[10236] in Security FYI
[IS&T Security-FYI] SFYI Newsletter, September 8, 2014
daemon@ATHENA.MIT.EDU (Monique Buchanan)
Mon Sep 8 16:43:55 2014
Resent-From: ist-security-fyi@mit.edu
From: Monique Buchanan <myeaton@mit.edu>
To: ist-security-fyi <ist-security-fyi@mit.edu>
Date: Mon, 8 Sep 2014 20:42:43 +0000
Message-ID: <0C14E511-AA88-4B1D-A90F-1A4B444E24B2@mit.edu>
Content-Language: en-US
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0863629883=="
Errors-To: ist-security-fyi-bounces@mit.edu
--===============0863629883==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_0C14E511AA884B1DA90F1A4B444E24B2mitedu_"
--_000_0C14E511AA884B1DA90F1A4B444E24B2mitedu_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
In this issue:
1. Microsoft Security Updates for September 2014
2. Firefox Enhances SSL Security
3. Celebrities=92 iCloud Accounts Breached
4. Home Depot Hit By Malware Similar to Target Breach
------------------------------------------------------------------
1. Microsoft Security Updates for September 2014
------------------------------------------------------------------
Microsoft is planning to release four updates<https://technet.microsoft.com=
/library/security/ms14-sep> this Tuesday, September 9, to address various f=
laws. On the same date Microsoft is also planning to release a new security=
feature for Internet Explorer (IE), called out-of-date ActiveX control blo=
cking and a new version of the Windows Malicious Software Removal Tool.
Affected software being updated includes Windows, IE (rated critical) and L=
ync Server.
Read the full story in the news<http://www.zdnet.com/microsoft-to-patch-win=
dows-ie-lync-server-next-week-7000033324/>.
---------------------------------------------
2. Firefox Enhances SSL Security
---------------------------------------------
Mozilla recently released Firefox 32<https://www.mozilla.org/en-US/firefox/=
32.0/releasenotes/> to improve browser security. The newest incarnation of =
the browser now includes public key pinning<https://wiki.mozilla.org/Securi=
tyEngineering/Public_Key_Pinning> in an effort to protect users from man-in=
-the-middle attacks. =93Key pinning allows site operators to specify which =
certificate authorities (CAs) may issue valid certificates for them, rather=
than accepting any of the many CAs that are trusted.=94 Read the full stor=
y in the news<http://www.eweek.com/cloud/firefox-32-debuts-with-improved-ss=
l-security.html>.
Note that this version of Firefox is not currently supported by IS&T. Learn=
more about certificates at MIT<https://ist.mit.edu/certificates>. Supporte=
d browsers at MIT<http://ist.mit.edu/software/browsers>.
------------------------------------------------------
3. Celebrities=92 iCloud Accounts Breached
------------------------------------------------------
Apple has acknowledged that several celebrities=92 iCloud accounts were com=
promised, but the company has said it was done by guessing or stealing logi=
n credentials, rather than breaching Apple=92s iCloud security. According t=
o Apple, these breaches are the result of a =93very targeted attack on user=
names, passwords and security questions.=94
According to security experts, the underlying problem with iCloud is that w=
hile Apple offers two-factor authentication for logging into iCloud and for=
making iTunes purchases, the authentication method did not extend to all a=
reas of iCloud, to back ups, for example.
Read the full story in the news<http://www.darkreading.com/attacks-breaches=
/celeb-hack-is-apple-telling-all-it-knows/a/d-id/1306923?>.
--------------------------------------------------------------------------
4. Home Depot Hit By Malware Similar to Target Breach
--------------------------------------------------------------------------
Security researcher, Brian Krebs, published information on his security blo=
g<http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-targ=
et/> yesterday about the cyber attack on Home Depot. Reportedly, the compro=
mised credit cards were exposed through the same malware that exposed 40 mi=
llion accounts of Target customers in December 2013. He points to a new var=
iant of the malware strain =93BlackPOS,=94 aimed at retail accounts, which =
has the ability to steal credit and debit card information from the physica=
l memory of point-of-sale devices.
If this information is true, then it could mean the same people were respon=
sible in both breaches. Credit card numbers allegedly stolen from Home Depo=
t have appeared on an underground cybercrime shop known as Rescator, which =
has also been seen selling cards stolen in the Target breach. According to =
Krebs, the people involved harbor anti-American sentiments.
