News

October 17, 2017

KRack - Serious Weaknesses in WPA2

Researchers have discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks.  This includes everything from computers, tablets, phones, home wireless routers and any device that supports WPA2 over Wi-Fi.

While details are still emerging, not all vendors have released patches as of yet.  So, in some cases, there will be little users can do until patches are released.   An attacker needs to be in range of an access-point to leverage this attack.  

September 6, 2017

Apache Struts Remote Code Execution Vulnerability (CVE-2017-9805)

Summary

A critical vulnerability has been discovered in the Apache Struts web application framework for Java web applications. A remote code execution attack is possible when using the Apache Struts REST plugin with XStream handler to deserialise XML requests. [1]

Impact

Attackers can execute arbitrary code remotely by exploiting this vulnerability.

July 17, 2017

bSecure Town Hall Events July 25th & July 27th

The bSecure team invites you to join us for a series of Town Hall events this month. All are welcome and existing Campus firewall customers are strongly encouraged to attend.

What?

The purpose of these Town Hall events is to introduce Campus to the bSecure project and its team. Topics will include:

June 14, 2017

Windows Search Remote Code Execution Vulnerability (CVE-2017-8543)

Summary

A remote code execution vulnerability exists when Windows Search handles objects in memory.  This can be exploited by an attacker sending a specially crafted SMB message to the Windows Search service. [4]

Due to recent nation-state activity and the elevated risk of potential cyber attacks, Microsoft has released security updates for older unsupported versions of Windows for this issue as well as other high-severity fixes in the June patch release. [1]

June 1, 2017

bSecure Project Launched

bSecure is the new initiative from the Network Operations & Services and Information Security & Policy teams to replace legacy firewalls and VPN, and provide proactive security technologies to Campus.

You can access all bSecure project information at http://bsecure.berkeley.edu or https://security.berkeley.edu/projects/bsecure.

May 25, 2017

Samba > 3.5.0 Remote Code Execution (CVE-2017-7494)

Summary

The samba team has released a patch for a Remote Code Execution bug that affects all versions between 3.5.0 and 4.6.3/4.5.9/4.4.13. This vulnerability will allow a malicious attacker to upload a library to a writable share then cause the server to execute that library. [1] Patches are available from the samba.org. [2]

Impact

May 3, 2017

Global Google Phishing Alert

To the campus community,

On Wednesday, May 3rd, we learned of a global phishing attack targeting the nearly 1 billion people who use Google email, including members of the campus community. You may have received an email that a Google Doc had been shared with you by a person you know. These were fraudulent emails sent as part of that cyber attack.

Phishing Example: Google Doc Phishing Message
What appears to be a wide-spread Internet worm hit the campus in the form of a phishing email message. The message slipped through normal spam filters as the worm virus spread to email accounts in the "berkeley.edu" domain.

April 13, 2017

Phishing Example: Message from human resources
This message, appearing to come from the HR department, was successful at convincing several campus recipients to click on the link provided and enter their Calnet credentials. The link was directed to a fake Calnet login page, the account name and password entered on this page would be compromised.

April 1, 2017

Phishing Example: Library Account
This phishing message was received by students across campus, purporting that the student's library account has expired. The Library does not issue emails concerning inactive accounts.

March 9, 2017

CRITICAL Apache Struts 2.x Vulnerability (CVE-2017-5638)

Summary

A critical vulnerability has been discovered and released in the Apache Struts 2 framework. Patches are available from Apache. [1]

Impact

This vulnerability allows for unauthenticated, remote code execution on the server. Further, there are at least two known public exploits for this vulnerability [2] and ISP has already started to see scanning and exploit attempts against campus systems.

February 3, 2017

WordPress 4.7.2 Security Release

Summary

WordPress has fixed several critical flaws in its content management system, addressing cross-site scripting and sql injection bugs, along with a severe privilege escalation / content injection vulnerability. [1]

January 30, 2017

Phishing Example: Your Dropbox File
A recent spate of phishing messages have been received on campus purporting to be Dropbox notifications. The link in the email message to "View File" is a ruse to capture CalNet passphrase credentials.

January 25, 2017

Phishing Example: bCourses Expiration Notice
A targeted phishing message was received on campus appearing as an expiration notice for access to bCourses. The message attempted to trick recipients to login with CalNet credentials to prevent access expiration

January 24, 2017

Phishing Example: First 2017 Tax Season Phish
This was the first tax season related phishing message reported on campus this year. Beware of phishing messages containing fake instructions for downloading your W2 form.
Protect Yourself Against Tax Fraud

As tax season begins, W-2 wage statements have already begun to be made available online this week.  Last year, several convincing phishing messages were crafted by tax scammers and sent to Campus to trick victims into divulging personal information for criminal purposes.

These fraudsters use your stolen credentials and tax documents to commit identity theft, and file a fraudulent tax return with the IRS in order to collect a refund using your identity.

January 20, 2017

Unwanted Printouts Hitting Campus Printers
Campus printers have received unwanted printouts in recent weeks. Report any unwanted printouts to CSS-IT and Information Security and Policy.

January 3, 2017

Phishing Example: FedEx Shipment Update
This very simple phishing message that appeared to be sent from FedEx was effective in convincing several campus recipients to download the PDF attachment. The file contained a link that required password authentication, allowing the attacker to capture these credentials for future use.

December 14, 2016

Phishing Example: Important Announcement from Chancellor Dirks
On Dec. 14th, the campus was the target of a phishing email purporting to be from Chancellor Dirks and containing a PDF file attachment with a link to a site intended to steal credentials. Beware of emails with the subject line "Important Announcement from Chancellor B. Dirks".

October 28, 2016

Phishing Example: Email Account Upgrade
A pretty convincing phishing message that appears to come from CSS-IT issuing a warning that the user's ID may have been compromised.