What appears to be a wide-spread Internet worm hit the campus in the form of a phishing email message. The message slipped through normal spam filters as the worm virus spread to email accounts in the "berkeley.edu" domain.
May 3, 2017
April 13, 2017
This message, appearing to come from the HR department, was successful at convincing several campus recipients to click on the link provided and enter their Calnet credentials. The link was directed to a fake Calnet login page, the account name and password entered on this page would be compromised.
April 1, 2017
This phishing message was received by students across campus, purporting that the student's library account has expired. The Library does not issue emails concerning inactive accounts.
March 9, 2017
Summary
A critical vulnerability has been discovered and released in the Apache Struts 2 framework. Patches are available from Apache. [1]
Impact
This vulnerability allows for unauthenticated, remote code execution on the server. Further, there are at least two known public exploits for this vulnerability [2] and ISP has already started to see scanning and exploit attempts against campus systems.
February 3, 2017
Summary
WordPress has fixed several critical flaws in its content management system, addressing cross-site scripting and sql injection bugs, along with a severe privilege escalation / content injection vulnerability. [1]
January 30, 2017
A recent spate of phishing messages have been received on campus purporting to be Dropbox notifications. The link in the email message to "View File" is a ruse to capture CalNet passphrase credentials.
January 25, 2017
A targeted phishing message was received on campus appearing as an expiration notice for access to bCourses. The message attempted to trick recipients to login with CalNet credentials to prevent access expiration
January 24, 2017
As tax season begins, W-2 wage statements have already begun to be made available online this week. Last year, several convincing phishing messages were crafted by tax scammers and sent to Campus to trick victims into divulging personal information for criminal purposes.
These fraudsters use your stolen credentials and tax documents to commit identity theft, and file a fraudulent tax return with the IRS in order to collect a refund using your identity.
This was the first tax season related phishing message reported on campus this year. Beware of phishing messages containing fake instructions for downloading your W2 form.
January 20, 2017
Campus printers have received unwanted printouts in recent weeks. Report any unwanted printouts to CSS-IT and Information Security and Policy.
January 3, 2017
This very simple phishing message that appeared to be sent from FedEx was effective in convincing several campus recipients to download the PDF attachment. The file contained a link that required password authentication, allowing the attacker to capture these credentials for future use.
December 14, 2016
On Dec. 14th, campus was the target of a phishing email purporting to be from Chancellor Dirks and containing a PDF file attachment with a link to a site intended to steal credentials. Beware of emails with the subject line "Important Announcement from Chancellor B. Dirks".
October 28, 2016
A pretty convincing phishing message that appears to come from CSS-IT issuing a warning that the user's ID may have been compromised.
October 24, 2016
A local privilege escalation vulnerability has been found in the Linux kernel. Nearly all versions of Linux are affected, and when exploited, attackers can escalate local privileges to root. Linux users are advised to patch or implement temporary mitigation immediately.
October 20, 2016
This phishing message, purportedly from Bank of America, contained multiple threats - two file attachments that likely contain malware and a separate ploy to obtain user credentials.
October 5, 2016
October is National Cyber Security Awareness Month (NCSAM), an annual campaign to raise awareness about cyber security. The NCSAM is designed to engage and educate by providing tools and resources to stay safe online, with the goal of increasing resiliency in the event of a cyber incident.
August 24, 2016
There has been a recent spate of email messages to campus containing the Locky ransomware virus in file attachments. The format of the message content is very similar.
July 13, 2016
Highly critical remote code execution vulnerabilities have been announced by the Drupal security team for the third-party modules RESTWS, Coder, and Webform Multiple File Upload. Open Berkeley Drupal sites are NOT affected.
June 29, 2016
Multiple, critical vulnerabilities have been discovered in Symantec products including Symantec Endpoint Protection (SEP), an anti-virus product previously licensed and distributed on campus. Users are advised to remove or upgrade affected Symantec products.
June 13, 2016
Apple has announced that it will no longer support Quicktime on Windows. All users are advised to remove Quicktime on Windows machines as there are multiple zero-day, remote code execution vulnerabilities that Apple has announced they will not be patching.