Cyberinfrastructure Vulnerabilities 2024 Annual Report

Since 2014, Trusted CI (formerly the Center for Trustworthy Scientific Cyberinfrastructure, a.k.a., CTSC) has delivered concise announcements on critical vulnerabilities that affect the software and cyberinfrastructure (CI) of higher education and scientific research communities. The alerting service began informally in 2014 at Indiana University with the creation of two mailing lists specific to software and infrastructure vulnerabilities. In 2016, the process was formalized by the NSF solicitation for the Cybersecurity Center of Excellence (CCoE) which called for "situational awareness of the current cyber threats to the research and education environment, including those that impact scientific instruments." The two mailing lists were merged and a more formalized process of monitoring external information sources for potential threats was established. These information sources included:

• US-CERT advisories
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Security announcements from open source projects such as OpenSSL and OpenSSH
• Announcements from CI projects such as XSEDE, ACCESS CI, Globus, and OSG
• Social media sites such as X/Twitter and Reddit (/r/netsec and /r/cybersecurity)
• News sources such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs on Security, SANS Internet Storm Center, and Schneier on Security

The Trusted CI team monitored these sources for vulnerabilities, then determined which ones were of critical interest to the CI community. While there were many cybersecurity issues reported in the news, we strove to alert on issues that affected the CI community in particular. For issues that warranted alerts to the Trusted CI mailing list, we provided guidance on how operators and developers could reduce risks and mitigate threats.

In April of 2024, the Cyberinfrastructure Vulnerabilities alerting service was replaced by the OmniSOC Community Advisory. This semi-monthly newsletter highlights current events and information security news aimed at the research cyberinfrastructure community. We encourage the Trusted CI community to subscribe to the OmniSOC newsletter by sending email to omnisoc-community-advisory-l-subscribe@iu.edu . Additionally, users are encouraged to subscribe to other CVE/vulnerability announcement lists, including:

• CISA
• SANS
• NIST National Vulnerability Database
• OpenCVE

In the first quarter of 2024, the Cyberinfrastructure Vulnerabilities team discussed 11 vulnerabilities and issued 4 alerts to 188 subscribers. Since 2014, the team has issued nearly 200 alerts to the community. 

The archives of alerts issued since 2017 are available here and here.

Cyberinfrastructure Vulnerabilities 2023 Annual Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available by subscribing to Trusted CI's mailing list (see below).

We monitor a number of sources for vulnerabilities, then determine which ones are of critical interest to the CI community. While there are many cybersecurity issues reported in the news, we strive to alert on issues that affect the CI community in particular. These issues are identified using the following criteria:

• the affected technology's or software's pervasiveness in the CI community
• the technology's or software's importance to the CI community
• the type and severity of a potential threat, e.g., remote code execution (RCE)
• the threat's ability to be triggered remotely
• the threat's ability to affect critical core functions
• the availability of mitigations

For issues that warrant alerts to the Trusted CI mailing list, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with ACCESS, Open Science Grid (OSG), and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Sources we monitor for possible threats to CI include the following:

• OpenSSL and OpenSSH
• US-CERT advisories
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/cybersecurity)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs on Security, SANS Internet Storm Center, and Schneier on Security

In 2023 the Cyberinfrastructure Vulnerabilities team discussed 43 vulnerabilities and issued 26 alerts to 187 subscribers.

You can subscribe to Trusted CI's Cyberinfrastructure Vulnerability Alerts mailing list by sending email to cv-announce+subscribe@trustedci.org. This mailing list is public and its archives are available at https://groups.google.com/a/trustedci.org/g/cv-announce.

If you have information on a cyberinfrastructure vulnerability, let us know by sending email to alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2022 Annual Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available by subscribing to Trusted CI's mailing list (see below).

We monitor a number of sources for vulnerabilities, then determine which ones are of critical interest to the CI community. While there are many cybersecurity issues reported in the news, we strive to alert on issues that affect the CI community in particular. These issues are identified using the following criteria:

• the affected technology's or software's pervasiveness in the CI community
• the technology's or software's importance to the CI community
• the type and severity of a potential threat, e.g., remote code execution (RCE)
• the threat's ability to be triggered remotely
• the threat's ability to affect critical core functions
• the availability of mitigations

For issues that warrant alerts to the Trusted CI mailing list, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with ACCESS, Open Science Grid (OSG), the NSF supercomputing centers, and the ResearchSOC on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Sources we monitor for possible threats to CI include the following:

• OpenSSL and OpenSSH
• US-CERT advisories
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/cybersecurity)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs on Security, SANS Internet Storm Center, and Schneier on Security

In 2022 the Cyberinfrastructure Vulnerabilities team discussed 41 vulnerabilities and issued 29 alerts to 192 subscribers.

