US CERT Current Activity
VMware Releases Security Updates for ESXi and Horizon DaaS
Dec 6, 2019
Original release date: December 6, 2019VMware has released security updates to address a vulnerability in ESXi and Horizon DaaS. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2019-0022 and apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.
ACSC Releases Fundamentals of Cross Domain Solutions
Dec 5, 2019
Original release date: December 5, 2019The Australian Cyber Security Centre (ACSC) has released a cybersecurity guide outlining the fundamentals of cross domain solution (CDS) technologies. This guidance provides cross domain security principles to enable organizations to share information securely across separated networks. The Cybersecurity and Infrastructure Security Agency (CISA) encourages organizations with information sharing requirements to review ACSC’s Fundamentals of Cross Domain Solutions to learn how to plan, analyze, design, and implement CDS systems. This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Releases Security Advisory for Windows Hello for Business
Dec 5, 2019
Original release date: December 5, 2019Microsoft has released a Security Advisory to address an issue in Windows Hello for Business (WHfB). An attacker could exploit this issue on devices that were affected by CVE-2017-15361, also known as Return of Coppersmith’s Attack (ROCA), to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Microsoft Security Advisories ADV190026 and ADV170012 and apply the recommended mitigations. This product is provided subject to this Notification and this Privacy & Use policy.
NCSC-NZ Releases Cyber Governance Resource for Leaders
Dec 5, 2019
Original release date: December 5, 2019The New Zealand National Cyber Security Centre (NCSC-NZ) has released an article on a new cybersecurity governance resource to support public and private sector leaders in making decisions about their cybersecurity resilience and risk. NCSC-NZ developed this governance—a series of documents with practical advice and simple steps—following a cybersecurity resilience assessment of New Zealand’s nationally significant organizations. The Cybersecurity and Infrastructure Security Agency (CISA) encourages senior leaders and security practitioners to review NCSC-NZ’s Charting Your Course: Cyber Security Governance and Cyber Security Resilience of New Zealand’s Nationally Significant Organisations 2017-2018 for more information. This product is provided subject to this Notification and this Privacy & Use policy.
Mozilla Releases Security Updates for Firefox and Firefox ESR
Dec 4, 2019
Original release date: December 4, 2019Mozilla has released security updates to address vulnerabilities in Firefox and Firefox ESR. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Mozilla Security Advisories for Firefox 71 and Firefox ESR 68.3. This product is provided subject to this Notification and this Privacy & Use policy.
CISA Releases Draft of Binding Operational Directive on Developing a Vulnerability Disclosure Policy
Dec 2, 2019
Original release date: December 2, 2019The Cybersecurity and Infrastructure Security Agency (CISA) has released a draft of Binding Operational Directive (BOD) 20-01, Develop and Publish a Vulnerability Disclosure Policy. BOD 20-01 will require each federal agency to publish a vulnerability disclosure policy (VDP). CISA has posted the draft directive for public feedback. The deadline for submitting comments is 11:59 PM EST on December 27, 2019. CISA encourages users and administrators to review the CISA blog post, Improving Vulnerability Disclosure Together, and draft BOD 20-01 for more information. CISA encourages feedback on draft BOD 20-01 from individuals with personal or institutional expertise in vulnerability disclosure and from organizations that have a VDP and manage coordinated vulnerability disclosures. This product is provided subject to this Notification and this Privacy & Use policy.
Cyber Monday: Tips for Safeguarding Personal Information
Dec 2, 2019
Original release date: December 2, 2019Cyber Monday draw millions of shoppers online for deals and savings, but this day also provides opportunities for an attacker to steal personal information. The Cybersecurity and Infrastructure Security Agency (CISA) reminds users to remain vigilant when browsing or shopping online. CISA encourages Cyber Monday shoppers to review the following online shopping safety tips: Do business with reputable vendors. Before providing any information, make sure that you are interacting with a reputable, established vendor. Some attackers may try to trick you by creating malicious websites that appear to be legitimate, so you should verify the legitimacy before supplying any information. (See Avoiding Social Engineering and Phishing Attacks.) Use caution with email links and attachments. Take appropriate precautions when using email and web browsers to reduce the risk of an infection. Be wary of unsolicited email attachments and avoid clicking on email links, even if they seem to come from people or businesses you know. (See Using Caution with Email Attachments.) Pay using a credit card. There are laws to limit your liability for fraudulent credit card charges, but debit cards may not have the same level of protection. Ensure your information is encrypted. Check website URLs to ensure they begin with "https:" (instead of "http:") accompanied by a padlock icon to verify that the site is secure. This product is provided subject to this Notification and this Privacy & Use policy.
