred to several thousand dollars to unlock the files, or kiss those files goodbye forever. That changed this morning, when two security firms teamed up to launch a free new online service that can help victims unlock and recover files scrambled by the malware. KrebsOnSecurity, August 6, 2014

Cyber Security Management – HIPAA

HIPAA Omnibus Rule compliance tips for healthcare law firms: In addition to covered entities, it is widely known that the HIPAA Omnibus Rule had a significant impact on business associates (BAs) and subcontractors. Interestingly, law firms that help covered entities comply with HIPAA regulations are often BAs themselves, so they were forced to make changes to the ways they handle protected health information (PHI). HealthITSecurity, August 1, 2014

Cyber Awareness

How To Talk To Your Employees About Cybersecurity (Without Putting Them To Sleep): You can just see the eye-rolls across the conference table when you bring it up. It may not be tops on the list of things you want to address at a staff meeting, but cybersecurity is an issue that likely effects every one of your employees, everyday, and if you’re delegating it to one person at the back of the IT department, you’re making a big mistake. Forbes, August 6, 2014

Cyber Underworld

The World’s Top 5 Cybercrime Hotspots: A Russian crime ring is suspected of obtaining access to a record 1.2 billion username and password combinations, shedding renewed light on how vulnerable online personal information can be. Cybersecurity firm Hold Security said the gang of hackers was based in a city in south central Russia and comprised roughly ten men in their twenties who were all personally acquainted with each other, the New York Times reported. Time, August 7, 2014

‘White Label’ Money Laundering Services: Laundering the spoils from cybercrime can be a dicey affair, fraught with unreliable middlemen and dodgy, high-priced services that take a huge cut of the action. But large-scale cybercrime operations can avoid these snares and become much more profitable when they’re able to disguise their operations as legitimate businesses operating in the United States, and increasingly they are doing just that. KrebsOnSecurity, August 4, 2014

Cyber Misc

Google Says Website Encryption – Or Lack Thereof – Will Now Influence Search Rankings: Google will begin using website encryption, or HTTPS, as a ranking signal – a move which should prompt website developers who have dragged their heels on increased security measures, or who debated whether their website was “important” enough to require encryption, to make a change. Initially, HTTPS will only be a lightweight signal, affecting fewer than 1% of global queries, says Google. TechCrunch, August 7, 2014

Cyber Sunshine

The FBI Is Infecting Tor Users with Malware to Catch Kiddie Porn Creeps: Tor’s had a tough week. Just a few days ago, the organization made the difficult announcement that an attack on their system likely stripped users of anonymity. Now, Wired reports that the FBI effort has been running a campaign to identify Tor users by installing malware on their computers for years, virtually unchecked by the courts. Gizmodo, August 4, 2014


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Cyber Security News of the Week, August 10, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Cyber Security News of the Week, August 10, 2014

by Fred F. Farkel, Monday, August 4th, 2014

 

Guest column by Citadel Information Group

Weekend Vulnerability and Patch Report

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

Apple MacBook Air: Apple has released firmware update 2.9.1 for its MacBook Air. The update is available from Apple’s website.

Avira Antivirus: Avira has released version 14.0.6.552 of its free Antivirus. Updates are available from Avira’s website.

Check Point Technologies Zone Alarm: Check Point has released version 13.3.052.000 of the Free version of Zone Alarm. Updates are available from Check Point’s website.

Skype: Skype has released Skype 6.18.0.106. Updates are available from the program or Skype’s website.

VLC Media Player: VLC has released version 2.1.5 (32-bit) of its Media Player. Download from the VLC website.

Current Software Versions

Adobe Flash  14.0.0.145 [Windows 7: IE]

Adobe Flash  14.0.0.145 [Windows 7: Firefox, Mozilla]

Adobe Flash  14.0.0.145 [Windows 8: IE]

Adobe Flash  14.0.0.145 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.07

Dropbox 2.10.3 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 31.0

Google Chrome 36.0.1985.125

Internet Explorer 11.0.9600.17126

Java SE 7 Update 65 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.4 [Mac OS X]

Skype 6.18.0.106

Newly Announced Unpatched Vulnerabilities

Apple QuickTime: Secunia reports an unpatched moderately critical vulnerability in version 7.7.4 of Apple’s QuickTime. No official solution is currently available.

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

Cisco Multiple Products: Secunia reports that Cisco has released updates for its Unified Customer Voice Portal (CVP), Cisco Unified Communications Manager IM and Presence Service, and others. Apply updates. Secunia reports that Cisco has released a partial fix for its Prime Data Center Network Manager to fix a vulnerability reported in versions 6.3(0.9) and 6.2(1) running on Cisco MDS 9500 Series. Upgrade to a fixed version. Secunia reports unpatched vulnerabilities in WebEx Meetings Server report in versions 1.5, 1.5.1.6, and 1.5.1.131. No official solution is available.

Novell eDirectory: Secunia reports that Novell has released an update for its eDirectory to fix a security issue. Apply 8.8 SP8 Patch 2 Hotfix 1.


