***University Information Services Alert: Widespread WiFi Vulnerability***
Apple has released a new security update that you should install as soon as possible. This operating system update, across virtually all Apple products, fixes a few security issues, including a very serious one that has recently been announced.
This vulnerability, called Broadpwn, is different from typical viruses and malware because it requires no user interaction. The system vulnerability allows an attacker to easily run their programs on your phone or computer by accessing your device over WiFi.
In other words, if you are in range of an attacker and have WiFi on, they can essentially take over your phone or computer, which could allow an attacker to read your emails, access your camera, and listen to your phone calls.
The vulnerability affects a particular manufacturer of WiFi hardware, which is present in an enormous range of devices, including many Android phones and all iPhone, iPad, and iPod touch models. Google issued a security patch for Android devices in early July, and Apple has released its update within the last 2 days.
This is a widely known and well publicized vulnerability. We expect that malicious hackers will take advantage of this quickly and in many locations.
Besides your phone and computer, look for system updates from any of your wireless connected devices, for example:
Smart TV
Apple TV
Apple Watch
Alexa
Google Home
Nest
Phillips Hue
If you need assistance with updating your phone or computer, please contact the UIS Service Center at 855-687-4949 or help@georgetown.edu.
You can find more information about “broadpwn” at:
nvd.nist.gov/vuln/detail/CVE-2017-9417
iOS (support.apple.com/en-us/HT207923)
Android (source.android.com/security/bulletin/2017-07-01)
***University Information Services Alert: Ransomware***
What’s going on?
There’s a new ransomware threat out there. It’s called Petya and it’s very similar to Wanna Cry, the ransomware that recently spread through over 150 countries back in May.
Petya is spread by taking advantage of the same vulnerability in the Windows operating system that allowed WannaCry to spread so easily. It’s imperative that the Microsoft security updates for all versions of Windows have been applied to University and personal computers.
Are we at risk?
Same rules apply. The campus technology managers at Georgetown University are working diligently to verify that our computers are appropriately updated, and to identify and remediate any unprotected University workstations that may be on our network. Anyone using a personal Windows computer should take steps to ensure that you are protected. Please note that Mac operating systems have not been assocated with this vulnerability.
Who is affected:
Any Windows computer without Windows update MS17-010.
What to do:
Make sure that all Microsoft updates are applied to your computer. (Beware of bogus ransomware removal sites and tools, and do not download from any site other than the official Microsoft Technet site)
Other Tips:
Read emails very carefully and DO NOT CLICK ON QUESTIONABLE LINKS OR ATTACHMENTS even from known sources.
If you receive an email with links or attachments, always verify with the sender that the email is legitimate.
Back-up any data from your computer to another storage location – including Box or Google Drive.
Spreading of this ransomware strain starts through phishing or junk email messages. A spam email is sent containing a malicious link or a malicious document. Once a target activates the malware by either clicking the link or opening the document the malware will hold the computer hostage until a ransom is paid. It does this by encrypting all of the files on the system with an encryption key.
Once your computer is infected, your data is lost if you do not have a back-up; even if you agree to pay the Bitcoin ransom, there’s no guarantee that the decryption key will work.
If you are using a University-managed computer, you can expect an emergency update to be applied to your workstation, even if you already have the patch installed. Please follow the instructions – including re-booting your computer to allow the updates to apply to your computer.
*You can contact the University Help Desk to get assistance with checking your Microsoft patch level and installing the appropriate patch.*
Online Best Practices
Your digital footprint is your online presence in today's technology-based environmenent. This footprint is all over the Internet. It is therefore important to ensure your digital profile matches the profile you are intending to share. It is also critical to guard your privacy — not only to avoid embarrassment, but also to protect your identity and finances!
New data breaches are continually announced in the news. To minimize the risks of exposure, below are specific steps you can take to protect your online information, identity and privacy:
Use a unique password for each site. Hackers often use previously compromised information to access other sites. Choosing unique passwords keeps that risk to a minimum.
Use a password manager. Using an encrypted password manager to store your passwords makes it easy to access and use a unique password for each site.
Know what you are sharing. Check the privacy settings on all of your social media accounts; some even include a wizard to walk you through the settings. Always be cautious about what you post publicly.
