News

This phishing message was received by students across campus, purporting that the student's library account has expired. The Library does not issue emails concerning inactive accounts.

Summary

A critical vulnerability has been discovered and released in the Apache Struts 2 framework. Patches are available from Apache. [1]

Impact

This vulnerability allows for unauthenticated, remote code execution on the server. Further, there are at least two known public exploits for this vulnerability [2] and ISP has already started to see scanning and exploit attempts against campus systems.

Summary

WordPress has fixed several critical flaws in its content management system, addressing cross-site scripting and sql injection bugs, along with a severe privilege escalation / content injection vulnerability. [1]

A recent spate of phishing messages have been received on campus purporting to be Dropbox notifications. The link in the email message to "View File" is a ruse to capture CalNet passphrase credentials.

A targeted phishing message was received on campus appearing as an expiration notice for access to bCourses. The message attempted to trick recipients to login with CalNet credentials to prevent access expiration

Campus printers have received unwanted printouts in recent weeks. Report any unwanted printouts to CSS-IT and Information Security and Policy.

This very simple phishing message that appeared to be sent from FedEx was effective in convincing several campus recipients to download the PDF attachment. The file contained a link that required password authentication, allowing the attacker to capture these credentials for future use.

On Dec. 14th, the campus was the target of a phishing email purporting to be from Chancellor Dirks and containing a PDF file attachment with a link to a site intended to steal credentials. Beware of emails with the subject line "Important Announcement from Chancellor B. Dirks".

A pretty convincing phishing message that appears to come from CSS-IT issuing a warning that the user's ID may have been compromised.

A local privilege escalation vulnerability has been found in the Linux kernel. Nearly all versions of Linux are affected, and when exploited, attackers can escalate local privileges to root. Linux users are advised to patch or implement temporary mitigation immediately.

This phishing message, purportedly from Bank of America, contained multiple threats - two file attachments that likely contain malware and a separate ploy to obtain user credentials.

There has been a recent spate of email messages to campus containing the Locky ransomware virus in file attachments. The format of the message content is very similar.

Highly critical remote code execution vulnerabilities have been announced by the Drupal security team for the third-party modules RESTWS, Coder, and Webform Multiple File Upload. Open Berkeley Drupal sites are NOT affected.

Multiple, critical vulnerabilities have been discovered in Symantec products including Symantec Endpoint Protection (SEP), an anti-virus product previously licensed and distributed on campus. Users are advised to remove or upgrade affected Symantec products.

Apple has announced that it will no longer support Quicktime on Windows. All users are advised to remove Quicktime on Windows machines as there are multiple zero-day, remote code execution vulnerabilities that Apple has announced they will not be patching.

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild. Please refer to APSA16-02 for additional details.

Another targeted phishing message, this one has been spoofed to appear to come from the Office of the Registrar.

Several people on campus reported this targeted phishing message concerning access to bCourses. The message was signed by a fictitious member of the Security department.