Caller Spoofs CISA’s Phone Number in Extortion Scam
Nov 29, 2019
Original release date: November 29, 2019The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a phone scam where a caller pretends to be a CISA Service Desk representative. The scammer, whose spoofed call appears to be from CISA’s toll free number, claims to have knowledge of the potential victim’s questionable behavior and attempts to extort money. If you receive a threatening call from someone claiming to be a CISA representative, CISA recommends the following actions: Do not respond or try to contact the caller. Do not pay the caller. Contact your local FBI field office to file a report. This product is provided subject to this Notification and this Privacy & Use policy.
Black Friday Shopping: Protect Your Identity
Nov 27, 2019
Original release date: November 27, 2019Black Friday is one of the most lucrative shopping days of the year for retailers in brick-and-mortar shops and online, but shoppers aren't the only ones looking for deals. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans. The Cybersecurity and Infrastructure Security Agency (CISA) encourages holiday shoppers to take the following identity theft precautions: Take advantage of security features. Passwords and other security features add layers of protection if used appropriately. (See Choosing and Protecting Passwords.) Check privacy policies. Take precautions when providing information, and make sure to check published privacy policies to see how a company will use or distribute your information. (See Protecting Your Privacy.) Check your statements. Keep a record of your purchases and copies of confirmation pages, and compare them to your bank statements. If there is a discrepancy, report it immediately. Be careful what information you publicize. Attackers may be able to piece together information from a variety of sources. Avoid posting personal data in public forums. (See Staying Safe on Social Networking Sites.) This product is provided subject to this Notification and this Privacy & Use policy.
Securing Portable Electronic Devices During Travel
Nov 22, 2019
Original release date: November 22, 2019Holiday travelers often use portable electronic devices (PEDs) because they offer a range of conveniences, for example, enabling the traveler to order gifts on-the-go, access to online banking, or download boarding passes. However, these devices are vulnerable to cyberattack or theft, resulting in exposure of personal information. With the holiday season approaching, the Cybersecurity and Infrastructure Security Agency (CISA) reminds users to be mindful of the security risks associated with traveling with PEDs. CISA encourages travelers to take the following steps to protect their personal information: Avoid using public Wi-Fi networks to conduct personal business. Open Wi-Fi networks at places such as airports present an opportunity for attackers to intercept sensitive information. Turn off Bluetooth when not in use. Cyber criminals have the capability to pair with your device's open Bluetooth connection and steal personal information. Be cautious when charging. Avoid connecting your device to any computer or charging station that you do not control, such as a charging station at an airport terminal. Remember physical security. Do not leave your device unattended in public or easily accessible areas. Check out CISA’s Tips on Holiday Traveling with Personal Internet-Enabled Devices and Cybersecurity for Electronic Devices for more information and tips. This product is provided subject to this Notification and this Privacy & Use policy.
ISC Releases Security Advisory for BIND
Nov 21, 2019
Original release date: November 21, 2019The Internet Systems Consortium (ISC) has released a security advisory that addresses a vulnerability affecting multiple versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit this vulnerability to cause a denial-of-service condition. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the ISC advisory for more information and to apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Releases Outlook for Android Security Update
Nov 21, 2019
Original release date: November 21, 2019Microsoft has released an update to address a vulnerability in Outlook for Android. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Microsoft Security Advisory and apply the necessary update. This product is provided subject to this Notification and this Privacy & Use policy.
