Important Information for Apple Users - Masque Attack

Earlier this week, the FireEye security company released a report about an iOS vulnerability referred to as “Masque Attack” (Details available at http://www.fireeye.com/blog/technical/cyber-exploits/2014/11/masque-attack-all-your-ios-apps-belong-to-us.html). The US Government’s Computer Emergency Readiness Team has also released an alert (https://www.us-cert.gov/ncas/alerts/TA14-317A). The “Masque Attack” vulnerability could allow an attacker to install a malware-filled app on top of a legitimate iOS app over the internet.

This is a vulnerability in the iOS operating system rather than in any specific iOS app, and thus only Apple will be able to resolve the vulnerability. Unfortunately, we do not have an official statement from Apple regarding this vulnerability in iOS at this time. We recommend that iOS users follow these guidelines for protecting their phones:

1.       Don’t install apps from third-party sources other than Apple’s official App Store.

2.       Don’t click “Install” on a pop-up from a third-party web page, no matter what the pop-up says about the app. The pop-up can show attractive app titles crafted by the attacker.

3.       When opening an app, if iOS shows an alert with “Untrusted App Developer”, as shown here (http://www.fireeye.com/blog/wp-content/uploads/2014/11/IMG_0001.jpg), click on “Don’t Trust” and uninstall the app immediately.

What is the POODLE Vulnerability and How Can You Protect Yourself?

What is POODLE? It stands for “Padding Oracle On Downgraded Legacy Encryption.”

If an attacker using a Man-In-The-Middle attack can take control of a router at a public hotspot, they can force your browser to downgrade to SSL 3.0 (an older protocol) instead of using the much more modern TLS (Transport Layer Security), and then exploit a security hole in SSL to hijack your browser sessions. Since this problem is in the protocol, anything that uses SSL is affected.

As long as both the server and the client (web browser) support SSL 3.0, the attacker can force a downgrade in the protocol, so even if your browser tries to use TLS, it ends up being forced to use SSL instead. The only answer is for either side or both sides to remove support for SSL, removing the possibility of being downgraded.

How Can We Solve the Problem?

Since there’s no way to solve the problems with SSL, the only solution is for browser makers and web servers to upgrade everything to remove support for SSL and require only TLS encryption.

Most of the large web companies are removing support for SSL after this problem came to light, but it will take a while for everybody to do so.Google and Firefox have already announced that they will be removing support in the future but for now, it is extremely easy as an end-user to disable SSL 3.0 in IE. 

You can remove support for SSL from your browser using one of the methods outlined below — or if you are using Firefox or Google Chrome and aren’t using hotspots all the time, you could wait for them to update the browser. Or you can make sure that you’ve fixed the problem yourself.

Disabling SSL 3.0 in Mozilla Firefox

Start by opening up your Firefox browser and navigating to the SSL Version Control download page in Firefox.

When it has successfully been installed, you can enter “about:addons” into the navigation bar and select the “SSL Version Control” extension. You can click on “Options” to see the settings for the extension. Ensure that the “Automatic Updates” are on and that the “Minimum SSL Version” is set to “TLS 1.0”

After Firefox 34 has been released, you can feel free to disable the extension or uninstall it.

Disabling SSL 3.0 in Google Chrome

Simply go to your Google Chrome desktop icon and right click on it then select “Properties” at the bottom of the popup menu.

In the “Properties” window you will see a text input box that says “Target.” Simply click in this box and press the “End” button on your keyboard. Next, press the “Spacebar” and copy and paste this text onto the end.

--ssl-version-min=tls1

Press “Apply” then click “Continue” in the popup window then press “OK.”

Now your browser will automatically reject SSL 3.0 certificates and only accept TLS 1.0 and higher. It’s worth noting that if you launch Chrome through any other shortcut on your computer, it won’t be using this flag.

Disabling SSL 3.0 in Internet Explorer

Microsoft has not yet announced when they are planning to address the SSL 3.0 issue so it is best to disable it yourself by opening your “Start” menu and typing in “Internet Options.”

