<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin: 0px; font-family: Arial;">In this issue:</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">1. Increase in Spam Attacks at MIT this Weekend</div>
<div style="margin: 0px; font-family: Arial;">2. Who’s Still Vulnerable to Heartbleed?</div>
<div style="margin: 0px; font-family: Arial;">3. US Retailers Launch Cyber Intelligence Sharing Center </div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">------------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial;">1. Increase in Spam Attacks at MIT this Weekend</div>
<div style="margin: 0px; font-family: Arial;">------------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">Over the weekend, two MIT Kerberos accounts were compromised, leading to a spike in
<a href="http://ist.mit.edu/security/spam_phishing">spam</a> in our email inboxes. The emails were not sent by anyone at MIT, but were sent using the compromised users’ accounts, to make it look like they came from MIT.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">When spam comes from a compromised email account at MIT, the spam filters at MIT are less likely to block them than if they come from an account outside of MIT. The only action MIT can take is to notify the user
and temporarily suspend the account, preventing it from sending further emails. The user must change their account password before it is reactivated by MIT.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">To prevent your MIT account from compromise, it is important to have a
<a href="http://kb.mit.edu/confluence/x/3wNt">strong password</a> and to <a href="http://ist.mit.edu/security/passwords">
protect it appropriately</a>. Do not use your Kerberos password for other accounts. Do not use your password on an insecure network. When off-campus, be sure to use an encrypted wireless network or use
<a href="http://ist.mit.edu/security/connections">VPN</a>.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">-----------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial;">2. Who’s Still Vulnerable to Heartbleed?</div>
<div style="margin: 0px; font-family: Arial;">-----------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">Is the Internet safer since the discovery of Heartbleed? To an extent. </div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">Many websites responded promptly to the bug by patching OpenSSL, replacing their SSL certificates and revoking the old certificates. However, 7% of these sites made a mistake: they reissued certificates without
changing the encryption key that may have been leaked via Heartbleed.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">It is critical to keep the private keys of certificates secret. If an attacker steals the private key, he can impersonate the secure website, decrypt sensitive information, or perform a man-in-the-middle attack.
By reusing the same private key, a site that was affected by Heartbleed still faces exactly the same risks as those who have not yet replaced their SSL certificates. </div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">So, it is STILL VERY IMPORTANT to check first before visiting sites to see if they remain affected by Heartbleed. You can check these sites by using several online tools, including:</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<ul>
<li style="margin: 0px; font-family: Arial;"><a href="https://filippo.io/Heartbleed/">https://filippo.io/Heartbleed/</a>
</li><li style="margin: 0px; font-family: Arial;"><a href="https://lastpass.com/heartbleed/">https://lastpass.com/heartbleed/</a>
</li><li style="margin: 0px; font-family: Arial;"><a href="https://www.ssllabs.com/ssltest/">https://www.ssllabs.com/ssltest/</a>
</li></ul>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><a href="http://news.netcraft.com/archives/2014/05/09/keys-left-unchanged-in-many-heartbleed-replacement-certificates.html">Read the full story in the news</a>.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">-----------------------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial;">3. US Retailers Launch Cyber Intelligence Sharing Center </div>
<div style="margin: 0px; font-family: Arial;">-----------------------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">Major US retailers have come together to launch the Retail Cyber Intelligence Sharing Center (R-CISC) in an effort to prevent incidents like the Target attack. The organization, which counts among its members Target,
The Gap, Walgreens, and J.C. Penney, will share real-time threat information with each other and with US agencies, including the Secret Service, the FBI, and the Department of Homeland Security (DHS), as well as with other public and private stakeholders. </div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;">R-CISC will provide training, education, and research resources to its members to help fight “increasingly sophisticated methods of attack.”</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial;"><a href="http://www.scmagazine.com/retailers-join-forces-to-share-threat-intelligence/article/347215/">Read the full story in the news</a>.</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Arial; min-height: 16px;"><br>
</div>
<div style="margin: 0px; font-family: Helvetica;">=======================================================================================</div>
<div style="margin: 0px; font-family: Helvetica;">Read all archived Security FYI Newsletter articles and submit comments online at
<a href="http://securityfyi.wordpress.com/"><span style="color: rgb(4, 46, 238);">http://securityfyi.wordpress.com/</span></a>.</div>
<div style="margin: 0px; font-family: Helvetica;">=======================================================================================</div>
<div apple-content-edited="true">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<br>
Monique Buchanan<br>
IT Security Communications Coordinator<br>
Information Systems & Technology (IS&T)<br>
Massachusetts Institute of Technology<br>
<a href="http://ist.mit.edu/secure">http://ist.mit.edu/secure</a><br>
tel: 617.253.2715<br>
<br>
<br>
</div>
</div>
</div>
</div>
<br>
</body>
</html>