%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R 25 0 R ] /Count 2 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> /XObject << /I1 24 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text /ImageC ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250716211815+00'00') /ModDate (D:20250716211815+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Annots [ 12 0 R 14 0 R 16 0 R 18 0 R 20 0 R 22 0 R ] /Contents 7 0 R >> endobj 7 0 obj << /Length 7931 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 80.351 521.469 666.383 re f 0.773 0.773 0.773 rg 0.773 0.773 0.773 RG 45.266 746.734 m 566.734 746.734 l 565.984 745.984 l 46.016 745.984 l f 566.734 746.734 m 566.734 80.351 l 565.984 80.351 l 565.984 745.984 l f 45.266 746.734 m 45.266 80.351 l 46.016 80.351 l 46.016 745.984 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(SARS PHISHING SCAM FROM SUN EMAIL)] TJ ET 0.400 0.400 0.400 rg BT 61.016 664.909 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 664.909 Td /F3 9.0 Tf [(January 01,1970)] TJ ET BT 173.588 664.909 Td /F2 9.0 Tf [( by )] TJ ET BT 188.096 664.909 Td /F3 9.0 Tf [(IT Communications)] TJ ET 0.153 0.153 0.153 rg BT 61.016 637.420 Td /F4 9.0 Tf [(If you receive an email with the subject SARS eFilings from any university email account, do not respond or click on the )] TJ ET BT 61.016 626.431 Td /F4 9.0 Tf [(link. This is not a legitimate email from SARS.)] TJ ET BT 61.016 606.442 Td /F4 9.0 Tf [(The suspicious email is being sent from compromised staff email accounts informing users that "An EMP Statement of )] TJ ET BT 61.016 595.453 Td /F4 9.0 Tf [(Account for the tax payer listed below has been issued by SARS" and you "need to log into the google doc with your )] TJ ET BT 61.016 584.464 Td /F4 9.0 Tf [(correct details to view the document". \(as shown in example below\):)] TJ ET BT 61.016 564.475 Td /F4 9.0 Tf [(It is important that you help us by spreading the word, informing us about suspicious mails and letting your colleagues and )] TJ ET BT 61.016 553.486 Td /F4 9.0 Tf [(friends know about the scams. You are our eyes and ears, and your input, information and questions are extremely )] TJ ET BT 61.016 542.497 Td /F4 9.0 Tf [(valuable.)] TJ ET BT 61.016 522.508 Td /F4 9.0 Tf [(When you click on links and provide your information on phishing emails, criminals will be able to gain access to your )] TJ ET BT 61.016 511.519 Td /F4 9.0 Tf [(personal information. If you clicked on the link of this phishing email, immediately go to the www.sun.ac.za/useradm )] TJ ET BT 61.016 500.530 Td /F4 9.0 Tf [(website and change the passwords on all your university accounts.)] TJ ET BT 61.016 480.541 Td /F4 9.0 Tf [(Remember that once the phishers lose control of one compromised account they might simply move over to another )] TJ ET BT 61.016 469.552 Td /F4 9.0 Tf [(account and they might also close the website they were using once it is blocked by us and would use another one that )] TJ ET BT 61.016 458.563 Td /F4 9.0 Tf [(looks and acts in the same way.Currently, the phishers are servers in Europe to launch their attacks.This is a common )] TJ ET BT 61.016 447.574 Td /F4 9.0 Tf [(tactic with a spear-phishing attack such as this.)] TJ ET BT 61.016 425.785 Td /F4 9.0 Tf [(To help us, please:)] TJ ET 0.153 0.153 0.153 RG 85.866 408.612 m 85.866 409.024 85.696 409.434 85.404 409.726 c 85.113 410.017 84.703 410.187 84.291 410.187 c 83.878 410.187 83.469 410.017 83.177 409.726 c 82.885 409.434 82.716 409.024 82.716 408.612 c 82.716 408.200 82.885 407.790 83.177 407.498 c 83.469 407.207 83.878 407.037 84.291 407.037 c 84.703 407.037 85.113 407.207 85.404 407.498 c 85.696 407.790 85.866 408.200 85.866 408.612 c f BT 91.016 405.796 Td /F4 9.0 Tf [(continue to watch out for mail like or similar to this and do NOT respond to it, click on links or provide your email )] TJ ET BT 91.016 394.807 Td /F4 9.0 Tf [(address username or password)] TJ ET 85.866 386.634 m 85.866 387.046 85.696 387.456 85.404 387.748 c 85.113 388.039 84.703 388.209 84.291 388.209 c 83.878 388.209 83.469 388.039 83.177 387.748 c 82.885 387.456 82.716 387.046 82.716 386.634 c 82.716 386.222 82.885 385.812 83.177 385.520 c 83.469 385.229 83.878 385.059 84.291 385.059 c 84.703 385.059 85.113 385.229 85.404 385.520 c 85.696 385.812 85.866 386.222 85.866 386.634 c f BT 91.016 383.818 Td /F4 9.0 Tf [(report the new phishing mail to the correct e-mail addresses of Information Technology Cyber Security using the )] TJ ET BT 91.016 372.829 Td /F4 9.0 Tf [(method added to the bottom of this post)] TJ ET 85.866 364.656 m 85.866 365.068 85.696 365.478 85.404 365.770 c 85.113 366.061 84.703 366.231 84.291 366.231 c 83.878 366.231 83.469 366.061 83.177 365.770 c 82.885 365.478 82.716 365.068 82.716 364.656 c 82.716 364.244 82.885 363.834 83.177 363.542 c 83.469 363.251 83.878 363.081 84.291 363.081 c 84.703 363.081 85.113 363.251 85.404 363.542 c 85.696 363.834 85.866 364.244 85.866 364.656 c f BT 91.016 361.840 Td /F4 9.0 Tf [(remember, just because a mail comes from a student or a personnel e-mail address and has university )] TJ ET BT 91.016 350.851 Td /F4 9.0 Tf [(branding does not mean in any way that it is legitimate)] TJ ET BT 61.016 330.862 Td /F4 9.0 Tf [(If you have received mail that looks like this please immediately