Threat: USB Thief, new USB-based data stealing malware.
Solution: Disable USB ports were possible and have AUP which enforce care in their use.
URL: http://www.welivesecurity.com/2016/03/23/eset-discovers-new-usb-based-data-stealing-malware/

USB Thief is a new USB-based data stealing malware that only uses USB devices for propagation. The malware also uses multi-stage encryption to hide its tracks and make it very difficult to detect. The malware is written in a way that each install is bound to each device, making it difficult to copy and analyze.

USB Thief is ideal for attacking isolated (Air-gapped) networks that are not vulnerable to other internet based attacks. It seems this malware has been designed for targeted attacks against specific networks. It is highly advised that staff at all levels undergo cyber security training.

Threat: Rogue access points and Evil Twins pose risks on open networks.
Solution: Users: disable automatic connection to wifi networks. Businesses: use network segmentation and devices that provide intrusion and malware detection.
URL: https://www.helpnetsecurity.com/2016/03/14/rogue-access-point-rsa-conference/

In this article the authors set up an open access point at RSA Conference configured to use some common SSID’s. Interestingly enough they 2,456 devices connect to the access points. These access points could have easily been configured as evil twins to snoop the network traffic of attendees that came to the conference. Luckily for the attendees this was just a test and their devices were just served the internet without bad intentions.

As a user there are several ways to protect against this type of attack. The first step would be to disable automatic connection to wifi networks. This would stop your device from connecting to an evil twin without your knowledge. As a business owner there are also several options to protect customers you want to provide access to wifi. Network segmentation and devices that offer other network protections are a good start. In addition, providing security such as WPA2 is another good option.

Threat: Multiple Passcode Bypass Vulnerabilities Discovered in iOS 9
Solution: Disable the Siri module and Events Calendar without passcode, along with the public Control Panel with the timer and world clock. Users should also activate the weather app to prevent the redirect.
URL: http://www.securityweek.com/multiple-passcode-bypass-vulnerabilities-discovered-ios-9

This is a pretty big vulnerability that requires very little technical knowledge to exploit. The last vulnerability of this type I remember only allowed access to pictures and contacts.

I also wonder if the FBI could could explot this to unlock the iPhone they want from Syed Farook and the few hundred ones they have from other suspects for lesser crimes.

In addition as I look at the steps needed to completely disable this exploit, I hope Apple pushes out a security update soon. I can’t imagine many users actually taking the steps to disable everything necessary to protect against this.