You can subscribe to Trusted CI's Cyberinfrastructure Vulnerability Alerts mailing list by sending email to cv-announce+subscribe@trustedci.org . This mailing list is public and its archives are available at https://groups.google.com/a/trustedci.org/g/cv-announce .

If you have information on a cyberinfrastructure vulnerability, let us know by sending email to alerts@trustedci.org .

Cyberinfrastructure Vulnerabilities 2021 Annual Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available by subscribing to Trusted CI's mailing list (see below).

We monitor a number of sources for vulnerabilities, then determine which ones are of critical interest to the CI community. While there are many cybersecurity issues reported in the news, we strive to alert on issues that affect the CI community in particular. These issues are identified using the following criteria:

• the affected technology's or software's pervasiveness in the CI community
• the technology's or software's importance to the CI community
• the type and severity of a potential threat, e.g., remote code execution
• the threat's ability to be triggered remotely
• the threat's ability to affect critical core functions
• the availability of mitigations

For issues that warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE, Open Science Grid (OSG), the NSF supercomputing centers, and the ResearchSOC on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Sources we monitor for possible threats to CI include the following:

• OpenSSL and OpenSSH
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center, and Schneier

In 2021 the Cyberinfrastructure Vulnerabilities team discussed 40 vulnerabilities and issued 26 alerts to 183 subscribers.

You can subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list at https://list.iu.edu/sympa/subscribe/cv-announce-l . This mailing list is public and its archives are available at https://list.iu.edu/sympa/arc/cv-announce-l .

If you have information on a cyberinfrastructure vulnerability, let us know by sending email to alerts@trustedci.org .

 

Cyberinfrastructure Vulnerabilities 2020 Annual Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available to all by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest, then determine which ones are of the most critical interest to the community. While it’s easy to identify issues that have piqued the public news cycle, we strive to alert on issues that affect the CI community in particular. These are identified using the following criteria: the affected technology’s or software’s pervasiveness in the CI community; the technology’s or software’s importance to the CI community; type and severity of potential threat, e.g., remote code execution; the threat’s ability to be remotely triggered; the threat’s ability to affect critical core functions; and if mitigation is available. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE, Open Science Grid (OSG), the NSF supercomputing centers, and the ResearchSOC on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Some of the sources we monitor for possible threats to CI include:

OpenSSL and OpenSSH

US-CERT advisories

XSEDE announcements

RHEL/EPEL advisories

REN-ISAC Alerts and Advisories

Social media, such as Twitter, and Reddit (/r/netsec and /r/security)

News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 2020 the Cyberinfrastructure Vulnerabilities team discussed 50 vulnerabilities and issued 22 alerts to 158 subscribers.  Additionally, the team solicited the community with a survey to gauge the team’s impact; 87% of the respondents said that the alerts were relevant to their science mission, would recommend the services to peers, and all participants thought the alerts were concise.

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Trusted CI Webinar Jan 27th at 11am ET: REN-ISAC for Research Facilities/Projects with Kim Milford

Indiana University's Kim Milford is presenting a talk on the REN-ISAC, The Research and Education Networks Information Sharing and Analysis Center, on January 27th at 11am (Eastern).

Please register here. Be sure to check spam/junk folder for registration confirmation email.

The Research and Education Networks Information Sharing and Analysis Center (REN-ISAC) serves members within the higher education and research community by promoting cybersecurity operational protection and response. 

REN-ISAC membership is not just for university security officers! REN-ISAC has multiple membership communities that are applicable to research facilities. Kim will discuss the benefits of REN-ISAC membership that are applicable to research facility/project representatives and will solicit feedback from webinar attendees on future service offerings. 

