NYU Wordpress Theme

Spectre Patches Available

Intel has released their Microcode Revision Guidance publication, which details both the availability and schedule for planned microcode updates and changes. The following processors have firmware patches ready to use in production environments:

Anniedale/Moorefield
Apollo Lake
Avoton/Rangeley
Broxton
Cherry View
Coffee Lake
Cougar Mountain
Deverton
Gemini Lake
Kaby Lake
Knights Landing
Knights Mill
Skylake
SoFIA
Tangier
Valleyview/BayTrail
XGold
It is recommended that users and admins of systems with affected processors review the above-referenced Intel publication, and apply the relevant patches asap. Additionally, please see the NJCCIC Meltdown and Spectre Product Vulnerability and Update List for a comprehensive list of the patches and advisories.

Additional Resources:

Related posts:

 

Equifax Breach Update

The Equifax breach, which occurred in September of last year and impacted the personal data of 14.5 million consumers, appears to have impacted more data than initially reported. Equifax already confirmed the loss of social security numbers, birth dates, home addresses, credit-score dispute forms and in some instances, credit card and driver’s license numbers. According to a document Equifax recently submitted to the Senate Banking Committee, hackers were also found to have accessed tax identification numbers, email addresses, phone numbers, credit card expiration dates and issuing states for driver’s licenses.

Using the following Equifax site, https://www.equifaxsecurity2017.com, you can check whether your personal information has been impacted. The site lists options for consumers such as obtaining a credit report, placing a freeze or lock on your credit report (with information regarding the distinction between these two options) and placing a fraud alert or an extended fraud alert on your credit report.

For more information please see:

Related post:

FTC Issues Alert on Equifax Phishing Scams

Recent Uptick in Phishing Messages Using URL Shorteners

There has been a recent uptick in phishing email campaigns using popular URL shortening services such as bit.ly, ow.ly, goo.gl, and t.co. to embed malicious links in email messages. This is a common ploy used by scammers as shortened URLs mask the true link destination.  

Further, these phishing messages often appear to come from a familiar entity, such as your bank, and the embedded links, if clicked, often take users to sites which appear to be legitimate and require the input of login credentials. Once login credentials are entered in the spoofed site, they are stolen/compromised and users are redirected to the legitimate site.

If you believe you have fallen victim to this type of scam, you should change your password on the affected account asap and apprise the business/entity of any fraudulent activity. To safeguard yourself from these types of phishing attacks, it is recommended that you never enter login credentials via embedded links in unsolicited emails. If in doubt of the legitimacy of a message, contact the sender/entity at a trusted phone number. An additional tip is to view the the browser address bar, and look for signs of a legitimate/secure site which may include a locked padlock preceding the business/entity name and “https://”

Image from a browser address bar showing a locked green padlock preceding JPMorgan Chase and Co., providing an example of what was detailed in the preceding paragraph

Image from a browser address bar showing https:// followed by www.chase.com, providing an example of what was detailed in the preceding paragraph.

Shortened URLs can be easily checked or expanded using link expander services. The expanded URL is the true destination URL. For more information on using link expanders, please see the following Connect Article: https://wp.nyu.edu/connect/2017/12/12/the-skinny-on-short-links/

Related post: https://wp.nyu.edu/itsecurity/2018/01/12/phishing-campaigns-crafted-to-steal-login-credentials/