If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

 

Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Weekend Vulnerability and Patch Report, August 3, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Weekend Vulnerability and Patch Report, August 3, 2014

by Fred F. Farkel, Monday, August 4th, 2014

 

Guest column by Citadel Information Group

Cyber Crime

Sandwich Chain Jimmy John’s Investigating Breach Claims: Sources at a growing number of financial institutions in the United States say they are tracking a pattern of fraud that indicates nationwide sandwich chain Jimmy John’s may be the latest retailer dealing with a breach involving customer credit card data. The company says it is working with authorities on an investigation. KrebsOnSecurity, July 31, 2014

Hackers stealing more sexual photos for extortion: The e-mail terrified the young mother. “What if I told you I had pics of you?” the writer asked. “Like a lot. Would you send me more?” SFGate, July 27, 2014

‘The Expendables 3’ Pirated by Hackers Three Weeks Before its Release: The action movie The Expendables 3, which officially premieres on August 15, has been pirated by hackers three weeks before its release. The film somehow leaked online and it has been downloaded over 189,000 times in just 24 hours through piracy websites. The lead cast members of the film include Wesley Snipes, Mel Gibson, Sylvester Stallone, Kelsey Grammer, Ronda Rousey, Jet Li, Jason Statham, Arnold Schwarzenegger, Antonio Banderas, Dolph Lundgren and Harrison Ford. Liberty Voice, July 26, 2014

Cyber Privacy

How to Invent a Person Online: On April 8, 2013, I received an envelope in the mail from a nonexistent return address in Toledo, Ohio. Inside was a blank thank-you note and an Ohio state driver’s license. The ID belonged to a 28-year-old man called Aaron Brown—6 feet tall and 160 pounds with a round face, scruffy brown hair, a thin beard, and green eyes. His most defining feature, however, was that he didn’t exist. TheAtlantic, July 23, 2014

3 Projects Prove Privacy Is Not Dead: Web and mobile phone users willingly share personal data in exchange for free stuff, but not everyone is ready to throw in the towel on privacy. Scientific American, July 22, 2014

Financial Cyber Security

Source code for tiny ‘Tinba’ banking malware leaked: The source code for an impressively small but capable malware program that targets online bank accounts has been leaked, according to CSIS Security Group of Denmark. PC World, July 10, 2014

Cyber Warning

Every USB Device Under Threat. New Hack Is Undetectable And Unfixable: It is well known that USB drives can be dangerous. Companies run strict screening policies and it has long been known that running unknown ‘exe’ files is a bad idea. But what if the threat was undetectable, unfixable and could be planted into any USB device be it a USB drive, keyboard, mouse, web camera, printer, even smartphone or tablet? Well this nightmare scenario just became reality. Forbes, August 1, 2014

Checking In From Home Leaves Entry for Hackers: SAN FRANCISCO — The same tools that help millions of Americans work from home are being exploited by cybercriminals to break into the computer networks of retailers like Target and Neiman Marcus. The New York Times, July 31, 2014

Zero-day flaws found in Symantec’s Endpoint Protection: Symantec’s Endpoint Protection product has three zero-day flaws that could allow a logged-in user to move to a higher access level on a computer, according to a penetration testing and training company. PCWorld, July 29, 2014

Critical Android vulnerability lets malware compromise most devices and apps: The majority of Android devices currently in use contain a vulnerability that allows malware to completely hijack installed apps and their data or even the entire device. PCWorld, July 29, 2014

The Internet of Things Is the Hackers’ New Playground: Excited about the promise of the shiny new Internet of Things? Good. Because hackers are too. Or at least they should be, according to a study by computing giant Hewlett-Packard. Recode, July 29, 2014

Cyber Security Management

Board interest in information security principles growing: Corporate boards have increased their awareness of security issues, but experts say they still lack information security principles. SearchSecurity, July 29, 2014

Five Tips for Preventing Cyber-Security Breaches: Before looking at vendor solutions to protecting data, CFOs need to put some thought into which information to safeguard. CFO, July 28, 2014

Cyber-Risk Oversight Handbook: Leading companies view cyber risks in the same way they do other critical risks—in terms of a risk-reward trade off. This is especially challenging in the cyber arena for two reasons. First, the complexity of cyber threats has grown dramatically. Corporations now face increasingly sophisticated events that outstrip traditional defenses. As the complexity of these attacks increases, so does the risk they pose to corporations. As noted above, the potential effects of a data breach are expanding well beyond information loss to include significant damage in other areas. Second, competitive pressures to deploy increasingly cost-effective business technologies often affect resource investment calculations. These two competing pressures on corporate staff and business leaders mean that conscientious and comprehensive oversight at the board level is essential. NACD, June 10, 2014

The Many Lives of PII: How many definitions could there be for one short phrase? I am not talking about Pi, the mathematical term and lead character in Yann Martel’s imaginative novel (which Ang Lee made into a movie), but “PII,” an acronym for the legal concept of “personally identifiable information.” DataNeutrality.org, 2014

