Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


Leaked version of Skype for Android leaks sensitive data

http://nakedsecurity.sophos.com/2011/04/17/skype-for-android-leaks-sensi...

Leaked copies of Skype for Android with video-conferencing capabilities
have been floating around. Before using, note that there is no security
of any kind on your personal & login information. It is literally stored
in text files with world-readable permissions. However, PCI DSS was
followed, so Credit Card information is safe.

APPLE-SA-2011-04-18-1 iTunes 10.2.2

http://lists.apple.com/archives/security-announce/2011/Apr/msg00004.html

"Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes
may lead to an unexpected application termination or arbitrary code
execution."

Users of iTunes are strongly encouraged to update their client software
as soon as possible.

Leaked version of Skype for Android leaks sensitive data

http://nakedsecurity.sophos.com/2011/04/17/skype-for-android-leaks-sensi...

Leaked copies of Skype for Android with video-conferencing capabilities
have been floating around. Before using, note that there is no security
of any kind on your personal & login information. It is literally stored
in text files with world-readable permissions. However, PCI DSS was
followed, so Credit Card information is safe.

APPLE-SA-2011-04-18-1 iTunes 10.2.2

http://lists.apple.com/archives/security-announce/2011/Apr/msg00004.html

"Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes
may lead to an unexpected application termination or arbitrary code
execution."

Users of iTunes are strongly encouraged to update their client software
as soon as possible.

Adobe to Patch Flash Zero Day on Windows, Mac on Friday, April 15, 2011

https://threatpost.com/en_us/blogs/adobe-patch-flash-zero-day-windows-ma...

Thanks to Kevin for the heads up.

"Adobe is planning to patch the recently disclosed Flash Player
vulnerability on Friday for users on Windows, Mac OS X and Linux. The
vulnerability is being used in targeted attacks right now that use
malicious Word documents.

Adobe to Patch Flash Zero Day on Windows, Mac on Friday, April 15, 2011

https://threatpost.com/en_us/blogs/adobe-patch-flash-zero-day-windows-ma...

Thanks to Kevin for the heads up.

"Adobe is planning to patch the recently disclosed Flash Player
vulnerability on Friday for users on Windows, Mac OS X and Linux. The
vulnerability is being used in targeted attacks right now that use
malicious Word documents.

Adobe to Patch Flash Zero Day on Windows, Mac on Friday, April 15, 2011

https://threatpost.com/en_us/blogs/adobe-patch-flash-zero-day-windows-ma...

Thanks to Kevin for the heads up.

"Adobe is planning to patch the recently disclosed Flash Player
vulnerability on Friday for users on Windows, Mac OS X and Linux. The
vulnerability is being used in targeted attacks right now that use
malicious Word documents.

phplist: cross site request forgery (CSRF), CVE-2011-0748

http://comments.gmane.org/gmane.comp.security.full-disclosure/78944

"Up to version 2.10.12, it provided no protection against cross site
request forgery (CSRF) at all, allowing a malicious attacker
controlling a webpage an admin visits at the time being logged into
phplist to gain full control over the phplist installation.

Pages