The eLearning Services team (eLS) want to inform you of some upcoming changes in Canvas.

There is a Canvas [1] update scheduled for Saturday, January 18 between 8:00am and 12:00pm EST.  Canvas will receive feature updates and bug fixes managed by the vendor (Instructure). Highlights in this update include:

• Updated Features:
  • Direct Share: Share Canvas content with other instructors and courses without using the Commons [2]
  • Gradebook: Utilize additional filtering options, late & missing policies, and assignment posting policies
  • SpeedGrader: Post comments to manually-graded items that haven’t been graded yet
  • New Quizzes: Shuffle answers in multiple choice, multiple answer, and matching quiz questions
  • Rich Content Editor (RCE): Opt into the updated RCE [3]
• Fixed Bugs
• API updates

See the release notes [4] for a full list of expected updates and fixes, including a short (~5 minutes) screencast reviewing this release.

–IT Community Partnerships on behalf of the eLearning Services team

[1] About Canvas at IU https://kb.iu.edu/d/bcll

[2] Direct Share https://community.canvaslms.com/docs/DOC-18147

[3] Canvas Release: New Rich Content Editor https://community.canvaslms.com/docs/DOC-17764

[4] Canvas Release Notes 01-18-2020 https://community.canvaslms.com/docs/DOC-18147

Alternatively, log in to Canvas. Click “Help”, “Ask the Community”, “Releases”, “Release Notes by Product”, “Canvas”, and “View Full Release Notes Document”.

~~~~~ Today’s IT Pro Tip ~~~~~

Yoga, Ice Hockey, Crafting, Live Music; What is your pleasure?  Make plans to attend the 2020 UITS Engagement Expo, hosted by IT Community Partnerships, on Tuesday, February 4, 10am-2pm in the Wrubel Commons, IU Bloomington.  The event is your opportunity to explore and join existing or new employee groups, clubs or committees led by UITS.  Live music back by popular demand; Margaret Tratta will play guitar and sing and Julie Songer will debut playing the electric violin and fiddle throughout the event.  Email TALK2UITS@IU.edu with questio

IT Professionals:

The University Information Security Office would like to make you aware of the following security bulletin of a vulnerability in the Microsoft CryptoAPI.

Background:

On January 14, 2020, Microsoft announced CVE-2020-0601 Windows CryptoAPI Spoofing Vulnerability [1]. The vulnerability exists in the Windows CryptoAPI (crypt32.dll) which is responsible for validating Elliptic Curve Cryptography (ECC) certificates. Microsoft has released a security update that addresses the vulnerability by ensuring that CryptoAPI properly validates ECC certificates.

Impact:

An attacker exploiting the vulnerability could spoof code-signed certificates making it appear that a malicious executable was from a legitimate and trusted source. There is no way of knowing the spoofed code-signed file is malicious because the digital signature would appear from a trusted provider. Once a system has been exploited, attackers can further cause harm by decrypting confidential information from user connections to the impacted software as well as launch man-in-the middle attacks.
Additionally, attackers may be able to spoof x.509 certificate chains that could allow for the interception and modification of TLS-encrypted communications, spoofing websites, or spoofing authenticode signatures [2].

Platforms Affected:

Windows 10
Windows Server 2016
Windows Server 2019

Local Observations:

University Information Security Office (UISO) has not identified any systems that have been exploited at this time; however, it is believed that systems could become compromised if they remain unpatched.

UISO Recommendations:

UISO strongly recommends that impacted systems are patched with the security update as soon as possible.

Workarounds:

There are no work arounds for this vulnerability.

Further Reading:

[1] CVE-2020-0601 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
[2] Authenticode Digital Signature https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode
[3] CryptoAPI System Architecture https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptoapi-system-architecture
[4] Certificate Chains https://docs.microsoft.com/en-us/windows/win32/seccrypto/certificate-chains

~~~~~ Today’s IT Pro Tip ~~~~~

Would you like to see an infoshare on a specific topic? Send your suggestion to talk2uits@iu.edu – we’ll try to arrange it.

