Monday, August 11, 2014

Cyber Security News, Education and Vulnerability Patch Report for the Week of August 11, 2014

Cyber Security News of the Week

From our friends at Citadel Information Group

Cyber Crime – Citadel On Security
With latest Russian hack, should we move beyond passwords for web security?: Stan Stahl Speaks on AirTalk with Larry Mantle. A Russian crime syndicate has apparently stolen over 1 billion internet usernames and passwords from hundreds of thousands of websites, the New York Times is reporting. Hold Security, a cybersecurity firm in Milwaukee, first made the discovery. According to the firm’s founder Alex Holden, the hackers targeted not only US companies that are household names, but pretty much any website they could break into. KPCC Radio, August 6, 2014

Cyber Crime
Target (TGT) stock tumbles; data breach will cost $148 million (+video): Target (TGT) lowered its second-quarter forecast Tuesday, saying it expects expenses tied to a massive data breach this past winter to come to $148 million. Target has been reeling since it announced in December that hackers stole millions of customers’ credit- and debit-card records. The Christian Science Monitor, August 5, 2014

P.F. Chang’s data breach hits 33 restaurants in 16 states (+video): P.F. Chang’s is providing more details on its ongoing investigation into a security breach first reported in June. The list of P.F. Chang’s restaurant locations where customers’ credit and debit card data may have been stolen includes 33 locations across the United States. The Christian Science Monitor, August 4, 2014

Cyber Privacy
Teens Are Waging a Privacy War on the Internet — Why Marketers Should Listen:Back in the early days of social media, Danah Boyd was asked to participate on a panel alongside some representatives from various consumer brands. A fellow panelist who worked at Coca-Cola commented with satisfaction that his company was the most popular brand on MySpace. Without meaning to, Boyd (who writes her name in all lowercase letters) laughed audibly. At the moderator’s prompting, she explained that she, too, had noticed how popular Coke was on the site, and investigated. The most popular “brand” turned out to be not the soft drink, but cocaine. Wharton University of Pennsylvania, August 5, 2014

Identity Theft
How to Keep Data Out of Hackers’ Hands: The numbers sound abstract: Hundreds of millions of email addresses and other types of personal identification found in the hands of Russian hackers. For people worried that they are caught in the mix, however, the discovery by Hold Security of a huge database of stolen data is very personal. But personal doesn’t mean helpless. There are common sense steps everyone can take to keep the impact of hackers to a minimum. The New York Times, August 5, 2014

Russian Hackers Amass Over a Billion Internet Passwords: A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say. The New York Times, August 5, 2014
Financial Cyber Security
Financial institutions and Cybercrime: It’s only just begun: A recent bout of high profile cyber-attacks on financial institutions across the UK, US and Canada has put the spotlight back on the importance of data security and the need to be diligent when it comes to cybersecurity within the banking industry, writes Alex Raistrick. BankingTech, July 28, 2014

Cyber Warning
Researcher says PayPal’s two-factor authentication is easily beaten: A security feature offered by PayPal to help prevent accounts from being taken over by hackers can be easily circumvented, an Australian security researcher has found. PC World, August 4, 2014

Stealthy, tricky ‘Poweliks’ malware hides in your system registry – but not your hard drive: A new malware program called Poweliks attempts to evade detection and analysis by running entirely from the system registry without creating files on disk, security researchers warn. PCWorld, August 4, 2014

U.S. government warns retailers about malicious software: BOSTON (Reuters) – The U.S. Department Of Homeland Security warned retailers about a type of malicious software attacking point-of-sales systems, dubbed “Backoff,” that it said is undetectable by most types of anti-virus software. MSN, August 1, 2014

Cyber Security Management
Securing the eCampus: Ten Observations About Cyber Security in Academia: I recently gave the keynote address at “Securing the eCampus,” a gathering of university CIOs and CISOs hosted by Dartmouth College. Drawing on my fifteen years of experience in the kinetic security world, running a security software company, and serving on the Board of Trustees at Dartmouth, I offered ten observations on the cyber landscape, especially as it pertains to academic environments: EndGame, August 2014

A Tough Corporate Job Asks One Question: Can You Hack It?: SAN FRANCISCO — Pity the poor chief information security officer. The profession barely existed a generation ago. But to combat the growing threat of online breaches, companies and governments are hiring executives whose main responsibility is to make sure data systems are secure. When things go wrong — and they often do — these executives expect to bear the blame. The New York Times, July 20, 2014

Don’t Be the Next Target — IT Security Spending Priorities 2014: Sound planning of the IT security budget requires a superficial look at market averages. Beware media hype, focus on business requirements and consider what peers in your industry and region are investing in. Gartner, April 8, 2014

Cyber Secuity Management – Cyber Defense
In Fight With Hackers, We Are on Our Own: Call it the hack whipsaw. A computer security company — it is rarely a government entity — comes out with a new report. Millions of stolen passwords. Tens of millions. No, hundreds of millions. The point is apparent: This is a big deal. Then it becomes clear this company is not simply informing the world out of some sort of noblesse oblige: It is trying to make money. The New York Times, August 7, 2014

