Independent – Page 391 – Computer Security Articles

Credit to Author: Steven J. Vaughan-Nichols| Date: Wed, 03 May 2017 04:00:00 -0700

In the beginning, devices on the internet were fun. My favorite was the Carnegie-Mellon’s Computer Science Department Coke Machine. Starting in the 1970s, you could “ping” it to see if it had sodas ready and if they were cold yet. It was good, silly fun. Now everything except the cat* is hooked to the internet, and that’s not so funny at all.

Oh, sure, some internet of things (IoT) devices are enjoyable and useful. I have an Amazon Echo in my bedroom and a Google Home in my kitchen. I use them every day. But I’m aware of their privacy problems. You should be too.

To read this article in full or to leave a comment, please click here

Independent Securiteam

May 2, 2017 admin

SSD Advisory – Serviio Media Server Multiple Vulnerabilities

Credit to Author: Maor Schwartz| Date: Tue, 02 May 2017 10:58:33 +0000

Vulnerabilities Summary The following advisory describes a five (5) vulnerabilities found in Serviio Media Server. Affected version: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1. Serviio is a free media server. It allows you to stream your media files (music, video or images) to renderer devices (e.g. a TV set, Bluray player, games console or mobile phone) on … Continue reading SSD Advisory – Serviio Media Server Multiple Vulnerabilities

Independent Krebs

May 2, 2017 admin

Breach at Sabre Corp.’s Hospitality Unit

Credit to Author: BrianKrebs| Date: Tue, 02 May 2017 18:41:42 +0000

Breaches involving major players in the hospitality industry continue to pile up. Today, travel industry giant Sabre Corp. disclosed what could be a significant breach of payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and other lodging establishments. In a quarterly filing with the U.S. Securities and Exchange Commission (SEC) today, Southlake, Texas-based Sabre said it was “investigating an incident of unauthorized access to payment information contained in a subset of hotel reservations processed through our Hospitality Solutions SynXis Central Reservations system.”

ComputerWorld Independent

May 2, 2017 admin

IDG Contributor Network: Using defense-in-depth to prevent self-inflicted cybersecurity wounds

Credit to Author: Robert C. Covington| Date: Tue, 02 May 2017 07:32:00 -0700

This past week, I encountered an all too common situation — a user gets a targeted phishing attempt. Despite a strong training program, the user opens the attachment and gets infected with ransomware.

For many organizations, this would have resulted in a disaster. Ransomware would have encrypted files on any servers, and the organization would have been forced to either restore the files from a backup, assuming they had them, or to hold their nose and pay a ransom.

The news was better, however, for the organization I mentioned above.

Fortunately, the premise of their security planning was that someone would eventually shoot them in the foot. With a security plan that assumed this, they had a depth of layered controls to help. While their anti-virus software did not prevent the infection, it did recognize and send an alert about it, after the fact. In the meantime, their web filtering appliances and their DNS service provider, recognizing the call from the infected PC to a command and control server to get an encryption key, blocked access. Since the ransomware client never got the key, it did not encrypt any files. The blocking of command and control access provided the extra time needed to get the PC pulled out of service and repaired.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

May 2, 2017 admin

Vulnerability hits Intel enterprise PCs going back 10 years

Credit to Author: Michael Kan| Date: Tue, 02 May 2017 03:34:00 -0700

Intel is reporting a firmware vulnerability that could let attackers take over remote management functions on computers built over nearly the past decade.

The vulnerability, disclosed on Monday, affects features in Intel firmware that are designed for enterprise IT management.

Enterprises using Intel Active Management Technology, Intel Small Business Technology and Intel Standard Manageability on their systems should patch them as soon as possible, the company says.

The vulnerable firmware features can be found in some current Core processors and all the way back to Intel’s first-generation Core, called Nehalem, which shipped in 2008. They’re part of versions 6.0 through 11.6 of Intel’s manageability firmware.

To read this article in full or to leave a comment, please click here

Independent Securiteam

May 1, 2017 admin

SSD Advisory – CloudBees Jenkins Unauthenticated Code Execution

Credit to Author: Maor Schwartz| Date: Mon, 01 May 2017 06:28:11 +0000

Vulnerability Summary The following advisory describes Java deserialization vulnerability found in CloudBees Jenkins version 2.32.1 that leads to a Remote Code Execution. Jenkins helps to automate the non-human part of the whole software development process with now common things like continuous integration and by empowering teams to implement the technical aspects of continuous delivery. It … Continue reading SSD Advisory – CloudBees Jenkins Unauthenticated Code Execution

ComputerWorld Independent

May 1, 2017 admin

'May the Fourth' remind users to choose a stronger password

Credit to Author: Matt Hamblen| Date: Mon, 01 May 2017 10:35:00 -0700

May 4 is coming up and has been designated as World Password Day to remind enterprise workers and consumers everywhere to use strong, updated passwords to protect cybersecurity.

The date was picked to align with one of the silliest puns yet: “May the Fourth Be with You” — also known as Star Wars Day. (Get it?) Well, maybe when Thursday, May 4 rolls around, it will still be a reminder for end-users to choose a stronger password and redouble security steps.

Security firm BullGuard cited recent studies showing that 90% of all passwords are vulnerable to attack in seconds. Also, 10,000 common passwords like “qwerty” or “12345678” allow access to 98% of all accounts, BullGuard said. Amazingly, 21% of online users rely on passwords that are 10 years old, the company said.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

May 1, 2017 admin

Career Watch: Be wary of IT employment contracts

Credit to Author: Jamie Eckle| Date: Mon, 01 May 2017 03:30:00 -0700

Q&A: Attorney Jeffrey Scolaro

Jeffrey Scolaro, an attorney at Daley Mohan Groble PC in Chicago and a member of Legal Services Link, answers questions about employment contracts.

Are employment contracts for IT workers negotiable, or are they one-size-fits-all? The axiom that “everything is negotiable” should be where all IT professionals begin their assessment of proposed employment contracts. However, the IT industry in particular can be especially rigid in its collective enforcement of employment agreements.

To read this article in full or to leave a comment, please click here