Information Technology Security

News and Tips

Watch this page for news and other feature articles that are pertinent to the security of the computing community at the University of South Carolina.

• Microsoft Security Alert (August 2010)
• Malware Incident
• Phishing Attacks
• Tips for Banking Online Securely
• 10 Ways to Protect your Identity

---

Security Advisory - Critical Adobe Flash Player Update

On February 26, Adobe released an emergency security update for Adobe Flash Player. This update is critical to ward off potential hacking attacks on Windows, Macintosh, and Linux computers.

Individuals who have a service level agreement (SLA) agreement with University Technology Services (UTS) will automatically receive the update beginning 4:00 p.m. on February 27. To find out if you have an SLA with UTS, contact your division's technology contact.

Users who do not have an SLA agreement with UTS are encouraged to update Flash Player immediately by going to http://get.adobe.com/flashplayer/.

If you have any questions, please contact the UTS Service Desk at (803) 777-1800, Monday-Friday from 8 a.m.-6 p.m., or via email at servicedesk@sc.edu.

---

Critical Updates for Adobe Reader and Acrobat

On February 20, Adobe released security updates for Adobe Reader and Acrobat. These updates are critical to ward off potential hacking attacks on both Windows and Macintosh computers.

Individuals who have an SLA agreement with University Technology Services (UTS) will receive the updates beginning 3:00 p.m. on February 21. To find out if you have an SLA with UTS, contact your division's technology contact.

It is important that all users install the update immediately, rather than postponing it for a later date. To manually check for the update, choose Help, and then Check for Updates from within Reader and Acrobat.

If you have any questions, please contact the UTS Service Desk at (803) 777-1800, Monday-Friday from 8 a.m.-6 p.m., or via email at servicedesk@sc.edu.

---

Critical Update for Java

Oracle has released security updates for Java 7. These updates are critical to fix multiple critical vulnerabilities on both Windows and Macintosh computers.

Individuals who have an SLA agreement with University Technology Services (UTS) will receive the updates beginning 7:00 a.m. on February 22. To find out if you have an SLA with UTS, contact your division's technology contact.

It is important that all users install the update immediately, rather than postponing it for a later date.

If you have any questions, please contact the UTS Service Desk at (803) 777-1800, Monday-Friday from 8 a.m.-6 p.m., or via email at servicedesk@sc.edu.

---

Users Should Allow Update to Adobe Flash Player

On February 7, Adobe announced that an update to Flash Player is critical to ward off potential hacking attacks. Hackers are sending malware to both Windows and Macintosh computers via websites that use Flash content. In addition, some users may receive bogus emails that encourage them to open a Microsoft Word® attachment that contains a virus or malware.

Beginning next week, individuals who have a SLA agreement with University Technology Services (UTS) will receive the update to Flash Player. It is important that all users install the update immediately, rather than postponing it for a later date.

To find out if you have an SLA with UTS, contact your division's technology contact. The update can be downloaded directly a thttp://get.adobe.com/flashplayer/. 

If you have any questions, please contact the UTS Service Desk at (803) 777-1800, Monday-Friday from 8 a.m.-6 p.m., or via email at servicedesk@sc.edu.

---

Individuals Encouraged to Disable Java Software

Hackers have found a flaw in Java 7 coding that could potentially allow malicious software to be installed on computers, thus increasing the chance of identity theft or the disabling of entire networks.

Beginning immediately, Java should be disabled and/or uninstalled from any system where it is not necessary to complete official university business. If Java cannot be disabled and/or uninstalled, University Technology Services (UTS) IT Security Office recommends installing the latest version of Java, which contains a patch to help reduce the risk of hacking.  NOTE: It is still unclear if the latest version of Java fixes the latest critical security issues. As a result, disabling or uninstalling Java is preferred to updating.

All students, as well as faculty and staff members who do not have a Desktop SLA with University Technology Services (UTS), should follow these directions on how to disable Java: http://www.java.com/en/download/help/disable_browser.xml

UTS will automatically patch computers supported by a Desktop SLA. No action is required for individuals who fall under this category.

If you use more than one browser, it is possible to set-up configurations so Java is only enabled on one. The browser that has Java enabled should only be used when necessary. Instructions can be found here: http://superuser.com/questions/45911/java-different-versions-for-ie-firefox.

If individuals are unable to perform any of the above recommendations, web browsing should only be related to official university work until the newly released patch in installed. By limiting the amount of web browsing, the risk of vulnerability can be significantly reduced.

Java is used on millions of Windows, Mac, and Linux machines in addition to mobile devices around the world to access interactive content or web applications and services.

If you are not sure if you have Java already installed on your computer, visit the Java website. Be sure to only check if you have Java installed; do not actually install it. The Java website can be found at: http://www.java.com/en/download/installed.jsp.

Click here for instructions on how to secure your home PC or click here for instructions on how to secure your home Mac

If you have any questions, please contact the UTS Service Desk at (803) 777-1800, Monday - Friday, 8 a.m. to 6 p.m. or email servicedesk@sc.edu. 

---

January is National Data Privacy Month. The purpose of the effort is to educate individuals on how to protect their privacy and manage their digital footprint.

Educause, a non-profit organization of IT leaders and professionals, developed weekly articles to educate people on data and Internet security. Be sure to check the UTS website each week for valuable information. 

The first article can be accessed here.

---

Malware Incident Briefing

A recent incident involving a University computer infected with malware (a virus), as well as developments in cybercriminal methods, have prompted the UTS IT Security Office to release the following briefings.