Cyber Security Management – Cyber Defense

‘Backoff’ Malware: Time To Step Up Remote Access Security: DHS issues advisory about remote desktop access tools associated with recent point-of-sale breaches. DarkReading, August 1, 2014

Cyber Espionage

Canada: Chinese Hackers Infiltrated Government Org: Chinese hackers infiltrated the computer systems of Canada’s top research and development organization, the Canadian government said Tuesday. ABC News, July 29, 2014

Cyber Law

Massachusetts Continues Aggressive Information Security Enforcement Agenda: On July 23, 2014, the Massachusetts Attorney General announced a consent judgment with Women & Infant’s Hospital of Rhode Island (“WIH”) to resolve allegations that it violated federal and state information security laws when it lost backup tapes. The backup tapes, allegedly containing sensitive personal information and protected health information of 12,127 Massachusetts residents, were not encrypted. As a result of the consent judgment, WIH will pay a civil penalty of $110,000, attorney fees of $25,000, and contribute $15,000 to funds organized by the Attorney General to support data security enforcement actions and education on the protection of sensitive personal information. Information Lawgroup, July 25, 2014

SECURITY BREACH NOTIFICATION CHART: Perkins Coie’s Privacy & Security practice maintains a comprehensive chart that summarizes state laws regarding security breach notification. The chart is for informational purposes only and is intended as an aid in understanding each state’s sometimes unique security breach notification requirements. Lawyers, compliance professionals, and business owners have told us that the chart has been helpful when preparing for and responding to data breaches. PerkinsCole, June 2014

Cyber Misc

Service Drains Competitors’ Online Ad Budget: The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Today’s post looks at a popular service that helps crooked online marketers exhaust the Google AdWords budgets of their competitors. KrebsOnSecurity, July 25, 2014


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Cyber Security News of the Week, August 3, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Cyber Security News of the Week, August 3, 2014

by Fred F. Farkel, Monday, July 28th, 2014

 

Guest column by Citadel Information Group

Weekend Vulnerability and Patch Report

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

Dropbox: Dropbox has released version 2.10.3 for its file hosting program. Updates are available at Dropbox’s website. [See Citadel’s warning below]

Mozilla Firefox: Mozilla has released version 31 to fix at least 11 highly critical unpatched vulnerabilities. Updates are available within the browser or from Mozilla’s website.

Opera: Opera has released version 23.0.1522.60 to fix moderately critical vulnerabilities. Updates are available from within the browser or from Opera’s website.

Piriform CCleaner: Piriform has released version 4.16.4736 for CCleaner. Updates are available from Piriform’s website.

Current Software Versions

Adobe Flash  14.0.0.145 [Windows 7: IE]

Adobe Flash  14.0.0.145 [Windows 7: Firefox, Mozilla]

Adobe Flash  14.0.0.145 [Windows 8: IE]

Adobe Flash  14.0.0.145 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.07

Dropbox 2.10.3 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 31.0

Google Chrome 36.0.1985.125

Internet Explorer 11.0.9600.17126

Java SE 7 Update 65 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.4 [Mac OS X]

Skype 6.18.0.105

Newly Announced Unpatched Vulnerabilities

None

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

Cisco Multiple Products: Secunia reports that Cisco has released updates for its Unified Attendant Console, Unified Attendant Console Advanced, Unified Communications Manager, Desktop Collaboration Experience DX650, Expressway Series and TelePresence Video Communication Server, Prime Data Center Network Manager, and others. Apply updates.


If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

 

Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Weekend Vulnerability and Patch Report, July 27, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Weekend Vulnerability and Patch Report, July 27, 2014

by Fred F. Farkel, Monday, July 28th, 2014

 

Guest column by Citadel Information Group

Cyber Crime

Hackers steal user data from the European Central Bank website, ask for money: Hackers have stolen user contact information, including email addresses and phone numbers, from the website of the European Central Bank and attempted to extort money from the institution. PCWorld, July 24, 2014

Feds: Hackers Ran Concert Ticket Racket: A Russian man detained in Spain is facing extradition to the United States on charges of running an international cyber crime ring that allegedly stole more than $10 million in electronic tickets from e-tickets vendor StubHub. KrebsOnSecurity, July 23, 2014

Banks: Card Breach at Goodwill Industries: Heads up, bargain shoppers: Financial institutions across the country report that they are tracking what appears to be a series of credit card breaches involving Goodwill locations nationwide. For its part, Goodwill Industries International Inc. says it is working with the U.S. Secret Service on an investigation into these reports. KrebsOnSecurity, July 21, 2014

Financial Cyber Security

Hackers Find Way to Outwit Tough Security at Banking Sites: Researchers at the computer security company Trend Micro have named a new attack on online banking Emmental. Why? Like the Swiss cheese, the researchers said, online banking protections may be “full of holes.” The New York Times, July 22, 2014

