BU DataMotion Clarification
For decades the University has operated a secure mail solution called DataMotion that we have recommended for use in transmitting Sensitive Information. After several years of security improvements to our email system, deployment of multifactor authentication, and improvements in our data classification and data management policies and processes, we would like to reframe the requirements…
MoveIT software vulnerability and third-party breaches
In late May, Boston University became aware of a vulnerability in a file transfer software package called “MoveIT” made by Progress Software. The federal Cybersecurity & Infrastructure Security Agency (CISA) released an advisory on this topic on June 1st. Boston University is not a customer of MoveIT and was not directly affected by this vulnerability. We have…
Microsoft security patch for Word, SharePoint, Office 365, and Office for Mac
In February, Microsoft released a patch for a critical vulnerability in Word, SharePoint, Office 365, and Office for Mac that could allow remote code execution. As such, we are issuing this advisory to call this to your attention and asking you to update your devices now. IMPACT The vulnerability CVE-2023-21716 is of low complexity and…
LastPass Security Breach
IS&T is aware that LastPass, a commonly used password manager, has had a breach of security. This breach does not directly expose passwords that have been stored in the product, but LastPass has provided some recommended remediations in their customer notification: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ We encourage members of our community who use the product to review the…
Patch now: Apple has released security updates fix vulnerabilities
Apple has released emergency security updates to fix vulnerabilities exploited by attackers in an effort to hack iPhones, iPads, or Macs. As such, we are issuing this advisory to call this to your attention and asking you to update your devices now. IMPACT The two vulnerabilities (CVE-2022-32894 & CVE-2022-32893) are the same for all three…
Google Chrome and Microsoft Edge release update to patch security vulnerability
There is a significant flaw in Chrome (CVE-2022-1096) that was announced on Friday, March 25th and has since been featured in the news. This one has received attention because there is an exploit available for it amid higher global tensions. The bug is also in shared code that is used in Microsoft Edge, which may…
Security advisory: Beware of fraudulent Duo prompts
We want to alert you to a new level of phishing attack that is currently being launched against Boston University and several other institutions across the country. This attack exploits some Duo multifactor authentication options. Please review this advisory carefully. The attacks will typically begin as an email with a generic subject, such as…
Major vulnerability in log4j – Immediate action required by all systems & web administrators and others
*See below for updates as of 1/3/2022, 3:00 pm A critical vulnerability has been discovered in log4j that is actively being exploited. This is an issue both for systems and web administrators on campus, including those who support products with a web interface, as well as requiring the attention of those that manage relationships with…
Update your Apple device now: emergency security update released
Apple has released an emergency security update to address a vulnerability in which spyware could be installed on an iPhone or other Apple device without ever having to click on a malicious link. The security patch was released on Monday September 13th, 2021 and a current activities alert (which provides up-to-date information about high-impact types…
Boston University Not Affected by SolarWinds Compromise
Boston University not affected by SolarWinds compromise: You may have heard on about recent exposures in SolarWinds that have impacted numerous federal agencies such as the U.S. Department of the Treasury and Departments of Homeland Security, State, Defense and Commerce. While several universities have reportedly been impacted, Boston University discontinued use of SolarWinds in 2018…