New Site Recovers Files Locked by Cryptolocker Ransomware: Until today, Microsoft Windows users who’ve been unfortunate enough to have the personal files on their computer encrypted and held for ransom by a nasty strain of malware called CryptoLocker have been faced with a tough choice: Pay cybercrooks a ransom of a few hundred to several thousand dollars to unlock the files, or kiss those files goodbye forever. That changed this morning, when two security firms teamed up to launch a free new online service that can help victims unlock and recover files scrambled by the malware. KrebsOnSecurity, August 6, 2014

Cyber Security Management – HIPAA
HIPAA Omnibus Rule compliance tips for healthcare law firms: In addition to covered entities, it is widely known that the HIPAA Omnibus Rule had a significant impact on business associates (BAs) and subcontractors. Interestingly, law firms that help covered entities comply with HIPAA regulations are often BAs themselves, so they were forced to make changes to the ways they handle protected health information (PHI). HealthITSecurity, August 1, 2014

Cyber Awareness
How To Talk To Your Employees About Cybersecurity (Without Putting Them To Sleep): You can just see the eye-rolls across the conference table when you bring it up. It may not be tops on the list of things you want to address at a staff meeting, but cybersecurity is an issue that likely effects every one of your employees, everyday, and if you’re delegating it to one person at the back of the IT department, you’re making a big mistake. Forbes, August 6, 2014

Cyber Underworld
The World’s Top 5 Cybercrime Hotspots: A Russian crime ring is suspected of obtaining access to a record 1.2 billion username and password combinations, shedding renewed light on how vulnerable online personal information can be. Cybersecurity firm Hold Security said the gang of hackers was based in a city in south central Russia and comprised roughly ten men in their twenties who were all personally acquainted with each other, the New York Times reported. Time, August 7, 2014

‘White Label’ Money Laundering Services: Laundering the spoils from cybercrime can be a dicey affair, fraught with unreliable middlemen and dodgy, high-priced services that take a huge cut of the action. But large-scale cybercrime operations can avoid these snares and become much more profitable when they’re able to disguise their operations as legitimate businesses operating in the United States, and increasingly they are doing just that. KrebsOnSecurity, August 4, 2014

Cyber Misc
Google Says Website Encryption – Or Lack Thereof – Will Now Influence Search Rankings: Google will begin using website encryption, or HTTPS, as a ranking signal – a move which should prompt website developers who have dragged their heels on increased security measures, or who debated whether their website was “important” enough to require encryption, to make a change. Initially, HTTPS will only be a lightweight signal, affecting fewer than 1% of global queries, says Google. TechCrunch, August 7, 2014
Cyber Sunshine

The FBI Is Infecting Tor Users with Malware to Catch Kiddie Porn Creeps: Tor’s had a tough week. Just a few days ago, the organization made the difficult announcement that an attack on their system likely stripped users of anonymity. Now, Wired reports that the FBI effort has been running a campaign to identify Tor users by installing malware on their computers for years, virtually unchecked by the courts. Gizmodo, August 4, 2014

Vulnerability and Patch Report, August 11, 2014

Important Security Updates

Apple iTunes: Apple has released version 11.3.1 of iTunes for Windows (64-bit). Updates are available from Apple’s website.

Foxit Reader: Foxit has released version to fix a moderately critical vulnerability. Updates are available through the program or from Foxit’s website.

Opera: Opera has released version 23.0.1522.72 to fix moderately critical vulnerabilities. Updates are available from within the browser or from Opera’s website

Oracle Java: Oracle has released Java SE 7 Update 67. The update is available through Windows Control Panel or Java’s website. [See Citadel's recommendation below]

Current Software Versions

Adobe Flash [Windows 7: IE]
Adobe Flash [Windows 7: Firefox, Mozilla]
Adobe Flash [Windows 8: IE]
Adobe Flash [Macintosh OS X: Firefox, Opera, Safari]
Adobe Reader 11.0.07
Dropbox 2.10.3 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]
Firefox 31.0
Google Chrome 36.0.1985.125
Internet Explorer 11.0.9600.17126
Java SE 7 Update 67 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]
QuickTime 7.7.5
Safari 5.1.7 
Safari 7.0.4 [Mac OS X]

Newly Announced Unpatched Vulnerabilities

For an updated list of previously announced Unpatched Vulnerabilities, please see theresources section of Citadel’s website.

For Your IT Department

Cisco Multiple Products: Secunia reports that Cisco has released updates for its IOS Software and IOS XE Software, Unity Connection and others. Apply updates. Secunia reports that Cisco has released a partial fix for its TelePresence Products. Update or upgrade to version 1.10.7:3 or 6.1.4:4.

McAfee Network Security Manager: Secunia reports that McAfee has released updates for its Network Security Manager to fix a vulnerability. Update to version,,,, or

OpenSSL Multiple Products: Secunia reports that vulnerabilities, some of which are moderately critical, are reported in previous versions. Update to version 0.9.8zb or update to version 1.0.0n or 1.0.1i.

If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Copyright © 2014 Citadel Information Group. All rights reserved.'s Security Recruiter Blog