News

February 12, 2019

Summary

Open Containers runc is prone to a local command-execution vulnerability. Runc is a command line utility designed to spawn container systems. It is the container runtime that underpins many open source container management systems including Docker, Kubernetes, containerd, Podman, and CRI-O. [1] [3]

January 28, 2019

We all exist in digital form on the Internet. While online you leave a trail of your digital self in the form of cookies, GPS data, social media posts, browser searches, email exchanges... the list goes on. Your footprint is vast and once something is online, it can be there forever.

That’s what Data Privacy Day is all about. Recognizing that owning your online presence will help to protect your identity, finances, and reputation – both now and in the future.

January 24, 2019

W-2 wage statements became available online this week and every year several convincing phishing messages are crafted by tax scammers and sent to Campus to trick victims into giving out personal information. Taxpayers should continue to watch out for fake emails and/or websites looking to steal personal information during the 2019 filing season.  

January 11, 2019

A widely reported spear phishing scam, termed “Business Email Compromise (BEC),” has been targeting universities and other academic institutions. These attacks are spear phishing scams designed to impersonate someone you know in an attempt to gain access to sensitive information or to encourage you to transfer funds or provide gift cards. There has been an increase of these assaults across the University this new year.

December 27, 2018

These are targeted and simple forms of phishing emails designed to get victims to purchase gift cards, the "email compromise" gets its name because the attacker mimics the email of a known sender. However, these can also be sent through a legitimate, albeit hacked account. The messages start out as basic greetings then progress into requests for money or data. Since the content is highly personalized it’s often easy to get hooked.

December 20, 2018

Summary

Microsoft just published an out-of-band patch for Internet Explorer. It fixes a memory corruption vulnerability in the scripting engine. This vulnerability is identified as CVE-2018-8653.

When successfully exploited, Internet Explorer could execute arbitrary code in the context of the current user. To exploit the vulnerability, the victim must just visit a malicious web page delivered through a phishing email or social engineering. [1]

October 4, 2018

The goal of National Cyber Security Awareness Month (NCSAM) – celebrated every October – is to ensure that all Americans have the resources they need to stay safer and more secure online. Check out these offerings to find an event near you, or a webinar of interest.


***highlighted event***

Oct 16, 11AM-1PM
UCOP Cyber Security Awareness Month Forum
UCOP, 1111 Franklin St., Oakland, CA, Lobby 1 Conference Room

September 25, 2018

To our campus community,

We are implementing some necessary updates to our Wi-Fi network that will require some action on your part. On Oct. 2, 2018 at 7 a.m., the Airbears2 and eduroam wireless networks will be updated with a new certificate. After this update is complete, devices attempting to connect to either wireless network will be presented with a message similar to one of the three examples shown below (message will vary based on the device and operating system you are using):

Example 1: MacOS X 10.13 (MacBook Air)

September 19, 2018

This is a reminder that throughout the UC system, we have a shared responsibility of information security. This can mean everything from daily practices around secure passphrases, encrypting laptops, and setting up CalNet 2-Step, all the way to making sure servers have the latest patches and are behind bSecure firewalls. 

New Policy

August 23, 2018

Summary

A critical remote code execution vulnerability has been discovered in Apache Struts, a popular open source framework for developing web applications in the Java programming language. [1] In the past, Apache Struts RCE vulnerabilities have been weaponized in less than 24 hours -- one of which resulted in the Equifax breach that totaled over $600 million in cost. [2]

August 17, 2018

Summary

A vulnerability has been discovered in Oracle Database that could allow for complete compromise of the database, as well as shell access to the underlying server. [1] . The vulnerability resides in the Java Virtual Machine component of the Oracle Database Server and does not require user interaction. The vulnerability allows low-privileged attackers that have Create Session privilege with network access via Oracle Net to compromise the Java VM component.

August 8, 2018

If you an IT Security professional and want to join a talented and dynamic team, check out our available job openings at: https://security.berkeley.edu/about/job-postings

July 12, 2018

NSF’s new Research Terms and Conditions (effective March 1, 2018) require recipients of NSF funding to protect Personally Identifiable Information within the scope of an NSF award.  Article 35 states:  

July 9, 2018

The Campus Policy for Minimum Security Standards for Electronic Information (MSSEI) [1] requires departments to register computer systems and applications containing restricted data.  Restricted Data is defined as "any confidential or personal information that is protected by law or policy, and that requires the highest level of access control and security protections whether in storage or in transit" [2]  and further refined based on adverse business impact into "High" or Protection Level 2 and "Moderate" or Protection Level 1. [3]

June 12, 2018

In the last few months, our office has received an increasing number of laptop theft reports. These incidents occurred both on and off campus, and in varying circumstances, however, in all the recent cases the laptops involved were not configured for Full Disk Encryption (FDE). In a few of these cases, the laptops were used to access sensitive data as part of campus business processes, and the Security team is concerned about possible data exposure due to lost and stolen devices with access to campus protected data. 

April 26, 2018

NOTE: These vulnerabilities are already being exploited in the wild. If you have an affected Drupal site, update IMMEDIATELY!

Summary

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. [1]

March 28, 2018

NOTE: Drupal core developers have stated that exploits for this vulnerability will likely be developed within days. Drupal site owners must take action immediately or risk complete compromise of their sites. 

Summary

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. [1]

Impact

This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. [1]

March 14, 2018

The IST-Telecommunications networking group will begin piloting the new bSecure Campus VPN service in the coming weeks. Eventually, this service will become the replacement for the existing Cisco AnyConnect based Campus Remote Access VPN service.

March 2, 2018

Summary

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow an attacker to execute arbitrary code.  PHP is a programming language originally designed for use in web-based applications with HTML content.  PHP supports a wide variety of platforms and is used by numerous web-based software applications.  [1]

February 22, 2018

Summary

Multiple critical vulnerabilities have been discovered in Drupal core. [1]

Impact

Attackers may be able to view restricted content or add content of their own. Additionally, a JavaScript function in Drupal core may allow attackers to perform cross-site scripting attacks.