Blackrock Networks, Inc.

Category: Security

  • Security threats abound this week, OpenSSL

    From Microsoft ending support for XP and OpenSSL having a major code fault the web has been a buzz about security. The problem with OpenSSL vulnerability (called Heatbleed by Google) is that the issue has been there for 2 years but researchers on the right side of the law have just found it. The wrong side could have been exploiting this vulnerability for over two years now.

    The problem is, it is not a simple software update that can be sent out and installed on mass. This is much more complex. Each SSL certificate has its own encryption key making it more secure as data passes over it.  In order to fix this the SSL certificate must be revoked, reissued and re-installed. All of which can’t happen in an instance. In the meantime people have no way of knowing whether their service provider has completed the process. From what we know as of this posting major websites such as Google, Facebook, Yahoo and Amazon have said they’ve taken steps to secure their sites.

    “A major online security vulnerability dubbed “Heartbleed” could put your personal information at risk, including passwords, credit card information and e-mails.”

    “Smaller online stores and services use OpenSSL, and those sites might take longer to make the necessary fixes. Websites don’t typically publicize whether they’re using OpenSSL, so the process will also be bumpy for consumers.” -CNN

    For more go to:
    http://www.cnn.com/2014/04/08/tech/web/heartbleed-openssl/index.html?hpt=hp_t2

    Mashable has put together a great video explanation as well as a running list of companies that have made the updates required to address Heartbleed. Until a company has made the update, changing your password can mean the new password could be compromised. Read the list to see if it is time for you to update your password at your vendor sites.

    http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/


    Google has also put up a webpage of FAQ at http://heartbleed.com/

     Be sure to Like us at  www.facebook.com/blackrocknetworks for system updates.

    Or +1 us on Google at www.google.com/+Blackrocknetworks

  • Microsoft will end support for Windows XP April 8, 2014

    Just a reminder that come April 8, 2014 Microsoft will no longer provide support and security updates for Windows XP so you will need to upgrade to Windows 7 or 8 prior to this to prevent security risks. Don’t let your PC go unprotected.

    END OF LIFE INFO for XP: On April 8, 2014, support and updates from Microsoft for Windows XP will no longer be available.

    For additional IT and Computer upgrade support contact John Marczak

  • Serious Security: Google finds fake but trusted SSL certificates in France

    http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html

    by Paul Ducklin on December 9, 2013
    “Google announced over the weekend that it recently came across a bunch of fake SSL certificates for some of its own domains.” Read more at:

    http://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/

  • Adobe’s Security Breach Widens

    Please review all your accounts, Amazon, eBay, your email, DropBox and any other services that use the same combination username and password and think about changing your password hint as well. Put a post it note near you to remind you to change anything using that login. It is likely you won’t remember all the places you use this so as you log in a year from now on a rarely accessed account remind yourself. Think about it, when was the last time you logged into your CVS pharmacy account, your Harvard Pilgrim account, or your GoDaddy account? Did you check these to see if you used the same combination?

    “Over the last week, the analysis of the Adobe breach has gotten more interesting.

    The actual file itself has been available via BitTorrent. I found a torrent file and looked through it myself. If you’re interested, note that the torrent gets you a 4+GB zip of the actual 10GB of text.

    …. The summary is that each record has an account number, an account name, an email address, the encrypted password (which is not a sophisticated format and can be reversed engineered), and the person’s password hint.” – http://krebsonsecurity.com/2013/11/facebook-warns-users-after-adobe-breach/

     

     

  • Why can’t I install Plugins in WordPress?

    Why can’t I install Plugins in WordPress?

    A new study has found that roughly 20 percent of the 50 most popular plug-ins for the WordPress platform are vulnerable to common Web attacks.

    According to research from security vendor Checkmarx, that figure represents nearly 8 million downloads of plug-ins vulnerable to issues such as SQL injection, cross-site scripting, cross-site request forgery and path traversal. Additionally, the research revealed that seven out of the top 10 most popular e-commerce plug-ins for WordPress are vulnerable to attacks as well—translating to more than 1.7 million downloads – See more at: http://www.eweek.com/security/popular-wordpress-plugins-vulnerable-to-attack-checkmarx-research/#sthash.bZ27CNUY.dpuf

    As part of our security policy we don’t allow users to install third-party plugins for WordPress without prior review (we do not guarantee that a review will prevent security risks nor create incompatibility issues with your theme). As part of your hosting with us we provide you with a set of popular and reliable plugins to the best of our knowledge. These plugins meets most of our clients needs. If there is a specific plugin that you would like to install we would be happy to review it. Note that not all plugins are compatible with all themes and are often not tested with the latest versions of WordPress. A cost may be incurred to debug a plugin that causes problems with the website functionality.

    This policy has not only proven effective in preventing security risks for our clients websites but also ensures that your website will load fast and won’t be bogged down by code from multiple plugins.

    With the latest research  this only confirms our policy is the best options for our clients.

    While every line of code has the potential of introducing a vulnerability, Checkmarx found that there was no correlation between the number of lines of code and the vulnerability level of the plug-ins. On the contrary, some plug-ins included only a few thousand lines of code, but had more vulnerabilities than plug-ins containing tens of thousands of lines of code, according to the company’s paper.  – By Brian Prince

     

     

  • End of Support for SMTP Authentication Using CRAM-MD5

    Hello,

    On June 26, 2013, Blackrock Networks, Inc.  will be performing a maintenance on the Blackrock Networks, Inc. Email and Microsoft Hosted Exchange environments which will remove the ability for mail clients to send mail using the legacy authentication protocol, CRAM-MD5. Once removed, a very small portion of our customers may lose the ability to send mail until their mail client’s SMTP authentication method is changed.