report it to the Information Technology Security Team )] TJ ET BT 61.016 319.873 Td /F4 9.0 Tf [(using the following method: \(especially if it comes from a university address\))] TJ ET BT 78.360 299.900 Td /F4 9.0 Tf [(1.)] TJ ET BT 91.016 299.884 Td /F4 9.0 Tf [(Start up a new mail addressed to )] TJ ET 0.373 0.169 0.255 rg BT 225.080 299.884 Td /F4 9.0 Tf [(sysadm@sun.ac.za)] TJ ET 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 225.080 298.733 m 303.740 298.733 l S 0.153 0.153 0.153 rg BT 303.740 299.884 Td /F4 9.0 Tf [( \(CC: )] TJ ET 0.373 0.169 0.255 rg BT 327.239 299.884 Td /F4 9.0 Tf [(help@sun.ac.za)] TJ ET 0.18 w 0 J [ ] 0 d 327.239 298.733 m 391.904 298.733 l S 0.153 0.153 0.153 rg BT 391.904 299.884 Td /F4 9.0 Tf [(\))] TJ ET BT 78.360 288.911 Td /F4 9.0 Tf [(2.)] TJ ET BT 91.016 288.895 Td /F4 9.0 Tf [(Use the Title SPAM \(without quotes\) in the Subject.)] TJ ET BT 78.360 277.922 Td /F4 9.0 Tf [(3.)] TJ ET BT 91.016 277.906 Td /F4 9.0 Tf [(With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail )] TJ ET BT 91.016 266.917 Td /F4 9.0 Tf [(Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the )] TJ ET BT 91.016 255.928 Td /F4 9.0 Tf [(attachments section of the New Mail.)] TJ ET BT 78.360 244.955 Td /F4 9.0 Tf [(4.)] TJ ET BT 91.016 244.939 Td /F4 9.0 Tf [(Send the mail.)] TJ ET BT 61.016 224.950 Td /F4 9.0 Tf [(IF YOU HAVE FALLEN FOR THE SCAM:)] TJ ET BT 61.016 204.961 Td /F4 9.0 Tf [(If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and )] TJ ET BT 61.016 193.972 Td /F4 9.0 Tf [(password you should immediately go to )] TJ ET 0.373 0.169 0.255 rg BT 221.081 193.972 Td /F4 9.0 Tf [(http://www.sun.ac.za/useradm)] TJ ET 0.18 w 0 J [ ] 0 d 221.081 192.821 m 341.627 192.821 l S 0.153 0.153 0.153 rg BT 341.627 193.972 Td /F4 9.0 Tf [( and change the passwords on ALL your university )] TJ ET BT 61.016 182.983 Td /F4 9.0 Tf [(accounts \(making sure the new password is completely different, and is a strong password that will not be easily )] TJ ET BT 61.016 171.994 Td /F4 9.0 Tf [(guessed.\) as well as changing the passwords on your social media and private e-mail accounts \(especially if you use the )] TJ ET BT 61.016 161.005 Td /F4 9.0 Tf [(same passwords on these accounts.\))] TJ ET BT 61.016 141.016 Td /F4 9.0 Tf [(For more information on reporting and combating phishing and spam:)] TJ ET 0.373 0.169 0.255 rg BT 339.638 141.016 Td /F4 9.0 Tf [(http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-)] TJ ET 0.18 w 0 J [ ] 0 d 339.638 139.865 m 545.243 139.865 l S BT 61.016 130.027 Td /F4 9.0 Tf [(malware-and-phishing/)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 128.876 