Cyber Warning

50,000 sites hacked through WordPress plug-in vulnerability: A critical vulnerability found recently in a popular newsletter plug-in for WordPress is actively being targeted by hackers and was used to compromise an estimated 50,000 sites so far. PCWorld, July 24, 2014

Nigerian 419 Scammers Evolving Into Malware Pushers (But Not Very Good Ones): “Silver Spaniel” attacks use commodity malware to damage others’ security, but they aren’t very good at protecting their own. DarkReading, July 22, 2014

Forensic scientist identifies suspicious ‘back doors’ running on every iOS device: Forensic scientist and author Jonathan Zdziarski has posted the slides (PDF) from his talk at the Hackers On Planet Earth (HOPE/X) conference in New York called Identifying Backdoors, Attack Points, and Surveillance Mechanisms in iOS Devices. ZDNet, July 21, 2014

Cyber Security Management – Cyber Update

FIREFOX 31 PATCHES 11 SECURITY FLAWS: Mozilla has released a new version of Firefox, which includes patches for 11 security vulnerabilities. Three of the bugs fixed in Firefox 31 are critical, including a use-after-free vulnerability and a handful of memory safety issues. ThreatPost, July 23, 2014

Cyber Underworld

Even Script Kids Have a Right to Be Forgotten: Indexeus, a new search engine that indexes user account information acquired from more than 100 recent data breaches, has caught many in the hacker underground off-guard. That’s because the breached databases crawled by this search engine are mostly sites frequented by young ne’er-do-wells who are just getting their feet wet in the cybercrime business. KrebsOnSecuriy, July 18, 2014

Cyber Research

How Hackers Hid a Money-Mining Botnet in the Clouds of Amazon and Others: Hackers have long used malware to enslave armies of unwitting PCs, but security researchers Rob Ragan and Oscar Salazar had a different thought: Why steal computing resources from innocent victims when there’s so much free processing power out there for the taking? Wired, July 24, 2014

7 Black Hat Sessions Sure To Cause A Stir: At Black Hat, researchers will point out the weaknesses in everything from the satellites in outer space to the thermostat in your home. DarkReading, July 22, 2014


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Cyber Security News of the Week, July 27, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Cyber Security News of the Week, July 27, 2014

by Fred F. Farkel, Monday, July 21st, 2014

 

Guest column by Citadel Information Group

Weekend Vulnerability and Patch Report

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

AVG Free Edition: AVG has released version 2014.0.4744 of its 32 bit Free Edition. Updates are available on AVG’s website.

Dropbox: Dropbox has released version 2.10.2 for its file hosting program. Updates are available at Dropbox’s website. [See Citadel’s warning below]

Google Chrome: Google has released Google Chrome 36.0.1985.125 for Windows, Mac, Linux, and Chrome Frame to fix at least 2 moderately critical unpatched vulnerabilities in previous versions. Updates are available from within the browser or from Google Chrome’s website.

Google Chrome for Android: Google has released version 36.0.1985.122 of Chrome for Android to fix at least 2 unpatched vulnerabilities in previous versions. Updates are available through the program or device.

Oracle Java: Oracle has released Java SE 7 Update 65 to fix at least 20 vulnerabilities, some of which are highly critical. The update is available through Windows Control Panel or Java’s website. [See Citadel’s recommendation below]

Current Software Versions

Adobe Flash  14.0.0.145 [Windows 7: IE]

Adobe Flash  14.0.0.145 [Windows 7: Firefox, Mozilla]

Adobe Flash  14.0.0.145 [Windows 8: IE]

Adobe Flash  14.0.0.145 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.07

Dropbox 2.10.2 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 30

Google Chrome 36.0.1985.125

Internet Explorer 11.0.9600.17126

Java SE 7 Update 65 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.4 [Mac OS X]

Skype 6.18.0.105

Newly Announced Unpatched Vulnerabilities

None

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

Cisco Multiple Products: Secunia reports that Cisco has released updates for its SPA300 / SPA500 Series, WebEx Meetings Server and Meeting Center, Adaptive Security Appliance (ASA), Unified Contact Center Express, Unified Communications Manager, Wireless Residential Gateway, Identity Services Engine (ISE), Unified Contact Center Enterprise, multiple Wireless Residential Gateway products, and others. Apply updates. Secunia report several unpatched vulnerabilities in Cisco Unified Communications Domain Manager (CUCDM), Business Edition 3000 and others. No official solution is available.

Citrix NetScaler: Secunia reports that Citrix has released updates for its NetScaler and NetScaler Gateway to fix 2 vulnerabilities. Update to version 10.1-126.12.

Citrix XenDesktop: Secunia reports that Citrix has released updates for it’s XenDesktop to fix a vulnerability reported in the following products and versions: Citrix XenDesktop 5.6 Common Criteria, Citrix XenDesktop 5.6 x32, Citrix XenDesktop 5.6 x64, Citrix XenDesktop 7, Citrix XenDesktop 7.1, Citrix XenDesktop 7.5. Apply updates.