NSA Releases Cyber Advisory: Managing Risk from Transport Layer Security Inspection
Nov 19, 2019
Original release date: November 19, 2019The National Security Agency (NSA) has released a Cyber Advisory that addresses managing risk from Transport Layer Security Inspection (TLSI). This short, informative document defines TLSI (a security process that allows incoming traffic to be decrypted, inspected, and re-encrypted), explains some risks and associated challenges, and discusses mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the NSA Cyber Advisory and apply the information, as appropriate. See CISA’s Alert on risks associated with HTTPS inspection. This product is provided subject to this Notification and this Privacy & Use policy.
FTC Provides Tips on Safeguarding Data Before Upgrading Mobile Phones
Nov 19, 2019
Original release date: November 19, 2019The Federal Trade Commission (FTC) has released an article with tips on how to protect personal information before trading in a mobile phone for a newer model. FTC recommends the following four steps to safeguard these devices: Back up data. Remove SIM and SD cards. Erase personal information. Verify deletion of personal information. The Cybersecurity and Infrastructure Security Agency (CISA) encourages consumers to review the FTC article for additional resources on how to perform each of the suggested steps and see CISA’s Tip on Proper Disposal of Electronic Devices for more information. This product is provided subject to this Notification and this Privacy & Use policy.
National Tax Security Awareness Week is December 2–6
Nov 19, 2019
Original release date: November 19, 2019The Internal Revenue Service (IRS) has released an article announcing that National Tax Security Awareness Week will be held December 2–6. The annual recognition event will feature a series of resources and tips to help taxpayers and tax professionals protect their data and identities against identity theft. The Cybersecurity and Infrastructure Security Agency (CISA) encourages taxpayers, businesses, and tax professionals to review CISA’s Tip on Preventing and Responding to Identity Theft and IRS’s article on National Tax Security Awareness Week for details about new resources and the more than 25 tax security events being held across the country throughout the awareness week. This product is provided subject to this Notification and this Privacy & Use policy.
Google Releases Security Updates for Chrome
Nov 19, 2019
Original release date: November 19, 2019Google has released Chrome 78.0.3904.108 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Chrome Release and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.
Reminder: Malware Can Exploit Improper Configurations
Nov 15, 2019
Original release date: November 15, 2019Protect yourself from unwanted—and potentially harmful—files or programs by adhering to vendor-recommended configurations for hardware and software. Doing so in addition to maintaining regular patch maintenance, will help give your systems and networks the best security possible. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following tips and guidance: What is Cybersecurity? Handling Destructive Malware Protecting Against Malicious Code Understanding Patches and Software Updates CISA’s Cyber Essentials (for small businesses and small SLTT governments) This product is provided subject to this Notification and this Privacy & Use policy.
NCSC-NZ Releases Annual Cyber Threat Report
Nov 14, 2019
Original release date: November 14, 2019The New Zealand National Cyber Security Centre (NCSC-NZ) has released their annual report detailing cyber threats and incidents affecting New Zealand from July 2018 to June 2019. During this period, NCSC-NZ recorded an increase in the severity of cybersecurity incidents—particularly from state-sponsored threat actors. NCSC-NZ provides enhanced cybersecurity services to New Zealand Government and organizations of national significance against cybersecurity threats. The Cybersecurity and Infrastructure Security Agency (CISA) encourages administrators to review the NCSC Cyber Threat Report for more information. This product is provided subject to this Notification and this Privacy & Use policy.
VMware Releases Security Updates
Nov 12, 2019
Original release date: November 12, 2019VMware has released security updates to address vulnerabilities in ESXi, Workstation, and Fusion. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisories VMSA-2019-0020 and VMSA-2019-0021 and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.
Adobe Releases Security Updates
Nov 12, 2019
Original release date: November 12, 2019Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates. Animate CC 2019 APSB19-34 Illustrator CC APSB19-36 Media Encoder APSB19-52 Bridge CC APSB19-53 This product is provided subject to this Notification and this Privacy & Use policy.