m 152.042 128.876 l S 0.153 0.153 0.153 rg BT 402.934 110.038 Td /F4 9.0 Tf [([Information supplied by David Wiles])] TJ ET BT 61.016 90.049 Td /F4 9.0 Tf [()] TJ ET q 225.000 0 0 145.500 61.016 427.766 cm /I1 Do Q endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 12 0 obj << /Type /Annot /Subtype /Link /A 13 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 427.7659 286.0157 573.2659 ] >> endobj 13 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/files/2018/08/burden.jpg) >> endobj 14 0 obj << /Type /Annot /Subtype /Link /A 15 0 R /Border [0 0 0] /H /I /Rect [ 225.0797 299.0512 303.7397 308.2087 ] >> endobj 15 0 obj << /Type /Action /S /URI /URI (mailto:sysadm@sun.ac.za) >> endobj 16 0 obj << /Type /Annot /Subtype /Link /A 17 0 R /Border [0 0 0] /H /I /Rect [ 327.2387 299.0512 391.9037 308.2087 ] >> endobj 17 0 obj << /Type /Action /S /URI /URI (mailto:help@sun.ac.za) >> endobj 18 0 obj << /Type /Annot /Subtype /Link /A 19 0 R /Border [0 0 0] /H /I /Rect [ 221.0807 193.1392 341.6267 202.2967 ] >> endobj 19 0 obj << /Type /Action /S /URI /URI (http://www.sun.ac.za/useradm) >> endobj 20 0 obj << /Type /Annot /Subtype /Link /A 21 0 R /Border [0 0 0] /H /I /Rect [ 339.6377 140.1832 545.2427 149.3407 ] >> endobj 21 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-malware-and-phishing/) >> endobj 22 0 obj << /Type /Annot /Subtype /Link /A 23 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 129.1942 152.0417 138.3517 ] >> endobj 23 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-malware-and-phishing/) >> endobj 24 0 obj << /Type /XObject /Subtype /Image /Width 300 /Height 194 /ColorSpace /DeviceRGB /Filter /DCTDecode /BitsPerComponent 8 /Length 10899>> stream JFIF;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82 C    !'"#%%%),($+!$%$C   $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$," }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?K^tAm챷̹dwӿ% O<km:+YG'1RYjpYlPAS(QF(1F(1@b(b (QEQE% O𿄭 27Opr9Kڕ>st+Y,tKyWl p{֕72(ʿfYDj$+_'mYz"0W ]k3vr5մ GQrH Vf<09dGm>e l% @9}Əg=ᴙLs{\x?IJFb+Tbp}Ǡ8MFI2 ۙUQ~i qQv"xlYBHdv nr{ }hKl6bg/'j)옷Xϻ8}jZʶ6O"ó`0n˵Z{,Wlp9݌ӚBvdW=,&XXmj&8 ۛ$|zS vP>b=:`=k7^-[pѤɸg88݃Oo&vq:+x\A*Epf91qĭ'}fl(m vۥtTW:.P,c+1 1Sj;EʖH{h:\4PSzd0Oüw>%Y\<|7NI<~Ess>&2ٶqm'`9hhwz vpP!9sy J()i{, *违UdXgv ǀ>S󬮡;w}8|L|(_Ώ:8AvTzE qks:H<YR,{Ev ] *?vܰiOfdծ?ypLc=ԔEx L,7; m+Bvn ķ[p"Yʁ9Ucg*N 5gpɍѥWpnNcG9,G1RM %"GFI]>l{8 +_  8_6; +iwysZmZk]Zج,dP!G>+grYbYH m(ϰ,&69!+"[aJP.#XD:6ً1Ʈ~4xK;av.@EP7uY * F@]z2u,<6l^Vf2`s7E5%;/dy7.fT=FOzJ;p}n[~*V֊,g{wUw187F^>`@8#EkEkekeq煀pXBӯR 9Lf8r0O^㏡>GCNMr,1h`8MhA*]ۼDҬ -#߅ys@ 0"VdUl"{Luietv#Q)s(|V/| j\[;M,+1fRH*|E76svP0;7U-sCNԾ!zF%僙|P dtLJaɎdf`36 '֦qwm$f:%0-*מo|mXY ";l \cOQ#2POݷvr-4H'yU'kg͟-Hs팚_K&i$mBYKݎ?4{-R\$?QxR/|}Z_4Ic?