Read the story in the news<http://www.cnet.com/news/home-depot-victim-of-sa=
me-malware-that-hit-target-report/>.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Read all archived Security FYI Newsletter articles and submit comments onli=
ne at http://securityfyi.wordpress.com/.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Monique Buchanan
IT Security Communications Coordinator
Information Systems & Technology (IS&T)
Massachusetts Institute of Technology
http://ist.mit.edu/secure
tel: 617.253.2715
--_000_0C14E511AA884B1DA90F1A4B444E24B2mitedu_
Content-Type: text/html; charset="Windows-1252"
Content-ID: <A83F2D7A98E776458B49FDE9ECD274AF@exchange.mit.edu>
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin=
e-break: after-white-space;">
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;">In th=
is issue:</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">1. Microsoft Security U=
pdates for September 2014</div>
<div style=3D"margin: 0px; font-family: Helvetica;">2. Firefox Enhances SSL=
Security</div>
<div style=3D"margin: 0px; font-family: Helvetica;">3. Celebrities=92 iClou=
d Accounts Breached</div>
<div style=3D"margin: 0px; font-family: Helvetica;">4. Home Depot Hit By Ma=
lware Similar to Target Breach</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
-------------------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica;">1. Microsoft Security U=
pdates for September 2014</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
-------------------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Microsoft is planning t=
o <a href=3D"https://technet.microsoft.com/library/security/ms14-sep">
release four updates</a> this Tuesday, September 9, to address various flaw=
s. On the same date Microsoft is also planning to release a new security fe=
ature for Internet Explorer (IE), called out-of-date ActiveX control blocki=
ng and a new version of the Windows
Malicious Software Removal Tool. </div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Affected software being=
updated includes Windows, IE (rated critical) and Lync Server.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;"><a href=3D"http://www.z=
dnet.com/microsoft-to-patch-windows-ie-lync-server-next-week-7000033324/">R=
ead the full story in the news</a>.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
----------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica;">2. Firefox Enhances SSL=
Security</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
----------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Mozilla recently releas=
ed <a href=3D"https://www.mozilla.org/en-US/firefox/32.0/releasenotes/">
Firefox 32</a> to improve browser security. The newest incarnation of the b=
rowser now includes
<a href=3D"https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning"=
>public key pinning</a> in an effort to protect users from man-in-the-middl=
e attacks. =93Key pinning allows site operators to specify which certificat=
e authorities (CAs) may issue valid
certificates for them, rather than accepting any of the many CAs that are =
trusted.=94
<a href=3D"http://www.eweek.com/cloud/firefox-32-debuts-with-improved-ssl-s=
ecurity.html">
Read the full story in the news</a>.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Note that this version =
of Firefox is not currently supported by IS&T. <a href=3D"https://=
ist.mit.edu/certificates">Learn more about certificates at MIT</a>. <a=
href=3D"http://ist.mit.edu/software/browsers">Supported
browsers at MIT</a>.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
-------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica;">3. Celebrities=92 iClou=
d Accounts Breached</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
-------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Apple has acknowledged =
that several celebrities=92 iCloud accounts were compromised, but the compa=
ny has said it was done by guessing or stealing login credentials, rather t=
han breaching Apple=92s iCloud security.
According to Apple, these breaches are the result of a =93very targeted at=
tack on user names, passwords and security questions.=94</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">According to security e=
xperts, the underlying problem with iCloud is that while Apple offers two-f=
actor authentication for logging into iCloud and for making iTunes purchase=
s, the authentication method did not
extend to all areas of iCloud, to back ups, for example. </div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;"><a href=3D"http://www.d=
arkreading.com/attacks-breaches/celeb-hack-is-apple-telling-all-it-knows/a/=
d-id/1306923?">Read the full story in the news</a>.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
---------------------------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica;">4. Home Depot Hit By Ma=
lware Similar to Target Breach</div>
<div style=3D"margin: 0px; font-family: Helvetica;">-----------------------=
---------------------------------------------------</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">Security researcher, Br=
ian Krebs,
<a href=3D"http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malwar=
e-as-target/">
published information on his security blog</a> yesterday about the cyber at=
tack on Home Depot. Reportedly, the compromised credit cards were exposed t=
hrough the same malware that exposed 40 million accounts of Target customer=
s in December 2013. He points to
a new variant of the malware strain =93BlackPOS,=94 aimed at retail accoun=
ts, which has the ability to steal credit and debit card information from t=
he physical memory of point-of-sale devices. </div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">If this information is =
true, then it could mean the same people were responsible in both breaches.=
Credit card numbers allegedly stolen from Home Depot have appeared on an u=
nderground cybercrime shop known as
Rescator, which has also been seen selling cards stolen in the Target brea=
ch. According to Krebs, the people involved harbor anti-American sentiments=
.</div>
<div style=3D"margin: 0px; font-family: Helvetica; min-height: 17px;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;"><a href=3D"http://www.c=
net.com/news/home-depot-victim-of-same-malware-that-hit-target-report/">Rea=
d the story in the news</a>.</div>
<div style=3D"margin: 0px; font-family: Helvetica;"><br>
</div>
<div style=3D"margin: 0px; font-family: Helvetica;">
<div style=3D"margin: 0px;">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</div>
<div style=3D"margin: 0px;">Read all archived Security FYI Newsletter artic=
les and submit comments online at
<a href=3D"http://securityfyi.wordpress.com/"><span style=3D"color: rgb(4, =
46, 238);">http://securityfyi.wordpress.com/</span></a>.</div>
<div style=3D"margin: 0px;">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</div>
<div style=3D"margin: 0px;"><br>
</div>
</div>
<div apple-content-edited=3D"true">
<div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; t=
ext-align: start; text-indent: 0px; text-transform: none; white-space: norm=
al; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-w=
rap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-=
space;">
<div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; t=
ext-align: start; text-indent: 0px; text-transform: none; white-space: norm=
al; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-w=
rap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-=
space;">
<div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; t=
ext-align: start; text-indent: 0px; text-transform: none; white-space: norm=
al; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-w=
rap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-=
space;">
<br>
Monique Buchanan<br>
IT Security Communications Coordinator<br>
Information Systems & Technology (IS&T)<br>
Massachusetts Institute of Technology<br>
<a href=3D"http://ist.mit.edu/secure">http://ist.mit.edu/secure</a><br>
tel: 617.253.2715<br>
<br>
<br>
</div>
</div>
</div>
</div>
<br>
</body>
</html>
--_000_0C14E511AA884B1DA90F1A4B444E24B2mitedu_--
--===============0863629883==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ist-security-fyi mailing list
ist-security-fyi@mit.edu
To Unsubscribe http://mailman.mit.edu/mailman/listinfo/ist-security-fyi
--===============0863629883==--
