Language:
SEARCH
  • Recent Posts

  • Categories

  • Archives

E-mail

SARS phishing scam

Wednesday, January 30th, 2019

Please be on the lookout for the next phishing attack on the university network. This time (as occurred several times in 2018) it comes with a subject of “SARS eFiling Letter Notification”

This is an obvious phishing scam using a website to attempt to steal your login details.

  1. SARS will not send you an email with the salutation: “Dear Tax Payer”, they’ll address you personally.
  2. The sender is a compromised email address from an estate agent in Pretoria and not a SARS email address.
  3. The link takes you to a site that is not the SARS eFiling Server address.
  4. Apart from department admin who deals with SARS directly, university email addresses are not (and should not be) used for SARS communication.

Here is an example of the email that several of our observant colleagues and students have already reported:

Here is the phishing website that will attempt to steal your login details:

If you receive an email like this, please report it to IT Cyber Security as soon as possible.

Once you have reported the spam or phishing mail, you can delete it immediately. You can report this in two ways:

  1. By reporting it on the ICT Partner Portal. Go to https://servicedesk.sun.ac.za/jira/servicedesk/customer/portal/6/create/115. Fill in your information and add the email as an attachment. Your request will automatically be logged on the system.
  2. By sending an email. 
    1. Start up a new mail addressed to csirt@sun.ac.za.
    2. Use the Title “SPAM” (without quotes) in the Subject.
    3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the – New Mail.
    4. Send the mail.

[ARTICLE BY DAVID WILES]

Feedback on Office365 outage

Friday, January 25th, 2019

On Thursday, 24 January, from 10:30 to 22:00 Outlook users across large parts of the world were left without email. A major outage affecting, among others, South Africa, South America and Europe was caused by a technical problem at one of Microsoft’s data centres in Europe. 

Subsequently, all Stellenbosch University staff could also not access their email. Connectivity to Microsoft Exchange was restored Thursday evening late and staff and students were able to access their emails again. For a full report from Microsoft on the incident, click here 

Keep in mind that cybercriminals could use incidents like these to launch attacks on email users. Neither Microsoft, not IT will ever ask you to reactivate your Microsoft account or divulge personal details.

Please take note that, in instances where email is unavailable, our Twitter feed will be used as the main communication channel and the latest updates will be posted on the feed. For any inquiries please contact the IT Service Desk at 021 808 4367 or log a request on the ICT Partner Portal.

Warning: Phishing scams with fake invoices

Monday, October 1st, 2018

The nature of the university as an academic institution means that goods like books and academic journals are purchased by staff.

Phishing scammers will often exploit these purchases by either spoofing the e-mail addresses of well-known publishers or sending “invoices” that are infected with malware to fool people into divulging personal details like passwords and bank account details, or more seriously, infecting their victim’s computers with ransomware which encrypts the contents of the hard drive and demands a ransom to unlock access to the encrypted files.

Last week several colleagues reported that they were getting invoices from a journal publisher for books they allegedly purchased. An invoice for books purchased is usually attached.

Here is an example of the phishing scam:

Please keep an eye open for this threat over the next few days. We have been reading reports of a drastic increase in the incidents of ransomware infections targeting large institutions like universities. Keep on your toes, these criminals will never stop trying, because they catch their victims from the university so easily. Don’t become a victim. Fight them by reporting these scams to the IT CyberSecurity Team, and by spreading the news to your colleagues and classmates.

 If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method: (especially if it comes from a university address) Once you have reported it, delete it or put it in your Junk Mail folder.

  1. Start up a new mail addressed to csirt@sun.ac.za, cc sysadm@sun.ac.za.
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the mail.

[ARTICLE BY DAVID WILES]

 

SARS phishing scam from sun email

Monday, August 13th, 2018

If you receive an email with the subject “SARS eFilings” from any university email account, do not respond or click on the link. This is not a legitimate email from SARS.

The suspicious email is being sent from compromised staff email accounts informing users that “An EMP Statement of Account for the tax payer listed below has been issued by SARS” and you “need to log into the google doc with your correct details to view the document”. (as shown in example below):

It is important that you help us by spreading the word, informing us about suspicious mails and letting your colleagues and friends know about the scams. You are our eyes and ears, and your input, information and questions are extremely valuable.

When you click on links and provide your information on phishing emails, criminals will be able to gain access to your personal information. If you clicked on the link of this phishing email, immediately go to the www.sun.ac.za/useradm website and change the passwords on all your university accounts.

Remember that once the phishers lose control of one compromised account they might simply move over to another account and they might also close the website they were using once it is blocked by us and would use another one that looks and acts in the same way. Currently, the phishers are servers in Europe to launch their attacks. This is a common tactic with a spear-phishing attack such as this. 

To help us, please:

  • continue to watch out for mail like or similar to this and do NOT respond to it, click on links or provide your email address username or password
  • report the new phishing mail to the correct e-mail addresses of Information Technology Cyber Security using the method added to the bottom of this post
  • remember, just because a mail comes from a “student” or a “personnel” e-mail address and has university branding does not mean in any way that it is legitimate

If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method: (especially if it comes from a university address)

  1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the mail.

IF YOU HAVE FALLEN FOR THE SCAM:

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

For more information on reporting and combating phishing and spam: http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-malware-and-phishing/

[Information supplied by David Wiles]

 

Sending emails to large groups

Monday, August 6th, 2018

Occasionally it is necessary to send emails to external students or other large groups of people who are not part of the sun domain. If you are currently using Outlook distribution lists we recommend that you switch to the much more user-friendly and functional Sympa mailing list management platform. 

For many years the university has been using Sympa as mass mailing solution successfully. In fact, many of our staff and students use it to administer their lists. 

Sympa is a mailing list management (MLM) software and has its roots in the academic computing community in France. Its name, which is an acronym for Système de Multi-Postage Automatique (i.e. Automatic Mailing System), also means “nice” or “friendly” in French. We’re not sure exactly why the French decided to call their mailing list system “nice”, but we can confirm that it is “friendly” to use.

By using Sympa as a platform for your group emails, you will have better control over your emails and access to handy functions such as:

  • appoint one or several moderators;
  • manage subscriptions and unsubscriptions;
  • add a shared document web space at the subscribers’ disposal;
  • answer questions from subscribers and potential subscribers about the list
  • read the list archive;
  • search in the message archive;
  • review members of the list;

As you can see, Sympa offers much more functionality than your normal Outlook distribution list. Any staff member can use Sympa, simply go to https://sympa.sun.ac.za/sympa.
If you need any assistance in setting up your Sympa distribution list, please send an email to help@sun.ac.za or call us at 808 4367.

 

© 2013-2020 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.