Blog

By Nancy Rand, Posted in Uncategorized

June 3, Help Net Security – (International) Weak SSH keys opened many GitHub repositories to compromise. A security researcher discovered that large numbers of GitHub repositories are vulnerable to compromise and the delivery of malicious code due to a flaw that generated weak cryptographic secure shell (SSH) keys until 2008. Source June 3, Help Net Security – (International) IoT devices entering enterprises, opening company networks to attacks. A recently released OpenDNS report on Internet of Things (I... read more.

• June 04, 2015

By Nancy Rand, Posted in Security

June 2, Securityweek – (International) Exploit for recently patched Flash flaw added to Magnitude, Neutrino, Nuclear Pack. Security researchers from Kafeine discovered that the Magnitude, Neutrino, and Nuclear Pack exploit kits (EKs) are leveraging a recently published Adobe Flash Player memory corruption vulnerability to deliver variants of the Andromeda malware and CryptoWall ransomware. Source June 2, Softpedia – (International) Dyre banking trojan aims at Europe and North America, infections double u... read more.

• June 04, 2015

By Ken Phelan, Posted in Virtualization

My daughter Joyce is graduating this week with a Master’s Degree in Occupational Therapy (#joytheot). Joyce has spent some time educating me on Occupational Therapy, and one of the concepts that I really like is OT’s position on Client Centered Care. I think there is a message there for us in the IT industry. Client Centered Care starts with getting its goals directly from the client. If I was to be in some kind of accident, the healthcare industry would work to put me back together. They would try to re... read more.

• June 02, 2015

By Nancy Rand, Posted in Security

June 1, IDG News Service – (International) Apple vulnerability could allow firmware modifications, researcher says. A security researcher discovered a vulnerability in the firmware of Apple computers made before mid-2014 in which an attacker could tamper with the system’s unified extensible firmware interface (UEFI) and install a rootkit by exploiting a flaw that unlocks UEFI code when a computer goes to sleep and reawakens. Source May 30, Softpedia – (International) Blue coat patches SSL visibility appl... read more.

• June 02, 2015

By Nancy Rand, Posted in Security

May 29, Softpedia – (International) Non-sophisticated malware steals thousands of credentials from targeted SMBs. Security researchers from Kaspersky discovered a large malware campaign, dubbed Grabit that has infiltrated small and medium businesses worldwide across a variety of sectors with a commercial keylogger called HawkEye and several remote administration tools (RATs) distributed via emails containing malicious macro-laden Microsoft Word documents. The researchers reported that the campaign has colle... read more.

• June 01, 2015

By Nancy Rand, Posted in Security

May 28, Softpedia – (International) Apache Cordova glitch allows tampering with mobile app behavior. A security researcher at Trend Micro discovered a high-severity security flaw in Android apps built with Apache Cordova which could allow an attacker to use locally compromised apps or remote web servers to inject malicious intent bundles by taking advantage of default behavior preferences in the Cordova framework. Source May 27, Softpedia – (International) Flash Player vulnerability exploited 2 weeks aft... read more.

• May 29, 2015

By Nancy Rand, Posted in Security

May 26, Securityweek – (International) New Linux-based router worm used in social network scheme. Security researchers at ESET discovered a new piece of malware, known as Moose, that primarily spreads by compromising unsecure Linux-based consumer routers and can eavesdrop on communications. Compromised devices steal unencrypted network traffic, mostly from social network sites, and act as a proxy service for botnet operators. Source May 26, Associated Press– (National) IRS says thieves stole tax info fro... read more.

• May 29, 2015

By Nancy Rand, Posted in Security

May 26, Softpedia – (International) Apache HBase fixes denial-of-service, info disclosure flaw. Apache released a fix for a vulnerability in its HBase software in which a remote attacker with network access could create a denial-of-service (DoS) condition and read sensitive information by exploiting insecure Access Control Lists (ACLs) on the ZooKeeper quorum. Source May 26, Securityweek – (International) Synology fixes XSS, command injection vulnerabilities in NAS software. Taiwan-based Synology release... read more.

• May 27, 2015

By Nancy Rand, Posted in Security

May 22, Softpedia – (International) Apache Hive infrastructures vulnerable to authentication flaw in HiveServer2. Apache reported that a vulnerability in all versions of its HiveServer2 interface for Apache Hive enterprise data warehouse infrastructure in which users without proper credentials could gain access by exploiting a flaw in the Lightweight Directory Access Protocol (LDAP) authentication mode. The company recommended that users update to the newest version or disable unauthenticated binds in the L... read more.

• May 26, 2015

By Nancy Rand, Posted in Security

May 20, Softpedia – (International) TLS protocol flawed, HTTPS connections susceptible to FREAK-like attack. Cryptography and security researchers discovered that approximately 8.4 percent of the top one million domains containing mail and web servers are vulnerable to an attack dubbed Logjam, in which an attacker could compromise a secure communication between a client and server by downgrading the transport layer security (TLS) connection to 512-bit export-grade cryptography due to left over variants of t... read more.

• May 26, 2015