Go to the “Advanced” tab and scroll down to the “Security” section until you see the SSL and TLS options, and then un-check the option for Use SSL 3.0, and enable TLS instead.

This way you can be sure that your Internet browsers are all secure from any potential POODLE attacks.

Vote for your fave KasasaT

It’s a win-win! Vote for your fave KasasaT at http://shout.lt/Hplb and you could 
win 1 of 50 free shirts. Plus, select LA Financial Credit Union on the entry form and we 
could win free shirts too! #DoYouKasasa?

Check your online presence for identity theft!

Regular checkups will alert you to any changes with your online status which may signal identity theft. Review your credit report to see if any unrecognizable accounts were opened in your name. Check for unexplained withdrawals or charges on your credit card and bank statements. You should also make sure your important bills and statements are coming to your address since the first step for some identity thieves is to change the mailing address for an account. By doing these simple things, you’re keeping a finger on the pulse of your finances, and that will help protect you from attempted identity theft or fraud.

Love your savings.

Everyone is looking for ways to save money, and that's just what Love My Credit Union Rewards is all about. 

LA Financial is excited to offer you, our member, exclusive discounts and benefits on products and services you use every day. Credit union members have already saved over $1 billion with Love My Credit Union Rewards discounts. So along with lower loan rates and fewer fees, here’s another way you can save even more.

·         Exclusive discounted pricing on most new Chevy, Buick, or GMC vehicles with the Credit Union Member Discount from GM

·         Save 10% on select regularly priced Sprint monthly service; businesses save 15% on select regularly priced Sprint monthly service. Plus, waived activation and upgrade fees (up to $36 savings for each)

·         Savings of up to 50% off other popular plans from Credit Union Auto Club

·         Save up to $15 on TurboTax Federal tax products

·         Save on services for your home from ADT, DIRECTV, Allied, and more

·         Earn cash back when you shop at over 1,500 online retailers with Love to Shop

The more offers you take advantage of, the more you save.  Start saving today at LoveMyCreditUnion.org.

Get Your Pre-Approval

Get pre-approved for an auto loan before you shop! Knowing how much car you can afford will come in handy when you’re trying to negotiate a deal. In addition knowing what you can afford will save you time by leading you straight to vehicles in your price range. Apply online here.

We Lowered Our Adjustable Mortgage Rates

The many benefits of owning your own home are legendary: tax deductions for mortgage payments (consult your tax advisor). . . the most solid hedge against inflation. . .and the opportunity to build equity over the years. . .are just a few. Homeownership is the American Dream. But unlocking that dream can be daunting these days.

Still, it does not have to be out of reach. The key is to get a mortgage that makes a new home fit into your budget from the start.

That’s where LA Financial comes in. Our always-superior home loans just got even better! Case in point: As of September 2nd, the rate on our most popular mortgage — the 5/1 Adjustable Rate Mortgage (ARM) — has been lowered. The new rate is just 2.889% APR*, fixed for 5 years (as the name implies), and adjusted thereafter for the remainder of the 30-year term. Amortized comfortably over the 30 years, this loan is designed to be affordable. At 2.889%APR, you pay only $415 per $100,000 borrowed. But the new super-low rate is not the only reason why our 5/1 ARM is super-desirable. Like our other conforming Adjustable Rate Mortgages — the 3/1, 7/1 and 10/1 ARM — this special loan features:

• NO points

• NO PMI (Private Mortgage Insurance)

• PLUS, amounts as high as 90% loan-to-value.

In short, your out-of-pocket costs are kept to a minimum.

Of course, we also offer all manner of First and Second Trust Deeds, including fixed-rate home loans, Conforming Loans (up to $417,000) and Super-Conforming Loans (up to $625,500), and terms of 10, 15, 20 and 30 years.

To find out what loan best suits your needs, visit our website at www.lafinancial.org or contact a Real Estate Representative at 800.894.1200 for more information and a rate quote. You can also apply online, at your convenience.