For example, the REN-ISAC members benefit from Security Event System (SES) threat intelligence and other automated data collection and sharing tools to enable informed decisions about threats and events, as well as peer assessment services to improve the institution’s overall security posture. The REN-ISAC offers members daily cybersecurity news situational awareness, alerts and advisories, analysis reports of cybersecurity threats and mitigation, and an active, interested community of subject matter experts who provide feedback on practices and standards. The REN-ISAC also fosters professional training and development through monthly webinars, regional workshops, and an aggregate purchasing program with the SANS Institute.

Kim Milford serves as Executive Director of the REN-ISAC, working with research and education institutions, partners, and sponsors to provide services and information that allow member institutions to better defend technical environments from cyberthreats. Ms. Milford oversees administration and operations for the REN-ISAC. Ms. Milford served in several roles leading strategic IT initiatives since 2007 at Indiana University. As Chief Privacy Officer, she coordinated privacy-related efforts, chaired the Committee of Data Stewards, and directed the work of the University Information Policy Office and IU's IT incident response team. Prior to joining Indiana University, Ms. Milford worked as Information Security Officer at the University of Rochester. As Information Security Manager at University of Wisconsin-Madison from 1998 - 2005, she assisted in establishing the university's information security department and co-led in the development of an annual security conference. Ms. Milford provides cybersecurity expertise and presentations at national and regional conferences, seminars and consortia, as well as taught courses on Internet security and authored/co-authored many articles on the subject. Ms. Milford has a B.S. in Accounting from Saint Louis University in St. Louis, Missouri and a J.D. from John Marshall Law School in Chicago, Illinois.

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Cyberinfrastructure Vulnerabilities 2019 Q2 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available to all by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest, then determine which ones are of the most critical interest to the community. While it’s easy to identify issues that have piqued the public news cycle, we strive to alert on issues that affect the CI community in particular. These are identified using the following criteria: the affected technology’s or software’s pervasiveness in the CI community; the technology’s or software’s importance to the CI community; type and severity of potential threat, e.g., remote code execution; the threat’s ability to be remotely triggered; the threat’s ability to affect critical core functions; and if mitigation is available. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE, Open Science Grid (OSG), the NSF supercomputing centers, and the ResearchSOC on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 2Q2019 the Cyberinfrastructure Vulnerabilities team issued the following 10 vulnerability alerts to 133 subscribers:

• Exim Remote Code Execution Vulnerability (CVE-2019-10149)
• Linux TCP SACK Panic (CVE-2019-11477, CVE-2019-11478, CVE-2019-11479)
• kubectl Path Traversal (CVE-2019-11246)
• VMware Multiple Vulnerabilities (VMSA-2019-0005)
• Apache HTTP Server privilege escalation from modules' scripts (CVE-2019-0211)
• Confluence WebDAV and Widget Connector Vulnerabilities
• Confluence Path Traversal Vulnerability (CVE-2019-3398)
• Drupal Vulnerabilities (SA-CORE-2019-005 & SA-CORE-2019-006)
• Drupal Vulnerability (SA-CORE-2019-007)
• Microarchitectural Data Sampling (CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, CVE-2019-11091)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2019 Q1 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available to all by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest, then determine which ones are of the most critical interest to the community. While it’s easy to identify issues that have piqued the public news cycle, we strive to alert on issues that affect the CI community in particular. These are identified using the following criteria: the affected technology’s or software’s pervasiveness in the CI community; the technology’s or software’s importance to the CI community; type and severity of potential threat, e.g., remote code execution; the threat’s ability to be remotely triggered; the threat’s ability to affect critical core functions; and if mitigation is available. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE, the NSF supercomputing centers, and the ResearchSOC (the newly formed CaaS MSSP) on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 1Q2019 the Cyberinfrastructure Vulnerabilities team issued the following 4 vulnerability alerts to 124 subscribers:

• System Down Exploit
• Drupal - Vulnerability in Third Party Libraries (SA-CORE-2019-001)
• Docker / runc Privilege Escalation (CVE-2019-5736)
• Drupal Vulnerability (SA-CORE-2019-003)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2018 Q4 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 4Q2018 the Cyberinfrastructure Vulnerabilities team issued the following 4 vulnerability alerts to 108 subscribers:

• VMware Vulnerability (CVE-2018-6983)
• Apache Struts 2.3.x RCE Vulnerability When File Uploads Are Enabled
• VMware Vulnerability (CVE-2018-6974)
• Drupal - Multiple Vulnerabilities (SA-CORE-2018-006)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2018 Q3 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 3Q2018 the Cyberinfrastructure Vulnerabilities team issued the following 4 vulnerability alerts to 91 subscribers:

• L1 Terminal Fault (L1TF) or Foreshadow (CVE-2018-3620/CVE-2018-3646)
• Apache Struts Vulnerability (CVE-2018-11776)
• OpenAFS Multiple Vulnerabilities (CVE-2018-16947, CVE-2018-16948, CVE-2018-16949)
• Red Hat Local Privilege Escalation or Mutagen Astronomy (CVE-2018-14634)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2018 Q2 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to Trusted CI’s mailing lists.