Citrix XenServer: Secunia reports that Citrix has released updates for it’s XenServer to fix 2 moderately critical vulnerabilities and a security issues.  Apply updates.

Oracle Multiple Products: Both Secunia and US-Cert report that Oracle has released updates to fix more than 100 vulnerabilities, some of which are highly critical, for Oracle Linux for java-1.7.0-openjdk, Solaris, Hyperion Provider Services, Hyperion Common Admin, Hyperion Business Intelligence Plus, Hyperion Essbase, Siebel CRM, Communications Messaging Server, Secure Global Desktop, Agile Product Collaboration, E-Business Suite, BI Publisher, BI Publisher, PeopleSoft Enterprise Supply Chain Management (SCM), Retail Returns Management, PeopleSoft Enterprise Financial Management Solutions (FMS), PeopleSoft PeopleTools, PeopleSoft Enterprise Learning Management, Glassfish Communications Server, Glassfish Server, Retail Back Office and Oracle Retail Central Office, JDeveloper, WebLogic Server, WebCenter Portal, iPlanet Web Server, iPlanet Web Proxy Server, Traffic Director, Hyperion Enterprise Performance Management Architect, Database, MySQL Server, Transportation Management, VM VirtualBox, JRockit, ISC BIND included in Solaris, and others. Apply updates.


If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

 

Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Weekend Vulnerability and Patch Report, July 13, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Weekend Vulnerability and Patch Report, July 20, 2014

by Fred F. Farkel, Monday, July 21st, 2014

 

Guest column by Citadel Information Group

Cyber Attack

Chinese Hackers Extending Reach to Smaller U.S. Agencies, Officials Say: WASHINGTON — After years of cyberattacks on the networks of high-profile government targets like the Pentagon, Chinese hackers appear to have turned their attention to far more obscure federal agencies. The New York Times, July 15, 2014

Why were this company’s computers attacked millions of times this year? Algae: About 16 months ago, a Florida-based biofuel company called Algenol noticed that its Internet service was slowing down. In checking that out, Jack Voth, Algenol’s information technology chief, stumbled on something odd: a telnet connection to its videoconference camera from an Internet Protocol address in China, a country where Algenol has never sought to do business. The Washington Post, July 12, 2014

Attack Campaign Targets Facebook, Dropbox User Credentials: The goal of the attackers is not fully clear but the credential theft could set up sophisticated targeted attackers. DarkReading, July 11, 2014

Financial Cyber Security

New banking malware ‘Kronos’ advertised on underground forums: A new Trojan program designed to steal log-in credentials and other financial information from online banking websites is being advertised to cybercriminal groups on the underground market. PCWorld, July 14, 2014

Cyber Warning

Vulnerability exposes some Cisco home wireless devices to hacking: Nine of Cisco’s home and small office cable modems with router and wireless access point functionality need software updates to fix a critical vulnerability that could allow remote attackers to completely compromise them. PCWorld, July 17, 2014

Beware Keyloggers at Hotel Business Centers: The U.S. Secret Service is advising the hospitality industry to inspect computers made available to guests in hotel business centers, warning that crooks have been compromising hotel business center PCs with keystroke-logging malware in a bid to steal personal and financial data from guests. KrebsOnSecurity, July 14, 2014

DropCam Vulnerable To Hijacking: Researchers at DEF CON to demonstrate flaws in a popular WiFi video monitoring system. DarkReading, July 14, 2014

Cyber Security Management

SEC Playing Bigger Role in Cybersecurity: Besides clarifying disclosure requirements, the agency is prompting companies to take proactive steps. JDSUPRA, July 14, 2014

Cyber Security Management – Cyber Defense

GOOGLE SET TO CHANGE MALWARE, PHISHING WARNINGS FOLLOWING STUDY: In the not too distant future, Google will change the way it displays malware and phishing warnings in its Chrome browser. ThreatPost, July 15, 2014

Cyber Security Management – Cyber Update

Java Update: Patch It or Pitch It: Oracle today released a security update for its Java platform that addresses at least 20 vulnerabilities in the software. Collectively, the bugs fixed in this update earned Oracle’s “critical” rating, meaning they can be exploited over a network without the need for a username and password. In short, if you have Java installed it is time to patch it or pitch it. KrebsOnSecurity, July 15, 2014

Securing the Village

Meet ‘Project Zero,’ Google’s Secret Team of Bug-Hunting Hackers: When 17-year-old George Hotz became the world’s first hacker to crack AT&T’s lock on the iPhone in 2007, the companies officially ignored him while scrambling to fix the bugs his work exposed. When he later reverse engineered the Playstation 3, Sony sued him and settled only after he agreed to never hack another Sony product. Wired, July 15, 2014

National Cyber Security

Justice Department’s New Crime Chief Targets Cyber Cases: WASHINGTON—International organized crime groups, lured by the prospect of thefts that can net hundreds of millions of dollars, increasingly are turning to cybercrime, said the new head of the Justice Department’s criminal division. The Wall Street Journal, July 14, 2014

