Major Adobe Data Breach

On October 3, 2013, Adobe announced that it had been a victim of a cyber attack that resulted in a data breach. This breach resulted in attacker(s) gaining access to the detailed information belonging to 38 million customers.  The information includes:

 

• Customer names
• Encrypted credit or debit card numbers
• Expiration dates
• Other information relating to orders

Adobe also acknowledged that the attacker(s) have gained access to the source code for Adobe Acrobat, ColdFusion, and ColdFusion Builder.

Adobe will be emailing all customers who have been affected by this breach and informing them to change their passwords, as well as providing additional guidance to help safeguard against potential misuse of the compromised data if their credit or debit card numbers were part of the breach.
 

Please note that it's likely that attackers will attempt to take advantage of this breach by sending fake emails that appear to come from Adobe.  If you receive an email related to this breach, do NOT click any links or reply with any information. 

Our recommendations for anyone who may be affected by this breach are as follows:

1. Check to see if you are affected by entering your email address at http://adobe.cynic.al/.
2. Change passwords for all Adobe accounts.
3. Change passwords for any other accounts that may use the same password as your account on Adobe.com.  (Remember:  it's not a good idea to use the same password on multiple websites!)
4. Monitor financial accounts that are used for purchasing Adobe products for fraudulent activity.

For more information, see Adobe's website at http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html.

Recognizing Fake Antivirus Software

What is fake antivirus?

Fake antivirus is malicious software (malware) designed to steal information from unsuspecting users by mimicking legitimate security software. The malware makes numerous system modifications making it extremely difficult to terminate unauthorized activities and remove the program. It also causes realistic, interactive security warnings to be displayed to the computer user.

How can my computer become infected with fake antivirus?

Criminals distribute this type of malware using search engines, emails, social networking sites, internet advertisements and other malware. They leverage advanced social engineering methodologies and popular technologies to maximize number of infected computers.

How will I know if I am infected?

The presence of pop-ups displaying unusual security warnings and asking for credit card or personal information is the most obvious method of identifying a fake antivirus infection.

What can I do to protect myself?

There are lots of things you can do to protect yourself from these antivirus scams:

• Become familiar with how your antivirus works and make sure it is always up to date.
• Be cautious when visiting web links or opening attachments from unknown senders.
• See Using Caution with Email Attachments for more information.
• Keep software patched and updated.
• See Understanding Patches for more information on the importance of software patching.
• To purchase or renew software subscriptions, visit the vendor sites directly.
• Monitor your credit cards for unauthorized activity.

This information was adapted from an original production by US-CERT and republished for non-commercial use as outlined in their Privacy & Use policy.

Keep a Clean Machine

Here are some simple tips from our friends at StopThinkConnect.org on how to keep your computer secure:

 
• Keep security software current: Having the latest security software, web browser, and operating system are the best defenses against viruses, malware, and other online threats.
• Automate software updates: Many software programs will automatically connect and update to defend against known risks. Turn on automatic updates if that’s an available option.
• Protect all devices that connect to the Internet: Along with computers, smart phones, gaming systems, and other web-enabled devices also need protection from viruses and malware.
• Plug & scan: “USBs” and other external devices can be infected by viruses and malware. Use your security software to scan them.

Want more tips on how to stay safe and secure online?  Visit the Stop.Think.Connect page at http://stopthinkconnect.org/tips-and-advice/.

Passphrases, Not Passwords

 

Did you know that the average person's password is fairly easy to guess?  Most people use their name or something personal about them in their passwords, so hackers use dictionaries of common English names, numbers and words to hack passwords.  In fact, you can see the list of the top 10,000 passwords here.  (Hopefully you're isn't on the list!)  But perhaps what's even more startling is that current software has been successfully used to crack passwords that are 55 characters long!

But you don't need to be one of those average people...  Instead, think about replacing your out of date passwords with strong passphrases.  What's that?  What's a passphrase and how do I pick one?  We're glad you asked. 

These 5 tips will help you out:

1. Choose a phrase that's at least five words long. You might start with your favorite book, song, movie or a quote. Longer passwords are harder to guess than shorter ones, so you could use the entire phrase as your password.  We still recommend doing Step 2.  If the application won't allow such long passwords, then you could use the first letters of each word as your password. For example, the first letters of the book title "The Cat in the Hat" are: tcith. This step protects you from a dictionary attack, in which someone tries to crack your phrase using known words (and proper names).
2. Alter some of it. The hardest to guess passwords\passphrases are "complex", which means they use a mix of numbers, symbols and upper and lower case letters.  Take your passphrase from Step 1 and replace some lowercase letters with capital letters, numbers or symbols. For example: Tc!tH capitalizes the first and last letter and replaces the "i" with an exclamation point. (You could replace an "a" with the "@" symbol too.) Make it simple; don't write your system down.
3. Customize the password for each use. Add a character or three to the core password to ensure that every pass phrase is at least seven characters long and includes a number. Generate an extra letter and number based on the name of the program you're accessing. For example: g6Tc!tH could be a password for a Google Gmail account, adding an "o" for the last letter of Google, and a 6, for the number of letters in Google.
4. Write down your hint. Now you can write down a mnemonic device that will jog your memory without being obvious to anyone else. Hide this piece of paper or keep it in your wallet. For example, you could write down "basic: cat" to recall the Dr. Seuss title.
5. Establish different levels of passwords. Use different core phrases to develop passwords for online banking, for accounts that use your credit card and for those that don't involve financial information.
6. Change your passwords often.  If you can't change your password every 90 days, use daylight-saving time as the reminder to change your passwords.  If you don't change them and someone is able to get them, this will stop them from using your accounts for a long period of time.

