Stopping visitor-uploaded spam submissions on your website

The article has been moved to https://security.gatech.edu/website-spam-upload

New Features in LastPass to Focus on Family Digital Life

The LastPass family is about to get bigger. Coming your way this summer, we’re excited to announce LastPass Families that will make it easy to manage your family’s digital life. The LastPass Families addition is just one more way we’re delivering a faster, simpler, and more intuitive password manager for all our users.

When it comes to keeping your loved ones safe online, recent research found that 91% of people feel that having a strong password allows them to protect their family better. We’ve seen this reflected in your requests for more shared folders and the ability to buy and manage licenses on behalf of others. We also know it’s a growing challenge to keep track of all your family’s information online: healthcare provider logins, school passwords, streaming media accounts. What worked 10 years ago, even five, just doesn’t cut it anymore.

Enter LastPass Families, where you can store everything from bank accounts to passports to credit cards. Your details are secure, organized the way you want, and easily shared with your spouse, kids, in-laws, and more. You can even give access to others in the event of an emergency. The family manager can quickly add and remove members to the account, making it easy to get everyone up and running.

Read the rest of the article here: https://blog.lastpass.com/2017/07/from-passwords-to-passports-a-new-way-to-manage-your-familys-digital-life.html/

Security Research Procedure

Georgia Tech Cyber Security realizes that sometimes researchers need to do some things that fall outside of the technical rules in our policies – especially when researching hacking and hackers, etc.

Because of this, we have created a Security Research Procedure that allows Cyber Security researchers to conduct their research without violating the law, violating Institute policy, or introducing reputational risk.

It’s published here: https://security.gatech.edu/security-research-procedure – so please read the procedure and familiarize yourself with it.

Keylogger found on HP laptops/desktops

A group of security researchers announced this morning that some HP laptops and desktops are shipping with an audio driver that includes a keylogger that logs all keystrokes to a local file. This includes potentially storing passwords and other sensitive data in a plaintext file that can be read by anyone on the system.

Indications are that this is debugging code that was left on unintentionally rather than a malicious actor, but it’s still a risk.

To see if your HP system is vulnerable check to see if C:\Windows\System32\MicTray64.exe or C:\Windows\System32\MicTray.exe exist on the system.

For detailed information see the original writeup

Security Sense: Security is Becoming Too Hard for the Layperson

This article addresses a concern that I think many of us who provide IT support with a focus on security share.  Namely that the implementation of what’s available to better secure a user has become too complex for them to easily adopt.

http://windowsitpro.com/troy-hunts-security-sense/security-sense-security-becoming-too-hard-layperson

University Credentials for Sale on ‘Dark Web’

Ever wonder what can happen with the accounts that get compromised on campus? Read on!

https://www.insidehighered.com/quicktakes/2017/03/31/university-credentials-sale-dark-web#.WN5hvfYJvks.mailto

Security Update for the LastPass Extension

LastPass comments on recent security vulnerabilities discovered in the LastPass client code:

Security Update for the LastPass Extension

Millions of records leaked from huge US corporate database

ZDNet reports on the release of records from a database containing more than 33 million records from government departments and large corporate clients:

http://www.zdnet.com/article/millions-of-records-leaked-from-huge-corporate-database/

Highly Effective Phishing Technique Being Exploited

Wordfence points out a new phishing technique involving an unusually formatted URL. This technique has been used to target Gmail users, as well as users of some other popular services. It has been partially mitigated in Chrome.

https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/

Beware This Clever “Fake Attachment” Gmail Phishing Scam

Lifehacker points out a new, tricky phishing scheme affecting Gmail users that uses an embedded image made to look like an attachment:

http://lifehacker.com/beware-this-clever-fake-attachment-gmail-phishing-sca-1793264478