Tabula Rosa Systems Security Bulletin - US-Cert Summary For The Week Of 5/18/2015

================================================

National Cyber Awareness System: SB15-145: Vulnerability Summary for the Week of May 18, 2015 05/25/2015 07:19 AM EDT Original release date: May 25, 2015 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: ·         High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 ·         Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9 ·         Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9 Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

===============================================
**Important note** - contact our company for very powerful solutions for IP management (IPv4 and IPv6, security, firewall and APT solutions:

www.tabularosa.net

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” will be published soon follow by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

 If you would like to listen to experts in all aspects of Netiquette and communication, try my radio show on BlogtalkRadio  Additionally, I provide content for an online newsletter via paper.li. I have also established Netiquette discussion groups with Linkedin and Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. Further, I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and have been a contributor to numerous blogs and publications. 

Lastly, I am the founder and president of Tabula Rosa Systems, a company that provides “best of breed” products for network, security and system management and services. Tabula Rosa has a new blog and Twitter site which offers great IT product information for virtually anyone.

==============================================

Tabula Rosa Systems Blog Of 5/24/2015 - Long List Of Devices Believed To Be Affected by NetUSB Vulnerability

 ============================================

Adam Greenberg, Reporter

 

May 19, 2015 SC Magazine

Long list of devices believed to be affected by NetUSB vulnerability
The vulnerability was identified by researchers with SEC Consult, who initially discovered the issue in on a TP-LINK device.

Potentially millions of devices around the globe – notably routers – are vulnerable due to a remotely exploitable kernel stack buffer overflow (CVE-2015-3036) identified in NetUSB, a Linux kernel module developed by Taiwan-based KCodes that is used to provide USB device sharing on a home network.

The issue presents itself when a client sends the computer name as part of the “connection initiation,” a Tuesday blog post stated, explaining that the stack buffer overflows when specifying a name longer than 64 characters.

“Because of insufficient input validation, an overly long computer name can be used to overflow the “computer name” kernel stack buffer,” according to a Tuesday advisory. “This results in memory corruption which can be turned into arbitrary remote code execution [or denial-of-service].”

The vulnerability was identified by researchers with SEC Consult, who initially discovered the issue in on a TP-LINK device and later verified that the bug exists in the most recent firmware versions of TP-LINK TL-WDR4300 V1, TP-LINK TL-WR1043ND V2, and NETGEAR WNDR4500.

SEC Consult went on to identify NetUSB in the most recent firmware versions of several other products, including D-Link DIR-615 C, as well as several other NETGEAR, TP-Link, TRENDnet, and ZyXEL devices.

Altogether, based on data embedded in KCodes drivers, researchers believe the following are among vendors that are affected: ALLNET, Ambir Technology, AMIT, Asante, Atlantis, Corega, Digitus, D-Link, EDIMAX, Encore Electronics, EnGenius, HawkingTechnology, IOGEAR, LevelOne, LONGSHINE, NETGEAR, PCI, PROLiNK, Sitecom, TP-LINK, TRENDnet, Western Digital, and ZyXEL.

According to the advisory, SEC Consult contacted KCodes numerous times throughout February and into March, but a fix was not made available. SEC Consult later contacted TP-LINK and NETGEAR, as well as CERT Coordination Center (CERT/CC) and other CERTs, before making a public disclosure.

“To this day, only TP-LINK released fixes for the vulnerability and provided a release schedule for about 40 products,” the blog post said. “Sometimes NetUSB can be disabled via the web interface, but at least on NETGEAR devices this does not mitigate the vulnerability. NETGEAR told us, that there is no workaround available, the TCP port can't be firewalled nor is there a way to disable the service on their devices.”

According to a CERT/CC advisory, blocking port 20005 on the local network could help mitigate the issue by preventing access to the service.

============================================
Good Netiquette And A Green Internet To All!

============================================ 

Great Reasons for Purchasing Netiquette IQ

·         Get more email opens.  Improve 100% or more.

·         Receive more responses, interviews, appointments, prospects and sales.