Want to test how long it would take a hacker to crack your password?  You can test a password over at HowSecureIsMyPassword.net.  But don't put in your actual passwords!!!

Happy National Computer Security Awareness Month!

It's finally here! National Computer Security Awareness Month starts today and the entire KUMC campus is celebrating throughout the month of October with both online and face-to-face opportunities to learn more about how to keep you, your family, and your data safe and secure. Each day on this blog, we'll focus on a different risk or threat such as phishing, iPad and mobile device security, social media privacy, or keeping track of all those passwords.  It will be a learning experience, but it will be a fun one....we promise!

During the week of October 28th, we hope you'll bring your lunch and join us for all four of the following Lunch 'n Learn sessions from 12 to 1 p.m. 
(You can sign up now using the links below):

Monday, October 28th:  Got (Too Many) Passwords?
Description:  Passwords, passwords, passwords for your bank site, your personal and work email, Facebook, and on and on. How do you keep track of all of them? Bring your lunch and learn about a FREE and secure way to manage your passwords, including how to make sure they're always available when you need them.

Tuesday, October 29th:  Defend Yourself: Top 10 FREE Security Tools
Description:  A new computer taken out of the box and connected to the Internet is easily taken over by a hacker within minutes. If you've got a computer, you need to arm yourself with the right tools to fight this constant battle. Bring your lunch and learn about the FREE security tools that are a must-have for any PC owner.

Thursday, October 31st:  R U My Friend? Privacy and Social Media
Description: Social media sites like Facebook and Instragram are great for keeping track of friends and sharing your everyday life with those you love. But there's also a dark side to sharing your information on these types of sites. Bring your lunch and find out how companies and criminals use the information and photos that you share on these sites and what YOU can do to protect yourself on social media.

Friday, November 1st:   Mobile Revolution: Mobile Device and Cloud Security
Description: Smartphones, iPads, tablets and other mobile devices are literally changing the way we work and play. But do you know how to protect your shiny new device from hackers? And just what does it mean to store your data "in the cloud"? Bring your lunch and your questions as we discuss security issues related to mobile devices and storing data in the cloud.


 

The more you participate, the more chances you have to win one of the great prizes* to be raffled off on November 1st!  And, even if you can' t make one of the sessions, you can still enter the raffle by participating in the online treasure hunt starting October 28th.

 *Prizes to be announced later this month.

We hope you'll join us in the celebration!

UPDATE 10/24/13:  Prizes for this year have been announced and they look great.  Click here to find out details on what prizes are available and how you can enter to win. 

UPDATE 10/28/13: The online security scavenger hunt is now open.  Even if you can't find time to attend the Lunch 'n Learn sessions, completing the hunt will give you an entry into the prize drawing on Friday.  Good luck!

NCSAM is coming in October!

Next month, KUMC will be participating in the nationwide celebration of the 10^th anniversary of National Cyber Security Awareness Month.   Check back here often for information on some great learning opportunities on campus, contests and even prizes!

What is National Cyber Security Awareness Month?

We lead Internet-connected, digital lives. From our desks and homes to on the go, we work, learn and play online. Even when we are not directly connected to the Internet, our critical infrastructure—the vast, worldwide connection of computers, data, and websites supporting our everyday lives through financial transactions, transportation systems, healthcare records, emergency response systems, personal communications, and more—impacts everyone.

National Cyber Security Awareness Month (NCSAM) – celebrated every October - was created as a collaborative effort between government and industry to ensure that we all have the resources we need to stay safer and more secure online.

This year's theme is "Our Shared Responsibility" because no individual, business, or government entity is solely responsible for securing the Internet. Everyone has a role in securing their part of cyberspace, including the devices and networks they use. Individual actions have a collective impact and when we use the Internet safely, we make it more secure for everyone. If each of us does our part—implementing stronger security practices, raising community awareness, educating young people, training employees—together we will be a digital society safer and more resistant from attacks and more resilient if one occurs.

If you are concerned about making the Internet safer and more secure for everyone, we invite you to join us next month as we celebrate.  Everyone can do something—even if you have less than one hour to devote to this effort!

Want to read President Obama's Presidential Proclamation on NCSAM?  Go here.

Keep Your Pesky Hands Off My Mobile Data!

Symantec - Keep Your Pesky Hands Off my Mobile Data