BU DataMotion Clarification

Monday, February 5th, 2024

For decades the University has operated a secure mail solution called DataMotion that we have recommended for use in transmitting Sensitive Information.  After several years of security improvements to our email system, deployment of multifactor authentication, and improvements in our data classification and data management policies and processes, we would like to reframe the requirements…

MoveIT software vulnerability and third-party breaches 

Friday, July 14th, 2023

In late May, Boston University became aware of a vulnerability in a file transfer software package called “MoveIT” made by Progress Software.  The federal Cybersecurity & Infrastructure Security Agency (CISA) released an advisory on this topic on June 1st. Boston University is not a customer of MoveIT and was not directly affected by this vulnerability. We have…

Microsoft security patch for Word, SharePoint, Office 365, and Office for Mac

Thursday, March 9th, 2023

In February, Microsoft released a patch for a critical vulnerability in Word, SharePoint, Office 365, and Office for Mac that could allow remote code execution. As such, we are issuing this advisory to call this to your attention and asking you to update your devices now. IMPACT The vulnerability CVE-2023-21716 is of low complexity and…

LastPass Security Breach

Friday, December 23rd, 2022

IS&T is aware that LastPass, a commonly used password manager, has had a breach of security. This breach does not directly expose passwords that have been stored in the product, but LastPass has provided some recommended remediations in their customer notification: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ We encourage members of our community who use the product to review the…

Patch now: Apple has released security updates fix vulnerabilities

Friday, August 19th, 2022

Apple has released emergency security updates to fix vulnerabilities exploited by attackers in an effort to hack iPhones, iPads, or Macs. As such, we are issuing this advisory to call this to your attention and asking you to update your devices now. IMPACT   The two vulnerabilities (CVE-2022-32894 & CVE-2022-32893) are the same for all three…

Google Chrome and Microsoft Edge release update to patch security vulnerability

Tuesday, March 29th, 2022

There is a significant flaw in Chrome (CVE-2022-1096) that was announced on Friday, March 25th and has since been featured in the news. This one has received attention because there is an exploit available for it amid higher global tensions. The bug is also in shared code that is used in Microsoft Edge, which may…

Security advisory: Beware of fraudulent Duo prompts

Wednesday, March 16th, 2022

  We want to alert you to a new level of phishing attack that is currently being launched against Boston University and several other institutions across the country. This attack exploits some Duo multifactor authentication options. Please review this advisory carefully. The attacks will typically begin as an email with a generic subject, such as…

Major vulnerability in log4j – Immediate action required by all systems & web administrators and others

Saturday, December 11th, 2021

*See below for updates as of 1/3/2022, 3:00 pm A critical vulnerability has been discovered in log4j that is actively being exploited. This is an issue both for systems and web administrators on campus, including those who support products with a web interface, as well as requiring the attention of those that manage relationships with…

Update your Apple device now: emergency security update released

Tuesday, September 14th, 2021

Apple has released an emergency security update to address a vulnerability in which spyware could be installed on an iPhone or other Apple device without ever having to click on a malicious link. The security patch was released on Monday September 13th, 2021 and a current activities alert (which provides up-to-date information about high-impact types…

Boston University Not Affected by SolarWinds Compromise

Friday, January 8th, 2021

Boston University not affected by SolarWinds compromise: You may have heard on about recent exposures in SolarWinds that have impacted numerous federal agencies such as the U.S. Department of the Treasury and Departments of Homeland Security, State, Defense and Commerce. While several universities have reportedly been impacted, Boston University discontinued use of SolarWinds in 2018…