·         Be better understood.

·         Eliminate indecision.

·         Avoid being spammed 100% or more.

·         Have recipient finish reading your email content. 

·         Save time by reducing questions.

·         Increase your level of clarity.

·         Improve you time management with your email.

·        Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=====================================================

**Important note** - contact our sister company for very powerful solutions for IP management (IPv4 and IPv6, security, firewall and APT solutions:

www.tabularosa.net

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” will be published soon follow by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

 If you would like to listen to experts in all aspects of Netiquette and communication, try my radio show on BlogtalkRadio  Additionally, I provide content for an online newsletter via paper.li. I have also established Netiquette discussion groups with Linkedin and Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. Further, I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and have been a contributor to numerous blogs and publications. 

Lastly, I am the founder and president of Tabula Rosa Systems, a company that provides “best of breed” products for network, security and system management and services. Tabula Rosa has a new blog and Twitter site which offers great IT product information for virtually anyone.

==============================================

Tabula Rosa Systems Technical Term For 5/24/15 - Attack Surface Analysis

  ======================================================

From whatis.com

Attack surface analysis is an assessment of the total number of exploitable vulnerabilities in a system or network or other potential computer attack target.

IT security workers  and hackers both use attack surface analysis to detect security weaknesses in a system. An individual trying to break into a system generally starts by scanning the target’s attack surface for vulnerabilities before choosing an attack vector. This is generally true for active attacks, passive attacks, ethical hacking and hacking competitions.

An organization’s attack surface can be subdivided into a few categories:

• The network attack surface: the totality of all vulnerabilities in connected hardware and software that are accessible to an unauthenticated  user.
• The software attack surface: the complete profile of all functions in any code running in a given system that are available to an unauthenticated user.
• The physical attack surface: all security vulnerabilities in a given hardware system that are accessible to an attacker in the same location as the target.

These different types of attack surfaces pose very different types of threats. Usually, the analysis of a target’s vulnerabilities focuses on exposed functions of incoming and outgoing code (the software attack surface). With the majority of attacks coming from the web, network attack surface is a very important consideration because it is the most common path to the software attack surface.

The physical attack surface branches out with more and different possibilities in close access to the target. The physical element includes insider threats, social networking and even break and entry and vandalization as considerations.

OWASP offers an attack surface analysis cheat sheet for organizations; software tools include Microsoft Attack Surface Analyzer. However, as attackers can be very creative, it is often necessary for security analysts to think like a hacker to perceive potential threats.

 +++++++++++++++++++++++++++++++++++++++++++++++++
Good Netiquette to all!

===================================================

Have you ever wondered how it would be if your email suddenly came to life? You are about to find out.

https://www.youtube.com/watch?v=HTgYHHKs0Zw
====================================================
Have you ever wondered what a conference call looks like in real life? See the link below
https://www.youtube.com/watch?v=DYu_bGbZiiQ
=====================================================
**Important note** - contact our sister company for very powerful solutions for IP management (IPv4 and IPv6, security, firewall and APT solutions:

www.tabularosa.net

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” will be published soon follow by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

 If you would like to listen to experts in all aspects of Netiquette and communication, try my radio show on BlogtalkRadio  Additionally, I provide content for an online newsletter via paper.li. I have also established Netiquette discussion groups with Linkedin and Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. Further, I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and have been a contributor to numerous blogs and publications. 

Lastly, I am the founder and president of Tabula Rosa Systems, a company that provides “best of breed” products for network, security and system management and services. Tabula Rosa has a new blog and Twitter site which offers great IT product information for virtually anyone.

==============================================

Tabula Rosa Systems Blog Of 5/23/2015 - Privacy And Security On the Internet - Which Do you Choose?

 ============================================
Different explanations can be given for the same thing and both be right! Although privacy on the Internet is desired by most netizens, the downside, in part, can mean more undetectable activity by criminals or terrorists among others. Even the US government id divided on this topic.

The article below explains real-life examples.
============================================
Good Netiquette And A Green Internet To All!