IT Professionals:

The Campus Communications Infrastructure team would like to make you aware that Microsoft has postponed the change previously announced requiring binding and signing of LDAP queries for all Windows hosts. This has been pushed to an upcoming release in March 2020 [1,2].  The Active Directory Servers at IU are currently monitoring client connections that will fail when the patch is applied.

At the moment, that list of hostnames includes a significant number of macOS machines, joined to Active Directory [3] or connecting to Exchange. However, we do not anticipate any issue for Macs bound to Active Directory.  If an AD bound macOS client is experiencing a login issue, you will need to rejoin it to the Active Directory [4].

There are also quite a number of service accounts or user accounts connected to unknown services, some of which reside on Data Center IP address space.

Actions for IT Pros

For macOS clients using Outlook, please enable signed LDAP queries [5].

For Enterprise Service Owners, please check your data center VLANs against the included list, to make sure your services are not included.  If you do have enterprise services in the list, please check any LDAP connections on those hosts, to see if you can configure changes to require binding or signing.

For other clients, IT Pros can attempt to locate an application or service that is running as the indicated user or machine object that connects via LDAP, and see if that application can be configured to require binding or signing.

The Active Directory Admins will continue to update this folder with impact lists.

If you have any further questions, please contact sct2@iu.edu.

–IT Community Partnerships on behalf of the Campus Communications Infrastructure team

[1] https://support.microsoft.com/en-ca/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows
[2] https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023
[3] Box Entrusted [Login Required]: https://iu.box.com/s/p8r805t4air9xujzl121b73nhzo6nwg4
[4] Configure macOS login for ADS: https://kb.iu.edu/d/aziv
[5] Enable signed LDAP for macOS: https://kb.iu.edu/d/bccz

~~~~~ Today’s IT Pro Tip ~~~~~

The staff of IT Connections is seeking your personal and professional milestones for the January issue. If you have news—awards, a new kitten, a new spouse, a cool trip, a fitness achievement—please share along with photos to IT Connections, itcxn@iu.edu. Deadline for submission is Friday, January 17.

IT Professionals:

The University Information Security Office would like to make you aware of the following security bulletin of a Zero-Day vulnerability in Mozilla Firefox.

Background

On January 8th, The Mozilla Foundation released a security advisory to address a critical zero-day flaw in Mozilla Firefox, which has been exploited in targeted attacks.[1]

To address CVE-2019-17026, Mozilla released Firefox 72.0.1 and Firefox ESR 68.4.1. Because this vulnerability has been exploited in targeted attacks, Firefox users are advised to upgrade as soon as possible.

Impact

CVE-2019-17026 is a type confusion vulnerability in IonMonkey[2], the JavaScript Just-In-Time (JIT) compiler for SpiderMonkey, Mozilla’s JavaScript engine. According to Mozilla’s advisory, the flaw exists in the JIT compiler due to “incorrect alias information for setting array elements,” specifically in StoreElementHole and FallibleStoreElement.

Users only need to visit a malicious website to be compromised and successful exploitation of this vulnerability could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Platforms Affected

* Firefox versions prior to 72.0.1

* Firefox ESR versions prior to 68.4.1

* Tor Browser versions prior to 9.0.4

Local Observations

SCCM IT Pros have deployed the upgrade in UDT (Leveraged Services) and are planning to expedite the deployment on UDM workstations.

JAMF Pro IT Pros have deployed patches for Firefox

UISO Recommendations

* Apply appropriate updates provided by Mozilla to vulnerable systems, immediately after appropriate testing.

* Upgrade Tor to the latest release[3]

* Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

* Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

* Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.

* Apply the Principle of Least Privilege to all systems and services.

Links:

1: https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/

2: https://wiki.mozilla.org/IonMonkey

3: https://blog.torproject.org/new-release-tor-browser-904

Further Reading:

https://www.cisecurity.org/advisory/vulnerability-in-mozilla-firefox-could-allow-for-arbitrary-code-execution_2020-004/

https://www.tenable.com/blog/cve-2019-17026-zero-day-vulnerability-in-mozilla-firefox-exploited-in-targeted-attacks

–IT Community Partnerships on behalf of the University Information Security Office

~~~~~ Today’s IT Pro Tip ~~~~~

Would you like to see an infoshare on a specific topic? Send your suggestion to talk2uits@iu.edu – we’ll try to arrange it.