_0F ̓€,Eytb*0OU(])E(0* 8N:՘mHXS"Iǔ[#$?Z>%l?l #dq?I䙆~m< rG<^,ԷG.[6?tq wZEy乑cB0^Prq:*5[8yur&DȪ@#{hNqm5/#jwpۂJ}ӍeFj6km% I ܃@0Xt˱gvE$wv~wPhv:4]R~،~Ri8=]v<{&iJD `I'$ƭ  )$O;|)ݓ<ߧ}foZEևj:I &aIJ: ⇖╯Me嫲mXsǹ\M}cu!Ӯ v6b[0vA׌1C:U~&hv4+}oB۲ \=)K.ħof9(2xZ($y/ ٭9=H?K'mഴkRS Ys1}i9((—=R(d{uVSЂQwJM͌2T$d#w\5Rg8!3\DK[H5Oi$p*8۴HI<j& :ˀJ.H8P=QE=2,*ț%C_Ns\|Ege%[ sq$q3*0VaT7zXVǎodQP˧n# P=ejJ6Z[ۛo>+D$*oN<)mI [}~cuH.L:vւk&FQP ~Rdj;B10ws ͐6sӭhGH(9Or~7!KIZ if7ܥ+!#?!یcO}%4*ۼv奚71F1ԑǠ9sJXKEΪA xt,#FIdb?kOovI,Or!U9lHԉ[Ǻ\0,6+QZ6wvXu";푃h `1G ㏧ȼ)Bţ-$}E6:4K XREEm/s3靼29 x^ԅ0" @wg~rAV20 OhqTӡP^22<ퟻ>.N܃8>sע1z6n `;Wo la ['.WfO98ZPd. m>Hv?'''MD<#.Ռl &v醎2AclQ@wѮiyd9s$ѮOh1v2sZ(;B1nl s1z<B%ҭULmۿcckfO hѼo bQ]bʟvO}kШ?͋Gg:2I0luk7 ~G̪x#vT9"QEpTұi k¢GW $[x >py<3G={Ƈ9E91F%c$v@ (A6.s~T(6/\ (*JZ(/DQ8yk9Zu-r~Q^:Wq:1EPEPEPEPEPEPEPEPEPEPEPM(qEYWW++cU4G-@ 0qGdڍO3"p d`#aǽKvL>z ed=iPI 7V3ol^Y3[(w .7 s%~K$-Bc#PEwUs.YN6>n9j& 4ou4v؇@_8vGRu˰&G-IF׷t.Bwc)Qk06}N}(FʖU(|#o\tFNߟqנ Z+%P9lC cKBc@01'P:Em\ ԋy~b$|p_(BڙNcO{E6* ͸Ѣ%/Ʃb]03s^"4h϶lʿa -8T.V[Px?ZТUT:c! %oG[I~FMO9?ƨkmfZIe*Ma?x9ztI(Gv&ΆzٍvS+ٍpr0yn}\(;/ }G=vfb;/QY7/zỌ=_"AN2Š2(@fE(((`36zHWvN[۞S? )U-0Q#F[c I$zN}zV%&GOvjB#̅0?5zT  c k&&Z@'nEdZʨ-'8ך62<̃'1޴h UxXJ$pS?);ס<ןi@G,nR  縭(5O)y76{5V1p5Ee+T2%Uӌn$N6XQТ(cT#ߛبkJI#?'[PtHcPLo\4^V9| ʨŸ::I`A9OLh2jRVD_>j' 1޴(kbUHF>%`+(( O]袪_& (((((((((((((((((( endstream endobj 25 0 obj << /Type /Page /Parent 3 0 R /Contents 26 0 R >> endobj 26 0 obj << /Length 627 >> stream 0.153 0.153 0.153 rg 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 719.245 521.469 38.739 re f 0.773 0.773 0.773 rg 0.773 0.773 0.773 RG 45.266 719.245 m 566.734 719.245 l 565.984 719.995 l 46.016 719.995 l f 566.734 757.984 m 566.734 719.245 l 565.984 719.995 l 565.984 757.984 l f 45.266 757.984 m 45.266 719.245 l 46.016 719.995 l 46.016 757.984 l f 61.016 734.995 m 550.984 734.995 l 550.984 735.745 l 61.016 735.745 l f 0.400 0.400 0.400 rg BT 61.016 749.193 Td /F2 9.0 Tf [(Posted in:E-mail,Phishing,Security | | With 0 comments)] TJ ET endstream endobj xref 0 27 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000339 00000 n 0000000376 00000 n 0000000514 00000 n 0000000631 00000 n 0000008614 00000 n 0000008726 00000 n 0000008841 00000 n 0000008961 00000 n 0000009069 00000 n 0000009196 00000 n 0000009298 00000 n 0000009426 00000 n 0000009501 00000 n 0000009629 00000 n 0000009702 00000 n 0000009830 00000 n 0000009910 00000 n 0000010038 00000 n 0000010163 00000 n 0000010290 00000 n 0000010415 00000 n 0000021483 00000 n 0000021548 00000 n trailer << /Size 27 /Root 1 0 R /Info 5 0 R >> startxref 22227 %%EOF E-mail « Informasietegnologie
Language:
SEARCH