Executive Level Briefing (13 minutes)
UTS IT Security Manager Marcos Vieyra gives an executive level briefing of recent and ongoing malware/virus threats to University assets.

Click here to view the video
for Windows Media Player and compatible

 

 

 

 

Q&A Followup (3 minutes)
UTS Public Information Coordinator Kimberly South interviews UTS IT Security Manager Marcos Vieyra regarding recent and ongoing malware/virus threats to University assets.

Click here to view the video
for Windows Media Player and compatible

 

 

 

Technical Briefing (37 minutes)
UTS IT Security Manager Marcos Vieyra gives a technical briefing of recent and ongoing malware/virus threats to University assets, focusing on the "Mebroot/Torpig" species most recently found. This briefing is intended for technical staff. This is a representation of the same information presented by UTS Information Security Officer Tom Webb at the USC Network Manager's meeting of 05-Mar-2010.
Click here to view the video
for Windows Media Player and compatible

 

 

 

Time Indexes:
NOTE - Video begins with approximately 20 seconds of blackout. Please be patient.
00:30 Introduction
01:20 Classes of Threats
02:50 Detecting Compromise
04:50 Torpig/Mebroot Capabilities
07:20 What We Found
09:30 Torpig/Mebroot Log File
10:10 Could My IT Staff Detect This?
11:20 Infection Vector, Syndicated Ads
14:15 Flow of the Attack
15:30 Example of Syndicated Ad Content
17:45 What Could Have Happened?
20:45 How to Detect This
22:45 How to Prevent This
24:30 Detecting Future Threats
27:30 Long-Term Risk Management
30:40 References
31:30 Network Managers Q&A Recap

Back to top

---

January 26, 2010
University Phishing Response

In response to the increase in phishing attacks, USC has begun to implement several measures intended to reduce the number of e-mail accounts compromised by phishing. For more information, see the USC Phishing Response web page.

The number of malicious e-mails arriving in University mailboxes continues to rise.

TIPS:

1. University policy forbids anyone to ask you for your password, and forbids you to share your password with anyone. When an account is detected sending spam, the University does not attempt any contact via that account, but blocks it immediately, as it is presumed to be under control of a spammer.
2. Links sent within e-mails should be considered untrustworthy. Even experienced computer professionals can be tricked into following links to malicious websites.
3. Regardless of how innocent the message may appear to be, links sent within e-mails should be considered untrustworthy.
4. It is sometimes difficult to tell whether an electronic greeting card notification is legitimate. In the the example below the link supplied for retrieving the eCard (www.campagnaviaggi.it) is different from the legitimate eCard company's website (www.greetingcard.org). However, links within e-mail are often disguised better than this one. Often they are disguised in such a way that they show one web address and instead take you somewhere else. Many e-mail programs will allow you to see the web address you would go to, when you hover the mouse pointer over the link and read the address that appears in the status bar at the bottom of the window. Read the web address closely. Criminals can register a website with a name that has a subtly different spelling from a legitimate site, and use it to abuse your confidence.

Back to Top

---

January 21, 2010
Tips for Banking Online Securely

Blog columnist Brian Krebs makes the case for doing your online banking by using a "Live CD", to avoid having your account credentials stolen.

Another recommendation is using a different computer than you use for web browsing and e-mail, as these activities are relatively high risk for infection.

Click here to read the full article at WashingtonPost.com

Back to Top

---

September 8, 2008
Ten Ways to Protect Your Identity on Campus

From SANS Ouch! newsletter: SANS Ouch! Sep 2008
Other editions here: SANS Ouch!
Reproduced with permission of SANS

1. Lock your door. This is the single most important way to keep your computer secure.
   
2. Mark your property in a very visible, permanent way. Just as would-be thieves are often deterred by homes bearing "Protected by... " signs, so is a computer thief more likely to go for an unmarked laptop.
3. Don't assume your desktop computer is safe. Invest in some inexpensive cables designed to tether the CPU to something immovable in the room.
4. Use password protection. Adjust your computer settings to prompt you for a password anytime the computer is used. And change that password from time to time.
   
5. Don't reveal too much. Social networking sites such as MySpace and Facebook may ask for your birth date, but birth dates are a boon to identity thieves. Likewise, do not reveal any other personal information on these public sites, or in response to any email requests for your Social Security number, credit card numbers, or other personal information, even if it appears to be from a familiar-sounding company.
   
6. Keep thorough records. If your laptop is stolen, can you provide a full description for the police? Write down your computer's make, model, color, and most importantly, the serial number. You might also need this information in case you want to file an insurance claim.
   
7. Install a tracking device. Use a GPS tracking device that runs invisibly on the computer to relocate the stolen property.
8. Use a multi-layered security approach. MyLaptopGPS, for example, offers six layers of protection, including permanent tagging, GPS tracking, covert data recovery, remote data deletion, stolen property tracing, and property registration, for $10 per month per computer. Other GPS tracking devices can be purchased individually for $50 to $400.
   
9. Start shredding (digitally shredding, that is). Use software, such as Identity Finder, to search and preview the personal data on your computer, including credit card numbers, Social Security number(s), birth dates, tax returns and financial aid documents.
10. Contact your college's IT department about network security. Many colleges provide security software or other services free to their students. Before you purchase any computer protection system, check with the IT department of the college to ensure that system is compatible with the college's network.

    (USC students, faculty, and staff are licensed to use several software products. Please contact the UTS Service Desk for more information.)

Back to Top