IT Professionals,

The eLearning Services team (eLS) want to inform you of two upcoming maintenances.

First, beginning at 8:00 pm on Thursday, January 9, Box [1] will be performing system maintenance on their SSO logins. There is no expected downtime associated with this maintenance, which will be finished at 2:59 am on Friday, January 10.

Next, Instructure will be running a brief maintenance event on Canvas [2] from 1:00 am – 2:00 am on Sunday, January 12, during which the New Quizzes LTI [3] may be unavailable.

[1] About Box at IU https://kb.iu.edu/d/bbox
[2] About Canvas at IU https://kb.iu.edu/d/bcll
[3] What is New Quizzes? https://community.canvaslms.com/docs/DOC-15014-67952929189

–IT Community Partnerships on behalf of The eLearning Services team

~~~~~ Today’s IT Pro Tip ~~~~~

Yoga, Ice Hockey, Crafting, Live Music; What is your pleasure?  Make plans to attend the 2020 UITS Engagement Expo, hosted by IT Community Partnerships, on Tuesday, February 4, 10am-2pm in the Wrubel Commons, IU Bloomington.  The event is your opportunity to explore and join existing or new employee groups, clubs or committees led by UITS.  Live music back by popular demand; Margaret Tratta will play guitar and sing and Julie Songer will debut playing the electric violin and fiddle throughout the event.  Email TALK2UITS@IU.edu with questions.

IT Professionals:

We want to inform you that the Campus Networks Engineering team is moving the retirement of the IU Secure wireless SSID to Fall 2020. Moving to eduroam [1] affects devices that use single sign-on (SSO) through group policy on faculty and staff devices. Thanks to your feedback, we are exploring alternative options to address this functionality. This is due to eduroam requiring the full email address instead of a username for login credentials [2][3].

IT Community Partnerships will update IT Pros in future communications as more information becomes available about SSO options. We are still encouraging users whose devices aren’t affected by the SSO issue to move to eduroam. The IT Communications Office will continue eduroam communications to faculty, staff, and students on all campuses.

For questions regarding GPO changes, or other concerns regarding this matter, please contact Support Center Tier 2 at sct2@iu.edu.

–IT Community Partnerships on behalf of the Campus Networks Engineering team

[1] About eduroam at Indiana University: https://kb.iu.edu/d/bcbt 
[2] Connect to eduroam: https://kb.iu.edu/d/bcdx 
[3] Troubleshoot your eduroam connection: https://wifi.iu.edu/troubleshoot/index.html

~~~~~ Today’s IT Pro Tip ~~~~~

The Qualtrics survey tool is now available to all IU faculty, staff, and students without a fee – you no longer have to buy an individual or organizational license. Consider using Qualtrics to embed surveys within Canvas courses and HTML websites, gather data for research projects, collaborate with users at other institutions, or gather event registrations. Get started.

IT Professionals,

As per our communication just prior to winter break, the IT People database will soon be going live, activating the tool assignments that IT unit leadership have made within IT People.

Our original “go live” date was January 13^th.  However, with the start of the semester occurring on the 13^th, we will push back the date for tool activation to Friday, January 17^th.

Additionally, please find below a table summarizing IT pro tools, description and relevant link, if applicable.

Please contact talk2uits@iu.edu with any related questions or concerns.

