Monday, July 21, 2014

Cyber Security News, Education and Vulnerability Patch Report for the Week of July 21, 2014

Cyber Security News of the Week

 From our friends at Citadel Information Group

Cyber Attack

Chinese Hackers Extending Reach to Smaller U.S. Agencies, Officials Say: WASHINGTON — After years of cyberattacks on the networks of high-profile government targets like the Pentagon, Chinese hackers appear to have turned their attention to far more obscure federal agencies. The New York Times, July 15, 2014
Why were this company’s computers attacked millions of times this year? Algae: About 16 months ago, a Florida-based biofuel company called Algenol noticed that its Internet service was slowing down. In checking that out, Jack Voth, Algenol’s information technology chief, stumbled on something odd: a telnet connection to its videoconference camera from an Internet Protocol address in China, a country where Algenol has never sought to do business. The Washington Post, July 12, 2014
Attack Campaign Targets Facebook, Dropbox User Credentials: The goal of the attackers is not fully clear but the credential theft could set up sophisticated targeted attackers. DarkReading, July 11, 2014

Financial Cyber Security

New banking malware ‘Kronos’ advertised on underground forums: A new Trojan program designed to steal log-in credentials and other financial information from online banking websites is being advertised to cybercriminal groups on the underground market. PCWorld, July 14, 2014

Cyber Warning

Vulnerability exposes some Cisco home wireless devices to hacking: Nine of Cisco’s home and small office cable modems with router and wireless access point functionality need software updates to fix a critical vulnerability that could allow remote attackers to completely compromise them. PCWorld, July 17, 2014
Beware Keyloggers at Hotel Business Centers: The U.S. Secret Service is advising the hospitality industry to inspect computers made available to guests in hotel business centers, warning that crooks have been compromising hotel business center PCs with keystroke-logging malware in a bid to steal personal and financial data from guests. KrebsOnSecurity, July 14, 2014
DropCam Vulnerable To Hijacking: Researchers at DEF CON to demonstrate flaws in a popular WiFi video monitoring system. DarkReading, July 14, 2014

Cyber Security Management

SEC Playing Bigger Role in Cybersecurity: Besides clarifying disclosure requirements, the agency is prompting companies to take proactive steps. JDSUPRA, July 14, 2014

Cyber Security Management – Cyber Defense

GOOGLE SET TO CHANGE MALWARE, PHISHING WARNINGS FOLLOWING STUDY: In the not too distant future, Google will change the way it displays malware and phishing warnings in its Chrome browser. ThreatPost, July 15, 2014

Cyber Security Management – Cyber Update

Java Update: Patch It or Pitch It: Oracle today released a security update for its Java platform that addresses at least 20 vulnerabilities in the software. Collectively, the bugs fixed in this update earned Oracle’s “critical” rating, meaning they can be exploited over a network without the need for a username and password. In short, if you have Java installed it is time to patch it or pitch it. KrebsOnSecurity, July 15, 2014

Securing the Village

Meet ‘Project Zero,’ Google’s Secret Team of Bug-Hunting Hackers: When 17-year-old George Hotz became the world’s first hacker to crack AT&T’s lock on the iPhone in 2007, the companies officially ignored him while scrambling to fix the bugs his work exposed. When he later reverse engineered the Playstation 3, Sony sued him and settled only after he agreed to never hack another Sony product. Wired, July 15, 2014

National Cyber Security

Justice Department’s New Crime Chief Targets Cyber Cases: WASHINGTON—International organized crime groups, lured by the prospect of thefts that can net hundreds of millions of dollars, increasingly are turning to cybercrime, said the new head of the Justice Department’s criminal division. The Wall Street Journal, July 14, 2014

Cyber Misc

How Russian Hackers Stole the Nasdaq: In October 2010, a Federal Bureau of Investigation system monitoring U.S. Internet traffic picked up an alert. The signal was coming from Nasdaq (NDAQ). It looked like malware had snuck into the company’s central servers. There were indications that the intruder was not a kid somewhere, but the intelligence agency of another country. More troubling still: When the U.S. experts got a better look at the malware, they realized it was attack code, designed to cause damage. Bloomberg, July 17, 2014

share on TwitterLike Weekend Vulnerability and Patch Report, July 20, 2014 on Facebook