    Why is Blackrock Networks, Inc. making this change? Blackrock Networks, Inc. is continually striving to improve the quality, usability, and security of our mail offering. While CRAM-MD5 is a secure authentication protocol, the industry as a whole has been migrating away from using this mechanism. The recommended method for sending mail today is to use PLAIN/PASSWORD authentication over an SSL or TLS connection.

    Will I be impacted? Our extensive testing in preparation for this maintenance has proven that the vast majority of mail clients do not use CRAM-MD5 by default. It is very difficult to pinpoint each and every mail client, version, device, etc that could be impacted, although we do know that if you are running one of the following configurations you could be impacted by this change:

    * NOTE: Customers using iPhones with Mobile Sync enabled will NOT be impacted.

    I’m impacted / will be impacted… How do I fix this? If you feel you may be impacted, or after the maintenance is complete you are no longer able to send mail from your email client, you can resolve this issue using one of the following means:

    1. Re-configure your mail client so it does not use CRAM-MD5 authentication for SMTP (sending).
    2. We also suggest connecting to our system via SSL or TLS when sending mail.

    Is there a workaround while I’m trying to set this up properly? Absolutely! You can always login to webmail to access and send email like normal should you experience issues and need to send something quickly.

    Are we the only ones? No. There are a number of companies that are changing settings as servers are upgraded. See this post on Verizon, they will end their support in September 2013 for their current settings.

  • Can you have Multiple SSL’s on a single IP?

    The answer is yes and no. Yes for most up to date browsers but no to some old ones. Unfortunelty since this is a newer technology the error messages for this issue on older browsers is less than informative. It is down right scary. It says;

    There is a problem with this website’s security certificate.

    The security certificate presented by this website was issued for a
    different website’s address.

    Security certificate problems may indicate an attempt to fool you or
    intercept any data you send to the server.
    We recommend that you close this webpage and do not continue to this
    website.


    Click here to close this webpage.
    Continue to this website (not recommended).
    More information

    If you arrived at this page by clicking a link, check the website address
    in the address bar to be sure that it is the address you were expecting.
    When going to a website with an address such as https://example.com, try
    adding the ‘www’ to the address, https://www.example.com.
    If you choose to ignore this error and continue, do not enter private
    information into the website.

    (more…)

  • Enable Javascript on Google Chrome – Windows

    Select the wrench icon on your browser window.

    2. Select Settings.
    3. Click Show advanced settings.
    4. Select Content Settings
    5. Click on Enable Java-script
    6. Click “OK”
    7. Close all tabs and the browser. Reopen to apply new settings.

  • Java Security Risk: How to disable Java

    There has been a security threat detected in the Java Plugin used in most web browsers.

    Internet Explorer

    The only way to completely disable Java in Internet Explorer (IE) is to disable Java through the Java Control Panel as noted above.

    Chrome
    1. Click on the Chrome menu, and then select Settings.
    2. At the bottom of Settings window, click Show advanced settings
    3. Scroll down to the Privacy section and click on Content Settings.
    4. In the Content Settings panel, scroll down to the Plug-ins section.
    5. Under the Plug-ins section, click Disable individual plug-ins.
    6. In the Plugins panel, scroll to the Java section. Click Disable to disable the Java Plug-in.
    7. Close and restart the browser to enable the changes.

    Note: Alternatively, you can access the Plug-ins settings by typing about:plugins in the browser address bar.

    Firefox
    1. Click on the Firefox tab and then select Add-ons
    2. In the Add-ons Manager window, select Plugins
    3. Click Java (TM) Platform plugin to select it
    4. Click Disable (if the button displays Enable then Java is already disabled)
    Safari
    1. Choose Safari Preferences
    2. Choose the Security option
    3. Deselect Enable Java
    4. Close Safari Preferences window

    Below are links on how to disable the plugins which more images.

    http://www.java.com/en/download/help/disable_browser.xml

    How to disable the Java web plug-in in Safari: http://support.apple.com/kb/HT5241

    How to disable Java in IE9 : http://windows7themes.net/how-to-disable-java-in-ie9.html

    How to disable Java in Firefox http://windows7themes.net/how-to-disable-java-in-firefox.html

  • SSL

    Although having an SSL certificate can present certain user errors in regards to notification from older browsers certificate-authenticated SSL is considered mandatory by all security guidelines whenever a web site hosts confidential information or performs material transactions.

    WildCard Domains:

    Unfortunately there has never been a good RFC on how wildcard matching works so the different implementations (SChannel and NSS mainly) are slightly different. However, here’s the draft standard which will pin this down:

    http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-09#section-4.4.3

    And here’s Microsoft’s take on it:

    http://support.microsoft.com/kb/258858

    Accepted wildcard examples

    • www.example.com matches www.example.com
    • *.example.com matches www.example.com
    • w*.example.com matches www.example.com
    • ww*.example.com matches www.example.com
    • Www.Example.com matches www.examPle.cOm

    Nonaccepted wildcard examples

    • *www.example.com
    • *w.example.com
    • w*w.example.com
    • *ww.example.com does not match www.example.com
    • www.e*ample.com does not match www.example.com
    • www.*ample.com does not match www.example.com
    • www.ex*.com does not match www.example.com
    • www.*.com does not match www.example.com
    • example.com does not match *.com does not match www.example.com
    • www.example.abc.com does not match *.abc.com
    • example.com does not match *.*
    • example does not match *
    • abc.def.example.com does not match a*.d*.example.com
    • www.example.com.au does not match *.*.com.au
    • www.example.com.au does not match www.*.com.au

    Basically, a wildcard may appear as the left-most label and it matches exactly one label. So *.example.com matches www.example.com, but not example.com (because that would mean matching zero labels).