============================================ 

Secretary Of State: We Must Have A Secure Internet; Homeland Security Secretary: A Secure Internet Makes Us All Less Safe – from techdirt.com

from the watch-out-for-the-buts dept

Secretary of State John Kerry gave a speech in South Korea this week about the importance of an"open and secure internet." Of course, that sounds a little hypocritical coming from the very same government that is actively working to undermine encryption, so it seems worth contrasting it with comments made from Secretary of Homeland Security Jeh Johnson, in which he whines about a secure internet making things better for terrorists. Kerry's speech is mostly good (with some caveats that we'll get to), in talking about the importance of not freaking out over moral panics and FUD:

Freedom. The United States believes strongly in freedom – in freedom of expression, freedom of association, freedom of choice. But particularly, this is important with respect to freedom of expression, and you believe in that freedom of expression here in Korea. We want that right for ourselves and we want that right for others even if we don’t agree always with the views that others express. We understand that freedom of expression is not a license to incite imminent violence. It’s not a license to commit fraud. It’s not a license to indulge in libel, or sexually exploit children. No. But we do know that some governments will use any excuse that they can find to silence their critics and that those governments have responded to the rise of the internet by stepping up their own efforts to control what people read, see, write, and say.

This is truly a point of separation in our era – now, in the 21st century. It’s a point of separation between governments that want the internet to serve their citizens and those who seek to use or restrict access to the internet in order to control their citizens.

That sounds good... until you compare it to Kerry's cabinet partner Johnson, who was doing exactly what Kerry said governments should not do:

“We are concerned that with deeper and deeper encryption, the demands of the marketplace for greater cybersecurity, deeper encryption in basic communications,” Johnson said on MSNBC’s “Morning Joe” on Friday. “It is making it harder for the FBI and state and local law enforcement to track crime, to track potential terrorist activity.”

Let's not even bother with the question of just what is "deeper and deeper encryption" or why we should have someone who clearly doesn't understand encryption in charge of Homeland Security. But it seems clear that Kerry and Johnson's views here are quite different. Kerry is saying that "governments will use any excuse they can" including bogus claims about "terrorism" and "criminals" -- and yet that's exactly what Johnson is doing.

Of course, later in his speech, Kerry starts enumerating a similar list for any country to use, should they want to control speech as well:

First, no country should conduct or knowingly support online activity that intentionally damages or impedes the use of another country’s critical infrastructure. Second, no country should seek either to prevent emergency teams from responding to a cybersecurity incident, or allow its own teams to cause harm. Third, no country should conduct or support cyber-enabled theft of intellectual property, trade secrets, or other confidential business information for commercial gain. Fourth, every country should mitigate malicious cyber activity emanating from its soil, and they should do so in a transparent, accountable and cooperative way. And fifth, every country should do what it can to help states that are victimized by a cyberattack.

============================================

Great Reasons for Purchasing Netiquette IQ

·         Get more email opens.  Improve 100% or more.

·         Receive more responses, interviews, appointments, prospects and sales.

·         Be better understood.

·         Eliminate indecision.

·         Avoid being spammed 100% or more.

·         Have recipient finish reading your email content. 

·         Save time by reducing questions.

·         Increase your level of clarity.

·         Improve you time management with your email.

·        Have quick access to a wealth of relevant email information.

Enjoy most of what you need for email in a single book.

=====================================================

**Important note** - contact our sister company for very powerful solutions for IP management (IPv4 and IPv6, security, firewall and APT solutions:

www.tabularosa.net

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” will be published soon follow by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

 If you would like to listen to experts in all aspects of Netiquette and communication, try my radio show on BlogtalkRadio  Additionally, I provide content for an online newsletter via paper.li. I have also established Netiquette discussion groups with Linkedin and Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. Further, I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and have been a contributor to numerous blogs and publications. 

Lastly, I am the founder and president of Tabula Rosa Systems, a company that provides “best of breed” products for network, security and system management and services. Tabula Rosa has a new blog and Twitter site which offers great IT product information for virtually anyone.

==============================================