On Tuesday Microsoft and Adobe issued patches to resolve critical vulnerabilities in their products.  Microsoft released 14 patch bundles that resolve 50 vulnerabilities and Adobe addressed 29 security vulnerabilities with its patch for the Flash player plug in.  

Microsoft's security bulletin for September 2016 can be found here.

Adobe’s advisory for this Flash Update is here. It brings Flash to v. 23.0.0.162 for Windows and Mac users. If you have Flash installed, you should update as soon as possible or remove it entirely. 

WordPress 4.6 and earlier versions are affected by two critical vulnerabilities. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected website.

US-CERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPress 4.6.1 immediately.

Source:  https://www.us-cert.gov/ncas/current-activity/2016/09/07/WordPress-Releases-Security-Update

Dropbox has recently confirmed the claim that a 5GB archive of files which contain hashed passwords and email addresses for 68,680,741 accounts is real.  Dropbox sent out emails earlier this week alerting it's users that a vast majority of it's users credentials were compromised in 2012 and that these credentials may soon be seen on the Dark Web marketplace.  If a user had not changed their password since the middle of 2012 Dropbox will prompt them to change their password.

What should you do?

Change your password to Dropbox immediately as well as any other accounts which use that same password.

Always use a password manager to avoid having to remember all the passwords you use in your daily life and to also help you create strong complex passwords.  The same password should never be used on multiple sites.

Turn on two factor authentication for your Dropbox account. You can find instructions here.

The Federal Trade Commission has released a warning to be cautious about charity scams involving the victims of the Louisiana flood. They urge for everyone to follow these tips when asked to give:

• Donate to charities you know and trust with a proven track record with dealing with disasters.

• Be alert for charities that seem to have sprung up overnight in connection with current events. Check out the charity with the Better Business Bureau's (BBB) Wise Giving Alliance, Charity Navigator, Charity Watch, or GuideStar.

• Designate the disaster so you can ensure your funds are going to disaster relief, rather than a general fund.
• Never click on links or open attachments in e-mails unless you know who sent it. You could unknowingly install malware on your computer.
• Don’t assume that charity messages posted on social media are legitimate. Research the organization yourself.

• When texting to donate, confirm the number with the source before you donate. The charge will show up on your mobile phone bill, but donations are not immediate. It can take as long as 90 days for the charity to receive the funds.

• Find out if the charity or fundraiser must be registered in your state by contacting the National Association of State Charity Officials. If they should be registered, but they're not, consider donating through another charity.

Source:  https://www.consumer.ftc.gov/blog/helping-victims-flooding-louisiana-make-sure-your-donations-count

Wouldn't it be nice if there was a site that has a comprehensive list of websites and whether or not they support two-factor authentication?  This way you could use this information before deciding on a bank to use for example or a cloud provider.  This would also be an indication on whether security is a priority for a particular company.  

There is a great site at https://twofactorauth.org which has such a list and also breaks down the type of two-factor authentication that is used.  If a website does not offer two-factor authentication there is a handy link where you can send a tweet to the company to request they add two-factor authentication to their site.  

This website was Developed by Josh Davis who is a computer science student and is kept up to date and added to by many contributors since the site is open source and available on GitHub.  

Check it out!

Cisco has released security updates to address vulnerabilities in several products. Exploitation of some of these vulnerabilities could allow an unauthenticated remote attacker to take control of an affected system.
Users and administrators are encouraged to review the following Cisco Security Advisories and apply the necessary updates:

• Cisco Firepower Management Center Privilege Escalation Vulnerability
• Cisco Firepower Management Center Remote Command Execution Vulnerability
• Cisco Application Policy Infrastructure Controller Enterprise Module Remote Code Execution Vulnerability
• Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability
• Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
• Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
• Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
• Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
• Cisco Firepower Management Center Cross-Site Scripting Vulnerability
• Cisco IP Phone 8800 Series Denial of Service Vulnerability
• Cisco Identity Services Engine Admin Dashboard Page Cross-Site Scripting Vulnerability
• Cisco Smart Call Home Transport Gateway Cross-Site Scripting Vulnerability
• Cisco Unified Communications Manager Information Disclosure Vulnerability
• Cisco WebEx Meetings Server Information Disclosure Vulnerability

Source: https://www.us-cert.gov/ncas/current-activity/2016/08/20/Cisco-Releases-Security-Updates

Black Hat is the most technical and relevant global information security event series in the world. For more than 18 years, Black Hat has provided attendees with the very latest in information security research, development, and trends in a strictly vendor-neutral environment. These high-profile global events and Trainings are driven by the needs of the security community, striving to bring together the best minds in the industry. Black Hat inspires professionals at all career levels, encouraging growth and collaboration among academia, world-class researchers, and leaders in the public and private sectors.

From its inception in 1997, Black Hat has grown from a single annual conference in Las Vegas to the most respected information security event series internationally. Today, the Black Hat Briefings and Trainings are held annually in the United States, Europe and Asia, providing a premier venue for elite security researchers and trainers to find their audience.

Source: https://www.blackhat.com/about.html

Videos from the 2016 conference in Las Vegas can be found here.

Eddie Bauer, a popular clothing store chain,  said yesterday that malicious software has been removed from all of it's point-of-sale (POS) systems following a compromise of its systems in the first half of the year.  Brian Krebs, an investigative reporter who is known for his breaking coverage of cyber crime contacted Eddie Bauer back in July after hearing from his sources who work with fighting fraud.  It took almost 6 weeks before Eddie Bauer came forward to publicly acknowledge the breach which can be viewed here.

For more on this story visit krebsonsecurity.com


About Eddie Bauer:

Eddie Bauer is an active outdoor brand offering premium-quality outerwear, apparel, footwear, accessories and gear. For almost 100 years, Eddie Bauer has been outfitting America; inspiring and enabling people to live their adventure. Eddie Bauer products are available online at www.eddiebauer.com, and at more than 400 stores in the United States, Canada, Germany, Japan, and other international markets.

Yesterday there was confirmation from Kaspersky Lab that the tools for auction by the ShadowBrokers are similar to the malware that the security company researched and disclosed back in 2015.  This malware was determined to come from the Equation Group which has been linked to the National Security Agency or NSA. 

“While we cannot surmise the attacker’s identity or motivation nor where or how this pilfered trove came to be, we can state that several hundred tools from the leak share a strong connection with our previous findings from the Equation group,” researchers from Kaspersky Lab wrote in a post to the Securelist website.

For more on this story click here.

On Friday August 12,  Guccifer 2.0- the online identity behind the hack of the Democratic National Committee took credit for another breach of the Democratic Congressional Campaign Committee.  In order to prove the breach was successful Guccifer 2.0 published a trove of personal identifiable information or PII data belonging to hundreds of Democratic representatives. 

Data contained in an Excel spreadsheet contained a vast amount of information such as home addresses, work and cell phone numbers, personal e-mail addresses, and names of staffers.

For more information on this story click here.