This podcast is brought to you by the Greater Lafayette Security Professionals (GLSP) group, SecurePurdue, and the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University.

Show Notes

Hosts

• Preston Wiley, CISSP, CCNA
• Mike Hill, CISSP
• Keith Watson, CISSP-ISSAP, CISA

Announcements

• The Greater Lafayette Security Professionals September meeting will be a workshop on using metasploit to probe for vulnerabilities in virtual environments on September 13.
• The first of the Fall CERIAS Security Seminars will be begin this week:
  • September 5, Ed Lopez, Fortinet
  • September 12, Deloitte & Touche

  The seminar will begin at 4:30pm in Stewart G52 and will also be shown on the Purdue channel. These seminars are recorded and made available as podcasts through iTunes and on YouTube.

Security Updates

• Mozilla Firefox 15 released correcting 7 critical and 6 high vulnerabilities, August 28
• Mozilla Thunderbird 15 released correcting 5 critical and 4 high vulnerabilities, August 28
• Oracle released an emergency patch for Java 7 update 7 the corrects several critical vulnerabilities that were being widely exploited in the wild. All Java users should immediately update to this new version.

Articles

• Oracle Knew About Currently Exploited Java Vulnerabilities for Months Researcher Says by (PC World), Oracle’s emergency Java patch blocks zero-day exploits, researchers confirm by Gregg Keizer (ComputerWorld), Java zero-day exploit goes mainstream, 100+ sites serve malware by Gregg Keizer (ComputerWorld)
• Dropbox help page for two-step verification, Enable Dropbox Two-Step Verification (Beta), Dropbox Two-Factor Authentication Has Kinks, Users Say by Mathew J. Schwartz (Information Week), Dropbox Introduces Two-Step Security Authentication by Nathan Eddy (EWeek)
• Toyota says fired IT contractor hacked into company secrets by Lindsay Chappell (Automotive News), Toyota: Fired contractor copied secrets by Lindsay Chappell (Automotive News), Toyota says it was hacked by ex-IT contractor, sensitive information stolen by Graham Cluley (nakedsecurity blog)