* For a $417,000 5/1 ARM loan for 30 years at an initial interest rate of 2.875%, the APR is 2.889%. A 5/1 ARM loan has a fixed interest rate for the first 5 years. After 5 years, the rate can change once every year for the remaining life of the adjustable-rate mortgage.  When the rate changes, the monthly payments will increase if rates go up and decrease if rates fall. Rate changes can occur annually according to the market index. For ARM interest rates, at adjustment, the new mortgage rate will be the weekly average yield on United States Treasury Securities adjusted to a constant maturity of 1 year, as made available by the Federal Reserve Board, plus a margin of 2.750% subject to annual and lifetime adjustment caps. Interest rate and APR is based on current market rates, for properties located in the states of California and Arizona. These rates are not guaranteed, are current as of 9/23/14, are subject to change without notice and may be subject to pricing add-ons related to property type, loan-to- value, credit score, occupancy type, and other variables. Monthly payment does not include taxes or insurance so the actual monthly cost may be greater. Call for details. This is not a credit decision or a commitment to lend.

LA Financial Staff raised $1780 for Children's Miracle Network Hospitals

Members of our staff donated $25 to wear jeans on the five Wednesday's leading up to September 10th. Our goal was to raise $1,000 for Children's Miracle Network Hospitals and we have exceeded our goal and raised $1,780. Awesome job LA Financial Staff!!!

Now, Our Vehicle Loan Rates are the SAME for New, Used and Refinanced!

As Good As New!! L.A. Financial has done it again!  We've revved up the savings when it comes to buying a pre-owned car, truck or van...or refinancing the one you have...by down-shifting our used car loan rates to match those of new cars. As of September 2nd, our Used Vehicle Loans will feature the same rock-bottom rates - as low as 1.90% APR - once reserved for our New Vehicle Loans!    And like their "new" counterparts, these winning rates come with terms up to 5 years.In dollars and cents, that means you don't need a down payment.  And your monthly payments will be just $17.49 for every $1,000 borrowed for five years.  Now that's affordable!  But it gets better.  We offer even longer terms - six and seven years - at slightly higher rates, to provide smaller monthly payments for larger loan amounts.  Here again, these same rates and terms are available on used vehicle loans. As low as 2.15% APR on 6 year terms ($14.83 per $1,000 borrowed) As low as 2.40% APR on 7 year terms ($12.96 per $1,000 borrowed) Now, here's the amazing part: This exceptional opportunity is not just intended for "pre-owned" vehicles a couple years old.  Our "good as new" rates and terms apply to all vehicles - cars, trucks, and vans - UP TO 10 YEARS OLD! This gives you maximum flexibility when you shop for a pre-owned car.... or if you decide to refinance your current vehicle financed with another lender, or owned free and clear.  That's right.  You can use your paid-off car, up to 10 years old, to secure a loan with rates as low as 1.90% APR and get the cash back!  And at LA Financial, there are no loan origination fees, and no pre-payment penalties...ever.  Got the old car blues?  Visit us at www.lafinancial.org, use our rate calculators, and find out how much money you can save.  Then get pre-approved today so you can shop with the power of cash in hand.  Get your best deal with a vehicle loan that's as good as new. * APR= Annual Percentage Rate.  Discounted rate includes 0.50% reduction for checking account with Direct Deposit -OR- 0.25% reduction for automatic payment & 0.25% reduction  for Direct Deposit/Payroll Deduction (maximum 0.50% total rate discount per loan). 100% Loan-to-Value on all cash-out refinances. Maximum mileage 100,000 (36-60 months) 85,000 (72 months) 50,000 (84 months) Maximum loan amount $150,000.  All rates are quoted on approved credit as Annual Percentage Rates (APRs). Some restrictions may apply. Loan approval subject to credit and income evaluation. Consumer loan rates may vary depending on credit profile, term, mileage, and the amount financed. Rates and terms are subject to change without notice.

The Credit Union will be closed on Monday, September 1 in observance Labor Day

LA Financial Credit Union and Havasu Community Credit Union will be closed on Monday, September 1 in observance of Labor Day. Accounts can still be accessed via ATM, anytimeBanking and anytimeMobile.