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 2Q2018 the Cyberinfrastructure Vulnerabilities team issued the following 4 vulnerability alerts to 91 subscribers:

• Container Runtime Vulnerability
• Multiple Vulnerabilities in PHP (MS-ISAC 2018-046)
• Drupal Remote Code Execution Vulnerability (CVE-2018-7602)
• SimpleSAMLphp Vulnerabilities (CVE-2018-7711/CVE-2018-7644/CVE-2018-6519)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available through https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2018 Q1 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to Trusted CI’s mailing lists.

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.

Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, Reddit (/r/netsec and /r/security), and LinkedIn
• News sources, such as The Hacker News, ARS Technica, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center, Paul’s Security Weekly and Schneier

In 1Q2018 the Cyberinfrastructure Vulnerabilities team issued the following 3 vulnerability alerts to 91 subscribers:

• Spectre/Meltdown Attacks (CVE-2017-5715/CVE-2017-5753/CVE-2017-5754)
• Shibboleth SP software vulnerable to forged user attribute data (CVE-2018-0486)
• SAML Vulnerabilities in Shibboleth SP Implementations (CVE-2018-0489)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available through https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Cyberinfrastructure Vulnerabilities 2017 Q4 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to CTSC's mailing lists.

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the CTSC mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.

Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, Reddit (/r/netsec and /r/security), and LinkedIn
• News sources, such as The Hacker News, ARS Technica, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center, Paul’s Security Weekly and Schneier

In 4Q2017 the Cyberinfrastructure Vulnerabilities team issued the following 3 vulnerability alerts to 87 subscribers:

• dnsmasq Remote Code Execution via DNS (CVE-2017-14491)
• Slurm Privilege Escalation Vulnerability (CVE-15566)
• Apache Struts 2 Vulnerabilities (CVE-2017-7525 & CVE-2017-15707)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available through https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

CCoE Webinar Sept. 25th 11am ET: Demystifying Threat Intelligence

CERN's Romain Wartel is presenting the talk "Demystifying Threat Intelligence" on September 25th at 11am (Eastern).

Please register here. Be sure to check spam/junk folder for registration confirmation with attached calendar file.

Threat intelligence has become a very popular keyword among security professionals in the recent years. What is this all about? Is this a service for sale or rather an intangible asset resulting from a trust relationship? Every organization is seeking relevant and target intelligence, ideally at little to no cost and yielding no false-positives. What are the myths and realities? Is threat intelligence a worthy investment? Is it more suitable to favor local or global sources? Are there services or tools that can facilitate threat intelligence management. Beyond obtaining information, an often overlooked aspect are the challenges linked with building the ability to take promptly and effectively action based on specific intelligence. Making good use of threat intelligence is what makes its value, but this requires time and efforts. Yet, a well-designed threat intelligence management and flow may in fact be the only realistic and affordable strategy for our community to mitigate sophisticated threats or well-funded attackers on a daily basis.

More information about this presentation is on the event page.
Presentations are recorded and include time for questions with the audience.

Join CTSC's discuss mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

CTSC’s Situational Awareness Expanding Collaborations

In an attempt to improve on the security alert service CTSC offers, the Situational Awareness (SA) group within CTSC has recently expanded its monitoring streams and collaborations to include Open Science Grid (OSG) and the European Grid Infrastructure’s Software Vulnerability Group (EGI: SVG). These entities join CTSC’s current collaborations with REN-ISAC and XSEDE in mutually sharing advisories. The immediate benefit of this effort is that CTSC and its collaborators have increased their monitoring channels, enabling a larger window to survey for potential threats to science cyberinfrastructure. This improvement in shared knowledge will better position us, as well as our new partners, to pass on the important alerts to our communities.

To register for CTSC SA advisories, see https://trustedci.org/situational-awareness.