–IT Community Partnerships

~~~~~ Today’s IT Pro Tip ~~~~~

Would you like to see an infoshare on a specific topic? Send your suggestion to talk2uits@iu.edu – we’ll try to arrange it.

IT Professionals,

UITS would like to inform you of upcoming changes to the Red Hat licensing at IU.

Due to the significant increases in Red Hat licensing costs and declining usage of Red Hat operating system across IU, UITS will be phasing out over a three-year period our enterprise license agreement.  UITS will continue to fully fund Red Hat enterprise licenses for two additional years, with the idea that schools and departments will plan and execute migrations out of Red Hat and into an alternate Linux platform, such as CentOS.  If schools and departments have not fully migrated during this two-year timeframe, departments and schools will be responsible for purchasing Red Hat license(s) at half the rate (approximately $135/server) for the third year.

UITS recommends that Red Hat should only be used for business needs specifically requiring Red Hat; those units without an absolute dependency on Red Hat are strongly encouraged to migrate out of Red Hat to an alternative platform prior to February 2022. If migration is not possible, you should seek appropriate funding (current cost estimate could be projected to exceed $300/server) to cover full licensing costs beyond the third year.

IT Community Partnerships will be sending out additional information and hosting an infoshare regarding the Red Hat changes in Q1 2020, which will include the Enterprise Linux Administration’s team experience with and tips around migrating from Red Hat to CentOS.

Additionally, please keep in mind present and future EdCert offerings focused on Red Hat/Linux, listed below, which cover the core concepts and training that are applicable to the Linux platform in general.

Current offerings:

RH124 – Red Hat System Administration I (4-day)
RH134 – Red Hat System Administration II (4-day)

Planned offerings:

RH254 – Red Hat System Administration III (4-day, based on RHEL version 7, planned for summer 2020 schedule)
RH294 – Red Hat System Administration III: Linux Automation (4-day, based on RHEL version 8, planned for fall 2020 schedule)
DO180 – Intro to containers, Kubernetes and Red Hat OpenShift (4-day, planned the second course for the RH254/RH294 course offering)
RH415 – Red Hat Security: Linux in Physical, Virtual, and Cloud (4-day, projected to attend mid-summer instructor training session)

Please contact cbri@iu.edu with any related questions or concerns.

–IT Community Partnerships on behalf of University Information Technology Services

~~~~~ Today’s IT Pro Tip ~~~~~

Would you like to see an infoshare on a specific topic? Send your suggestion to talk2uits@iu.edu – we’ll try to arrange it.

IT Professionals,

The eLearning Services team (eLS) want to inform you of an upcoming maintenance.

On Saturday, January 4 from 11:00am to 5:00pm EST, Turnitin and all integrations in Canvas [1] will be unavailable while the vendor performs system upgrades.

As always, we will continue to provide timely communication/additional information concerning future updates.

–          IT Community Partnerships on behalf of The eLearning Services team

[1] About Turnitin in Canvas https://kb.iu.edu/d/advs

~~~~~ Today’s IT Pro Tip ~~~~~

IT Training serves all IU campuses, providing award-winning educational resources on popular and timely tech topics. Previously, these resources were available at no additional cost to the IU community and for a small fee to those outside the university. Now, they’re no cost for all – and there’s more material than ever to choose from (including critical cybersecurity topics). Learn more.

IT Professionals,

The eLearning Services team (eLS) want to inform you of an upcoming maintenance.

On Monday, December 30 from 2:00am – 7:00am EST, Pressbooks [1] will undergo system maintenance while the vendor implements several upgrades. The vendor will perform a similar maintenance again on Tuesday, December 31 from 2:00am – 7:00am EST.

UITS does not recommend editing content or settings within Pressbooks during the maintenance window.

As always, we will continue to provide timely communication/additional information concerning future updates.

–          IT Community Partnerships on behalf of The eLearning Services team

[1] About Pressbooks at IU https://kb.iu.edu/d/aobs

~~~~~ Today’s IT Pro Tip ~~~~~

IT Training serves all IU campuses, providing award-winning educational resources on popular and timely tech topics. Previously, these resources were available at no additional cost to the IU community and for a small fee to those outside the university. Now, they’re no cost for all – and there’s more material than ever to choose from (including critical cybersecurity topics). Learn more.