Cyber Misc

How Russian Hackers Stole the Nasdaq: In October 2010, a Federal Bureau of Investigation system monitoring U.S. Internet traffic picked up an alert. The signal was coming from Nasdaq (NDAQ). It looked like malware had snuck into the company’s central servers. There were indications that the intruder was not a kid somewhere, but the intelligence agency of another country. More troubling still: When the U.S. experts got a better look at the malware, they realized it was attack code, designed to cause damage. Bloomberg, July 17, 2014


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Cyber Security News of the Week, July 20, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Cyber Security News of the Week, July 20, 2014

by Fred F. Farkel, Monday, July 14th, 2014

 

Guest column by Citadel Information Group

Weekend Vulnerability and Patch Report

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

Adobe Flash Player: Adobe has released version 14.0.0.145 to fix at least 3 moderately critical vulnerabilities in its Flash Player for the Windows and Mac versions. Updates are available from Adobe’s website. Updates are also available for Adobe AIR.

Apple iTunes: Apple has released version 11.3 of iTunes for Windows (32-bit). Updates are available from Apple’s website.

Avira Antivirus: Avira has released version 14.0.5.464 of its free Antivirus. Updates are available from Avira’s website.

Malwarebytes Anti-Exploit: Malwarebytes has released version 1.03.1.1220 of its free Malwarebytes Anti-Exploit. Updates are available from Malwarebytes’ website.

Microsoft Patch Tuesday: Microsoft released several updates addressing at least 29 security vulnerabilities, some of which are highly critical, in Windows, Office, Internet Explorer, and more. This release of updates specifically fixes at least 24 highly critical vulnerabilities in Internet Explorer. Updates are available via Windows Update or from Automatic Update.

Skype: Skype has released Skype 6.18.0.105. Updates are available from the program or Skype’s website.

TechSmith Corporation SnagIt: TechSmith has released version 12.1.0.1322 for SnagIt. Updates are available from TechSmith’s website.

Current Software Versions

Adobe Flash  14.0.0.145 [Windows 7: IE]

Adobe Flash  14.0.0.145 [Windows 7: Firefox, Mozilla]

Adobe Flash  14.0.0.145 [Windows 8: IE]

Adobe Flash  14.0.0.145 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.07

Dropbox 2.8.4 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 30

Google Chrome 35.0.1916.153

Internet Explorer 11.0.9600.17126

Java SE 7 Update 60 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.4 [Mac OS X]

Skype 6.16.0.105

Newly Announced Unpatched Vulnerabilities

None

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

Cisco IOS XR: Secunia reports that Cisco has released updates for its IOS XR to fix a vulnerability. Update to version 5.1.3.9i.BASE or 5.2.2.11i.BASE.

Novell iManager: Secunia reports that Novell has released updates for its iManager to fix reported vulnerabilities in previous versions.


If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

 

Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Weekend Vulnerability and Patch Report, July 13, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Weekend Vulnerability and Patch Report, July 13, 2014

by Fred F. Farkel, Monday, July 14th, 2014

 

Guest column by Citadel Information Group

Cyber Crime

BitBeat: Phishing Scam Tries to Lure In Bitcoin Bidders: – A scam artist tried to swindle a group of potential bidders in the June auction of 30,000 bitcoins by the U.S. Marshals Service, and appears to have scored a small win with at least one of them. The Wall Street Journal, July 3, 2014

Cyber Privacy

Controversial Cybersecurity Bill Known As CISA Advances Out Of Senate Committee: The Senate Select Committee on Intelligence voted Tuesday to approve a controversial cybersecurity bill known as the Cyber Information Sharing Act (CISA). The bill is intended to help companies and the government thwart hackers and other cyber-intrusions. The bill passed by a 12-3 vote, moving it one step closer to a floor debate. Forbes, July 9, 2014

Financial Cyber Security

Why Information Sharing Isn’t Working: Tim Pawlenty, CEO of the Financial Services Roundtable, says the only way to ensure adequate cyberthreat information sharing is through federal legislation that would furnish liability protection and other incentives. BankInfoSecurity, June 25, 2014

FFIEC Launches Cybersecurity Web Page, Promotes Awareness of Cybersecurity Activities: WASHINGTON –The Federal Financial Institutions Examination Council (FFIEC) today launched a Web page on cybersecurity (www.ffiec.gov/cybersecurity.htm).The Web page is a central repository for current and future FFIEC-related materials on cybersecurity. FFIEC, June 24, 2014

Cyber Warning

Crooks Seek Revival of ‘Gameover Zeus’ Botnet: Cybercrooks today began taking steps to resurrect the Gameover ZeuS botnet, a complex crime machine that has been blamed for the theft more than $100 million from banks, businesses and consumers worldwide. The revival attempt comes roughly five weeks after the FBI joined several nations, researchers and security firms in a global and thus far successful effort to eradicate it. KrebsOnSecurity, July 10, 2014