Weekend Vulnerability and Patch Report, July 20, 2014

Important Security Updates

AVG Free Edition: AVG has released version 2014.0.4744 of its 32 bit Free Edition. Updates are available on AVG’s website.
Dropbox: Dropbox has released version 2.10.2 for its file hosting program. Updates are available at Dropbox’s website. [See Citadel's warning below]
Google Chrome: Google has released Google Chrome 36.0.1985.125 for Windows, Mac, Linux, and Chrome Frame to fix at least 2 moderately critical unpatched vulnerabilities in previous versions. Updates are available from within the browser or from Google Chrome’s website.
Google Chrome for Android: Google has released version 36.0.1985.122 of Chrome for Android to fix at least 2 unpatched vulnerabilities in previous versions. Updates are available through the program or device.
Oracle Java: Oracle has released Java SE 7 Update 65 to fix at least 20 vulnerabilities, some of which are highly critical. The update is available through Windows Control Panel or Java’s website. [See Citadel's recommendation below]

Current Software Versions

Adobe Flash [Windows 7: IE]
Adobe Flash [Windows 7: Firefox, Mozilla]
Adobe Flash [Windows 8: IE]
Adobe Flash [Macintosh OS X: Firefox, Opera, Safari]
Adobe Reader 11.0.07
Dropbox 2.10.2 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]
Firefox 30
Google Chrome 36.0.1985.125
Internet Explorer 11.0.9600.17126
Java SE 7 Update 65 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]
QuickTime 7.7.5
Safari 5.1.7 
Safari 7.0.4 [Mac OS X]

Newly Announced Unpatched Vulnerabilities

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website.

For Your IT Department

Cisco Multiple Products: Secunia reports that Cisco has released updates for its SPA300 / SPA500 Series, WebEx Meetings Server and Meeting Center, Adaptive Security Appliance (ASA), Unified Contact Center Express, Unified Communications Manager, Wireless Residential Gateway, Identity Services Engine (ISE), Unified Contact Center Enterprise, multiple Wireless Residential Gateway products, and others. Apply updates. Secunia report several unpatched vulnerabilities in Cisco Unified Communications Domain Manager (CUCDM), Business Edition 3000 and others. No official solution is available.
Citrix NetScaler: Secunia reports that Citrix has released updates for its NetScaler and NetScaler Gateway to fix 2 vulnerabilities. Update to version 10.1-126.12.
Citrix XenDesktop: Secunia reports that Citrix has released updates for it’s XenDesktop to fix a vulnerability reported in the following products and versions: Citrix XenDesktop 5.6 Common Criteria, Citrix XenDesktop 5.6 x32, Citrix XenDesktop 5.6 x64, Citrix XenDesktop 7, Citrix XenDesktop 7.1, Citrix XenDesktop 7.5. Apply updates.
Citrix XenServer: Secunia reports that Citrix has released updates for it’s XenServer to fix 2 moderately critical vulnerabilities and a security issues.  Apply updates.
Oracle Multiple Products: Both Secunia and US-Cert report that Oracle has released updates to fix more than 100 vulnerabilities, some of which are highly critical, for Oracle Linux for java-1.7.0-openjdk, Solaris, Hyperion Provider Services, Hyperion Common Admin, Hyperion Business Intelligence Plus, Hyperion Essbase, Siebel CRM, Communications Messaging Server, Secure Global Desktop, Agile Product Collaboration, E-Business Suite, BI Publisher, BI Publisher, PeopleSoft Enterprise Supply Chain Management (SCM), Retail Returns Management, PeopleSoft Enterprise Financial Management Solutions (FMS), PeopleSoft PeopleTools, PeopleSoft Enterprise Learning Management, Glassfish Communications Server, Glassfish Server, Retail Back Office and Oracle Retail Central Office, JDeveloper, WebLogic Server, WebCenter Portal, iPlanet Web Server, iPlanet Web Proxy Server, Traffic Director, Hyperion Enterprise Performance Management Architect, Database, MySQL Server, Transportation Management, VM VirtualBox, JRockit, ISC BIND included in Solaris, and others. Apply updates.

If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.
If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.
Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.
Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.
Copyright © 2014 Citadel Information Group. All rights reserved.'s Security Recruiter Blog