If you're a member of a trust community that would like to share alerts with CTSC, please contact us at alerts@trustedci.org.

CTSC Training at GPN/GWLA Annual Meeting

The Great Plains Network and the Greater Western Library Alliance Annual Meeting will be held in Kansas City on May 31st through June 2nd. CTSC will be providing an Incident Response and Log Analysis workshop during the conference. For more information on the conference please refer to the link below. Details for the workshop are on the Schedule page.

http://conferences.k-state.edu/gpn-gwla/

2016 Security Awareness Retrospective

As we enter the new year it’s a good time to reflect on what has happened in the last year and the lessons we should be learning from them. The general goal of our situational awareness mission is to inform on threats to the cyberinfrastructure (CI) of research and education centers. With most alerts it can sometimes be hard to identify overall threats not only to CI but also to you as an individual. We try our best to provide information to help you identify where these vulnerabilities may affect your infrastructure. We translate the issue into a more understandable format so you can make better assessments for how it may affect you, how you can detect it and how it can be resolved.

If you have been taking advantage of this service let us know how it’s been going. We would really appreciate your feedback to help us prepare for our annual report to the NSF as well as to improve the Situational Awareness program. Here is the link to the survey:

https://goo.gl/forms/MRMYVs4k24l2RpR82

In the last year we have provided a number of different alerts for core software like OpenSSH and OpenSSL. We announced vulnerabilities for content management systems WordPress and Joomla. There have been alerts for vulnerabilities in the Linux kernel as well. We have even provided some guidance for named vulnerabilities like Badlock, DirtyCOW and HTTPoxy.

Many of these issues we’ve seen in the last year can be identified, mitigated and/or resolved quickly by taking a few extra steps. If you don’t have the time or expertise on site to manage a service, use professionally hosted services that can provide security mitigation and patching quickly. Use regularly scheduled vulnerability scanning services to identify vulnerabilities in your infrastructure such as unpatched systems or exposed services that you’re unaware of. Protect against compromised passwords by enabling multi-factor authentication. Taking these extra steps can go a long way to protect your infrastructure from pending vulnerabilities.

Back in October we posted about Ransomware and ensuring that you are backing up your data. Every year Ransomware attacks have been increasing in number and complexity. We’ve seen this increase in the last year and expect to see another increase in the next year. If you haven’t already invested in a backup solution for your data this is something you should put effort in as soon as possible.

This last year has also seen the rise of a new compromise vector in small internet devices known as the Internet of Things (IoT). These are embedded devices of everyday things that are connected to the internet. These give you the ability to turn lights on and off, adjust your thermostat, open doors, even cook your food all from your phone. These simple devices are not as complex as a desktop computer and are usually designed for ease of use and not for security. Attackers have taken advantage of this lack of security using the ‘Mirai’ malware to build up an impressively destructive botnet. Because these devices are usually not designed to be upgraded remotely it’s likely this botnet will not disappear soon. In the next year we expect to see increased activity from and growth of this botnet.

The ease at which many of these devices can be added to any network can make this a very real threat for your CI. You may also see devices that show up in offices or on your wireless network. The most likely source of IoT devices will be networks for personal living spaces like dorm networks. The introduction of these devices to your network may create unintended vectors for access to your network. In large enough numbers they can potentially cripple your network if they’re compromised and being used in a DDoS attack. This post from Internet2 has a number of options for mitigating DDoS attacks on your infrastructure.

One of the other things we’ve noticed a lot of in the last year are compromised accounts. Yahoo recently announced the compromise of over 1 billion accounts from as far back as 2013. While large public sites like Yahoo often get mentioned in the news, we do still see lists of compromised accounts for organizations like Universities and small businesses. Also we continue to see re-use of passwords across systems, where a password compromise at a commercial service like Yahoo can lead to compromise of a CI account using the same password. To counteract this many sites and organizations have started to roll out multi-factor authentication solutions to protect their users and systems. The introduction of multi-factor authentication is something we’ll likely be seeing more of in the next year and beyond.

Whatever the new year brings we hope our service will help you navigate through them. If you haven’t already signed up for our mailing lists you can find them here. Security alerts are sent to the CTSC Infrastructure Operators Announce List for issues affecting CI. Alerts that affect software development are sent to the CTSC Software Developers Announcement List. We hope this next year is a safe and secure one.