HARD-CODED PASSWORD VULNERABILITY PLAGUES SOME NETGEAR SWITCHES: A vulnerability in Netgear-branded ethernet switches could give an attacker full access to the hardware, including the ability to log into the device and execute arbitrary code. ThreatPost, July 7, 2014

The Rise of Thin, Mini and Insert Skimmers: Like most electronic gadgets these days, ATM skimmers are getting smaller and thinner, with extended battery life. Here’s a look at several miniaturized fraud devices that were pulled from compromised cash machines at various ATMs in Europe so far this year. KrebsOnSecurity, July 7, 2014

Funeral Announcement: Origins: In January 2014, Internet users began receiving e-mails from various funeral homes with attention-getting subject lines such as “Passing of your friend,” messages that informed recipients a “dear friend” had passed away and invited them to attend that person’s upcoming funeral or memorial service. The messages provided a hyperlink (on the word “here”) for readers to click in order to obtain detailed information about the date and location of the service. Snopes, January 24, 2014

Cyber Security Management

Strategic Security: Begin With The End In Mind: The trouble with traditional infosec methodology is that it doesn’t show us how to implement a strategic security plan in the real world. DarkReading, July 11, 2014

The CISO-centric Information Security Triad: What is the information security triad? Just about everyone knows the answer to this question is CIA – Confidentiality, Integrity, and Availability. Security professionals, service providers, and technology vendors are responsible for these three infosec pillars in one way or another. NetworkWorld, July 10, 2014

Managing Cyber Risk: Job #1 for Directors and General Counsel: Each year, FTI Consulting and NYSE Governance Services survey public company directors and general counsel about the legal and governance issues that concern them the most. FTI Journal, July 2014

Rogers: Cybersecurity is the ‘ultimate team sport’: Thank you very much for taking the time from your very busy days to focus on a topic that I think is of critical importance to us as a nation: this idea of how do we maintain security in a cyber arena in a world where cyber continues to grow in importance and, at the same time, the level of vulnerability that is present within our cyber systems has probably never been greater. So that’s quite a challenge for anybody. Federal Times, July 8, 2014

Ponemon: Data Breach Costs Rising: On the day Target’s CEO resigned in the aftermath of a massive data breach, the Ponemon Institute issued its 2014 Cost of Data Breach Study, which Chairman Larry Ponemon says helps explain why CEOs should be more involved in breach preparedness and response. BankInfoSecurity, May 5, 2014

Cyber Security Management – Cyber Defense

Black Hat USA 2014: Third-Party Vulns Spread Like Diseases: Understanding the impact of vulnerabilities in libraries and other components. DarkReading, July 7, 2014

Cyber Security Management – Cyber Update

APPLE UPDATES OSX BLACKLIST FOLLOWING FLASH VULNERABILITY: Apple acknowledged on Thursday that it has updated its OSX plugin blacklist to reflect a critical vulnerability in Adobe Flash made public earlier this week. ThreatPost, July 11, 2014

Microsoft, Adobe Push Critical Fixes: If you use Microsoft products or Adobe Flash Player, please take a moment to read this post and update your software. Adobe today issued a critical update that plugs at least three security holes in the program. Separately, Microsoft released six security updates that address 29 vulnerabilities in Windows and Internet Explorer. KrebsOnSecuriy, July 8, 2014

Cyber Underworld

The Hazards Of Probing The Internet’s Dark Side: Late last year, hackers breached Target’s data security and stole information from millions of credit cards. Brian Krebs, who writes about cybercrime and computer security for his blog, Krebs on Security, broke the story. A few days later, he broke the story of a credit card breach at Neiman Marcus. NPR, July 8, 2014

Cyber Espionage

Chinese Hackers Pursue Key Data on U.S. Workers: WASHINGTON — Chinese hackers in March broke into the computer networks of the United States government agency that houses the personal information of all federal employees, according to senior American officials. They appeared to be targeting the files on tens of thousands of employees who have applied for top-secret security clearances. The New York Times, July 9, 2014

Chinese Attackers Targeting U.S. Think Tanks, Researchers Say: Government-backed group “Deep Panda” compromised “several” nonprofit national security policy research organizations, CrowdStrike says. DarkReading, July 7, 2014

Critical Infrastructure

Study: Most Critical Infrastructure Firms Have Been Breached: A new Ponemon Institute study finds 70% of critical infrastructure companies have been hit by security breaches in the last year, but cyber security programs are still a low priority. DarkReading, July 10, 2014

Cyber Misc

Scammers, hackers and spies hit campaign trail: Political campaigns are hotbeds of criminal activity and mischief — just not in the way you think. Politico, July 7, 2014

Cyber Sunshine

Global Law Enforcement, Security Firms Team Up, Take Down Shylock: A la GOZeuS, an international, public-private collaboration seizes a banking Trojan’s command and control servers. DarkReading, July 10, 2014

