News

March 2, 2016

The OpenSSL development team published a security advisory regarding high-impact TLS/SSL vulnerabilities, which could allow an attacker to decrypt TLS sessions by using a server supporting legacy ciphers (CVE-2016-0800).

February 22, 2016

A targeted phishing message was received at both Berkeley and UCLA campuses that was purportedly from the UC Office of the President requesting employee's W2 form.
This phish example attempts to trick the recipient into clicking on a link to a malicious website by purporting to be a link to download a Google doc.

February 21, 2016

Another example of a common ploy to trick the recipient into clicking a link to a malicious website by claiming access to ITunes has been disabled.

February 18, 2016

The glibc (since version 2.9) DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo() library function is used. Software using this function may be remotely exploited with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack.

February 9, 2016

An example of a common phishing ploy - a notice that your email password will expire, with a link to change the password that leads to a malicious website.

February 8, 2016

As the 2015 tax deadline approaches, tax scams are ratcheting up.  The IRS has reported an increase in tax scams, especially by phone.  Some of the most common scams involve con-artists who pretend to be from the IRS and call victims telling them they have to pay right now, or else. 

Don't believe it - the IRS has formal processes in place for people with tax issues, and angry harassing calls like these are not how the IRS does business.  The IRS will NEVER:

February 2, 2016

Another example of a phish that attempts to trick the user to click on a link to a malicious website by claiming their password will expire otherwise. This one purports to come from the IT-Service Help Desk.

January 18, 2016

Campus was the target of a phishing email purporting to be from the U.S. Dept of Labor and asking for users to update their employment records. Beware of emails with the subject line "Record Update".

January 15, 2016

The 2016 tax filing season is upon us, beware of messages requesting personal information to be updated online to make your "refund easier".
Phishing message purporting to be from DHL and requesting package delivery confirmation contains links to malware infected website.

January 6, 2016

Several people on campus fell for this phish, which directed the recipient to a fake CalNet login page where credentials were stolen. Beware of tax related phishing exploits, like this one, during this time of year.

January 2, 2016

This spear phishing attack was targeted to campus academic staff. The recipient was asked to share access to research articles, but the embedded link was routed to a fake CalNet login page.

January 1, 2016

This is a forgery example of a commonly used service provider, PayPal. The intent is to fool the recipient into clicking the link directed to a malware infected webpage.

December 15, 2015

A remote code execution vulnerability has been discovered in Joomla versions 1.5.0 to version 2.4.5. Exploits for this vulnerability have been observed in the wild. Patches are available and users are advised to upgrade immediately.

December 10, 2015

This phishing message was forged to appear to come from the UCB Human Resources office. Beware of "URGENT" message from HR concerning "Your New Salary Notification".

November 13, 2015

A serious vulnerability in Apache Commons, a library that contains a widely used set of Java components maintained by the Apache Software Foundation, puts thousands of Java applications and servers at risk of remote code execution attacks.

November 3, 2015

As part of a UC system-wide effort to address the increasing threats to the security of our information systems and data, a comprehensive security awareness training program is being rolled out by UCOP for all staff and faculty.

October 1, 2015

You may have noticed changes to the Information Security and Policy website beginning October 1st!

We've migrated our site to the Open Berkeley platform. The new site includes:

September 22, 2015

On October 20th, 2015, the CalNet login page will undergo important cosmetic and security changes. Read the announcement and preview the new look before the change!