Guard your date of birth, telephone number, social security number and other personal details. These are key pieces of information used for verification, and you should not share them publicly. If an online service or site asks you to share this critical information, consider whether it is important enough to warrant it.
Keep your work and personal presences separate. Keep Georgetown information in Georgetown places. Keep GU email in your GU account, not a personal account.
There are no true secrets online. Use the postcard or billboard test: Would you be comfortable with everyone reading a message or post? If not, don't share it.
Other tips:
Online Security Awareness Training now available!
UIS is now providing a brief online training on security awareness and best practices. This introductory course is currently available for active University staff and faculty. Completing the course will enable all of us to better protect our information.
The course is available now at https://slate.workplaceanswers.com/georgetown/.
Log in with your net ID and password. It takes about 15 minutes.
What does UISO do?
Threat and Vulnerability Management: Because Georgetown University considers the protection of University information a critical priority,we endeavor to protect by providing critical information security services and education to the GU community, equipping students, faculty and staff with the tools to better protect computers and data.
See what we do: https://georgetown.box.com/s/0b8ke6f0ubtwg5oxzjc2
Cybersecurity Information and Tips
E-Mail Safety
Phishing
Every email account is bombarded with phishing attempts on a daily basis. Much like telemarketers and political campaign callers, phishing is a consistent part of our environment. Nobody is immune - faculty, students, staff, alumni all get phishing emails. Much of this phishing e-mail is filtered out, but some still occasionally get through.
Phishing emails use tricky tactics to steal your personal information. When an unsolicited message is sent to you asking for passwords, your social security number, other personal data, or to verify that an email address is active, that is a phishing e-mail. They are "fishing" for information.
Phishing e-mails can be especially convincing as they can be highly personalized and sophisticated and appear to legitimately be from trusted companies or organizations that you may have an association or do business with, such as your bank, Georgetown University, or the government. Legitimate business or government organizations will rarely ever ask you for any personal information – any such request should be validated before responding.
Learn more about how to Spot a Phish!
E-Mail Links or Attachments
In addition to phishing e-mails, you should also be aware of strange links or attachments that may accompany e-mails – including those from people you know. You should never click on any links from or open attachments from emails from unknown individuals. If you receive an e-mail from someone you know with strange links or attachments, you should confirm with the individual that they meant to send you the link or attachment as their e-mail account could be compromised without their knowledge.
Online Account Safety
It’s important that you take care to protect your online accounts to ensure that others do not have unauthorized access. Your online accounts include your Georgetown University NetID and accounts associated with your online financial, social media, and shopping activities. While it may seem harmless to share your individual online account with others – your online accounts also represent your “digital identity” and allowing others to access your personal data or perform online activities as you can have bad unintended consequences and identity theft.
Sharing your NetID is not just allowing someone to access your GU account for convenience purposes, it’s also allowing someone access to your student records, staff personnel information, or personal emails and data stored in your Google account.
To protect yourself and the University, please make sure that you do the following:
- Try to use different passwords for key online accounts (e.g., your NetID, online banking, personal e-mail account, social media account, etc.)
- Use a complex password or pass-phrase (more than 8 characters with a mixture of upper / lower case, numeric, and special characters)
- Change passwords regularly
- Do not share your password with others
- Enroll in the Georgetown University Password Management System – to ensure that only you can change your NetID password
- Validate and delete any suspicious e-mails - do not click on any links from “phishy e-mails” (You can check the Georgetown University website to validate authentic University e-mails or to see recent phishing examples. Search for “phishing examples”)
- It’s also important to ensure that you have proper security software installed on your computer – including all PC’s and Macs – to prevent malware infection (All Georgetown University staff can download the Symantec End-Point Protection software free of charge – please contact UIS for more information)
- You should also be avoid installing any pirate software or apps as these are often the sources of malware infections
Every email account is bombarded with phishing attempts on a daily basis. Much like telemarketers and political campaign callers, phishing is a consistent part of our environment. Nobody is immune: faculty, students, staff, alumni all get phishing emails.
If you clicked or think you may have clicked on a link? Computer acting oddly? Spamming folks on your contact list?
- Change your password immediately!
- Call the Service Center (202-687-4949) for assistance.
Password Change Requirement (twice per year)
UISO will remind students, faculty, staff and alumni to change their passwords two times per year. If you have questions, please email us at security@georgetown.edu or call (202) 687-3031.