Feds Charge Carding Kingpin in Retail Hacks: The U.S. Justice Department on Monday announced the arrest of a Russian hacker accused of running a network of online crime shops that sold credit and debit card data stolen in breaches at restaurants and retailers throughout the United States. KrebsOnSecurity, July 8, 2014

Cyber Calender

ISSA-LA July Lunch Meeting: Attack Trends, the Need for Intelligence. Integration and a Prevent-Based Security Posture: This presentation will review recent trends associated with malware, advanced threats and risky applications. It will also highlight security administrator views toward their ability to identify, analyze and prevent security breaches. The data points associated with these findings identify a clear need for information security intelligence that is rich in content and also actionable. Security administrators must be able to integrate intelligence into their security controls in near real-time to prevent evolving attacks. The session will also raise the need for security practitioners to consider switching their security postures from detect to prevent. ISSA-LA, Event Date: July 16, 2014


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Cyber Security News of the Week, July 13, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Cyber Security News of the Week, July 13, 2014

by Fred F. Farkel, Monday, July 7th, 2014

 

Guest column by Citadel Information Group

Weekend Vulnerability and Patch Report

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

Adobe Shockwave Player: Adobe has released version 12.1.3.153 of Shockwave Player running on Windows and Macintosh. Updates are available through the program or from Adobe’s Shockwave Web Site.

Apple iOS: Apple has released version 7.1.2 of its iOS for iPhone 4 and later, iPad and iPod touch to fix at least 35 vulnerabilities, some of which are highly critical. The update is available through the devices or through Apple’s website.

Apple OS X: Apple has released updates for its OS X to fix at least 16 vulnerabilities, some of which are highly critical. Update to version 10.9.4 or apply Security Update 2014-003.

Apple Safari: Apple has released updates for Safari to fix at least 11 vulnerabilities, some of which are highly critical, reported in previous versions. Update to Safari 7.0.5 for OS X Mavericks and Safari 6.1.5 for OS X Mountain Lion and Lion. Updates are available from Apple’s website.

Apple TV: Apple has released version 6.1.2 for Apple TV to fix at least 29 vulnerabilities, some of which are highly critical. Updates are available through the device or Apple’s website.

Avast: Avast has released version 9.0.2013. Updates are available on Avast’s website.

AVG Antivirus Free Edition: AVG has released version 2014.0.4716 (32-bit) of its Free Edition Antivirus. Updates are available through the program or from AVG’s website.

Foxit Reader / PhantomPDF: Foxit has released version 6.2.1.0618 to fix a vulnerability reported in Foxit Reader, Foxit Enterprise Reader, Foxit PhantomPDF. Updates are available through the program or from Foxit’s website.

RealPlayer: RealPlayer has released version 17.0.10.8 to fix a highly critical vulnerability. The update is available from RealPlayer’s website.

Siber Systems RoboForm: Siber Systems has released version 7.9.8 of Roboform. Updates are available from within the program, look for the “Check for Update” button on the Help menu or download from the Roboform website.

Current Software Versions

Adobe Flash  14.0.0.125 [Windows 7: IE]

Adobe Flash  14.0.0.125 [Windows 7: Firefox, Mozilla]

Adobe Flash  14.0.0.125 [Windows 8: IE]

Adobe Flash  14.0.0.125 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.07

Dropbox 2.8.4 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 30

Google Chrome 35.0.1916.153

Internet Explorer 11.0.9600.17126

Java SE 7 Update 60 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.4 [Mac OS X]

Skype 6.16.0.105

Newly Announced Unpatched Vulnerabilities

None

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

BlackBerry Multiple Products: Secunia reports that BlackBerry has released an update for its BlackBerry Enterprise Service to fix at least 3 moderately critical vulnerabilities. Update to version 10.2.1 or later. Secunia also reports several moderately critical unpatched vulnerabilities in BlackBerry OS due to a bundled vulnerable version of OpenSSL and at least 2 moderately critical vulnerabilities in BlackBerry Link. No official solution is currently available. Secunia also reports a partial fix to address a security issue in BBM for Android versions prior to 2.2.1.40, BBM for iOS versions prior to 2.2.1.24, Secure Work Space for iOS and Android WorkConnect component. Apply update if available.

Cisco Multiple Products: Secunia reports that Cisco has released updates for its Unified Communications Domain Manager (CUCDM), Universal Small Cell 3000, 5000, 7000, and 9000 Series, and others. Apply updates.

Novell Open Enterprise Server: Secunia reports that Novell has released updates for its Open Enterprise Server and Novell Messenger to fix vulnerabilities reported in Novell Open Enterprise Server 2 (OES 2) SP3 and Novell Open Enterprise Server 11 (OES 11) SP1. Apply updates.


If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

 

Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community


Copyright © 2014 Citadel Information Group. All rights reserved.

The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. The post Weekend Vulnerability and Patch Report, July 6, 2014 appeared first on Citadel Information Group.

Read More | Comments Off on Weekend Vulnerability and Patch Report, July 6, 2014