<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="margin: 0px; font-family: Helvetica;" class="">In this issue:</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">1. Superfish Adware Put Lenovo Users at Risk</div>
<div style="margin: 0px; font-family: Helvetica;" class="">2. Microsoft Security Updates for February</div>
<div style="margin: 0px; font-family: Helvetica;" class="">3. Safety While Traveling</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">--------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Helvetica;" class="">1. Superfish Adware Put Lenovo Users at Risk</div>
<div style="margin: 0px; font-family: Helvetica;" class="">--------------------------------------------------------------</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">Per an <a href="http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with-man-in-the-middle-adware-that-breaks-https-connections/" class="">
article by ArsTechnica</a> last week, Lenovo is selling computers with adware preinstalled that hijacks encrypted web sessions, making users vulnerable to HTTPS man-in-the-middle attacks.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">The adware comes from a company called Superfish, designed to inject ads into web pages. But it is more nefarious than that. The software literally acts as a middle man, standing between you and the
sites you visit. It does this by installing a self-signed root certificate authority (CA) into your browser that can intercept traffic for every HTTPS website you visit, allowing an attacker to spoof websites you log into.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class=""><a href="http://arstechnica.com/security/2015/02/lenovo-honestly-thought-youd-enjoy-that-superfish-https-spyware/" class="">According to a statement by Lenovo</a>, the software was only installed on
machines that shipped between September and December of last year and was removed in January. The statement also mentions that Superfish has disabled server side interaction since January, so that the product is no longer active.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">This issue with Superfish was overlooked until last week. This week, Microsoft updated Windows to remove the Superfish software (learn more in the article below: “Microsoft Security Updates for February”).
<a href="http://support.lenovo.com/us/en/product_security/superfish_uninstall" class="">
Lenovo has also issued a tool</a> that removes the software.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class=""><a href="https://filippo.io/Badfish/" class="">This test</a> will tell you if you have a problem with Superfish.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class=""><a href="http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with-man-in-the-middle-adware-that-breaks-https-connections/" class="">Read the Superfish story in the news</a>.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class=""><a href="https://www.us-cert.gov/ncas/alerts/TA15-051A" class="">Read the US-CERT alert</a>.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">--------------------------------------------------------</div>
<div style="margin: 0px; font-family: Helvetica;" class="">2. Microsoft Security Updates for February</div>
<div style="margin: 0px; font-family: Helvetica;" class="">--------------------------------------------------------</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">As mentioned in the previous article, Microsoft has updated Windows to detect the Superfish software that comes preinstalled on Lenovo computers. Windows Defender is now actively removing the software
and will reset any SSL certificates that were circumvented by Superfish, restoring the system to proper working order. Users should update their version of Windows Defender and scan as soon as possible.
<a href="http://www.theverge.com/2015/2/20/8077033/superfish-fix-microsoft-windows-defender" class="">
Learn more</a>.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">Microsoft released <a href="https://technet.microsoft.com/en-us/library/security/ms15-feb.aspx" class="">
nine bulletins for February</a> on Patch Tuesday (MS15-009 through MS15-017). Systems affected are Microsoft Windows, Office, Internet Explorer and Server Software. </div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">The security update for Internet Explorer patches 41 vulnerabilities. Be sure to accept the updates as they occur, or go to the
<a href="http://windowsupdate.microsoft.com/" class="">Windows Update site</a>.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">---------------------------------</div>
<div style="margin: 0px; font-family: Helvetica;" class="">3. Safety While Traveling</div>
<div style="margin: 0px; font-family: Helvetica;" class="">---------------------------------</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">“<a href="http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201502_en.pdf" class="">Staying Secure on the Road</a>” (.pdf) is the topic for this month’s OUCH! newsletter. In this issue, you
can learn how to securely connect to the Internet and get things done while Traveling. Written by Steve Armstrong, Technical Director of CyberCPR at Logically Secure.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">Feel free to share this issue with colleagues who are or will be traveling this year.
<a href="http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201502_en.pdf" class="">
View a copy here (.pdf)</a></div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">MIT also provides a list of great tips for those traveling with technology in the KB article
<a href="http://kb.mit.edu/confluence/x/ODIYCQ" class="">Technology Tips for Travelers</a>.</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica; min-height: 17px;" class=""><br class="">
</div>
<div style="margin: 0px; font-family: Helvetica;" class="">=======================================================================================</div>
<div style="margin: 0px; font-family: Helvetica;" class="">Read all archived Security FYI Newsletter articles and submit comments online at
<a href="http://securityfyi.wordpress.com/" class=""><span style="color: rgb(4, 46, 238);" class="">http://securityfyi.wordpress.com/</span></a>.</div>
<div style="margin: 0px; font-family: Helvetica;" class="">=======================================================================================</div>
<div apple-content-edited="true" class="">
<div style="color: rgb(0, 0, 0); font-family: Avenir; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); font-family: Avenir; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
</div>
<div style="color: rgb(0, 0, 0); font-family: Avenir; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
Monique Buchanan<br class="">
IT Security Communications Coordinator<br class="">
Information Systems & Technology (IS&T)<br class="">
Massachusetts Institute of Technology<br class="">
<a href="http://ist.mit.edu/secure" class="">http://ist.mit.edu/secure</a><br class="">
tel: 617.253.2715</div>
<div style="color: rgb(0, 0, 0); font-family: Avenir; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
</div>
<br class="Apple-interchange-newline">
</div>
</div>
</div>
<br class="">
<br class="Apple-interchange-newline">
</div>
<br class="">
</body>
</html>