  • Recent Posts

  • Categories

  • Archives

E-mail

« Older Entries
Newer Entries »

PHISHING: ABSA account statement

Monday, October 9th, 2017

Please be wary of receiving so-called “Bank Account Statements” or alleged payment/transaction notifications that arrive in your mailbox from one of South Africa’s banks. In most cases, they are phishing scams designed to fool you into willingly giving the criminals your bank account details and password/PIN code.

The warning signs are obvious, but the amount of email that we all get every day and the day-to-day stress of the workday, often make us miss the warning signs. 

Below is a typical phishing scam some university accounts received this morning. It could just as well be FNB or Standard Bank, therefore it’s important that you note the warning signs:

  1. Do you have a bank account with the bank? If not why are they sending you an account statement?
  2. Unless you are directly responsible for your department’s finances and your department has a bank account with ABSA or your official university e-mail account is the contact address for your bank correspondence, you shouldn’t be getting emails from any bank.
  3. There is no personal salutation. Banks have your contact details and they will always address you personally, never as “Dear Customer”.
  4. The grammar and spelling are usually poor. This is because the scammers are often from countries where English isn’t the main language.
  5. There is always an attached file or link you should click on or open and type in your details including passwords to “verify” your identity. Email is NOT secure and revealing any details with this medium is very risky.
  6. Branding (e.g. logos and templates) of banks can easily be copied from the bank websites and forged. Just because the bank’s logo is in the e-mail it doesn’t make the mail is official.
  7. The website you are taken to will not be the official address. Often these are compromised websites which have been hacked by criminals and used for identity theft. See the example below. The address in the address bar is clearly not ABSA’s address.

The phishing website looks like this – very similar to the login page of the ABSA website:

[ARTICLE BY DAVID WILES]

 

 

 

Email

Tags:
Posted in E-mail, phishing, Security | Comments Off on PHISHING: ABSA account statement

PHISHING: “Server Message: Verify your email account”

Wednesday, September 27th, 2017

There is a phishing scam going around disguised as an “e-mail upgrade”. Please do not respond to any e-mail asking you to click on links and provide any sort of personal information, including usernames and passwords.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

 

Here is an example of today’s phishing scam as reported by several colleagues and students already. (Links have been removed)

 

From: Mail Administrator [mailto:phishing@e-mail.address]
Sent: Saturday, 23 September 2017 3:37 AM
To: Your University E-Mail Address <somebody@sun.ac.za> <somebody@sun.ac.za>
Subject: Server Message:Verify your somebody@sun.ac.za email account.

 

Dear somebody@sun.ac.za

Access to your account will be temporarily limited for failing automated security server update.

Kindly upgrade your email with the link below to re-verify account ownership or your email account will be deactivated..
 
Click here to verify your details.

Thanks for taking this additional step to secure your account.

Email Administrator

 

[ARTICLE BY DAVID WILES]

 

Email

Tags:
Posted in E-mail, phishing, Security | Comments Off on PHISHING: “Server Message: Verify your email account”

How to recognise a phishing website

Friday, September 22nd, 2017

Over the past few years, as phishing started to gain a stronger foothold closer to home, we’ve tried to give you tips on how to recognise the typical phishing email. However, recognising the email is just the first step. The actual danger is in the website you reach after you’ve clicked the link. This is where your information is harvested to be used maliciously later. 

Considering Google is the expert on the internet, we’ve consulted their guide to recognising a phishing website. Here’s what they say:

1. What is phishing?

Phishing is a particularly popular scam in which a party creates an official-looking web page that asks you to provide your username and password, or other personal information such as your Social Security number, bank account number, PIN number, credit card number, or mother’s maiden name or birthday. 

In many cases, you’ll receive a link to this phishing page via an email which claims to come from an official-looking (but probably forged) address. You can also end up at these pages by following links that you find on the web or in IM messages.

2. How can I tell if a page is a fake?

The best thing to do is to check the page’s URL to make sure it’s actually controlled by the party it appears to be controlled by. The crucial part of the URL is the part between the HTTP:// and the next slash (‘/’). (If there’s no slash, start at the end of the URL.) This is the part of the URL that determines site ownership. Some popular domains, for instance, are amazon, google, and eBay: 

http://www.amazon.com 
http://www.google.com 
http://www.ebay.com 

In some cases, URLs will be a bit more complex; be sure to check the name listed immediately to the left of the top level domain (.com, .net, .co.uk, etc.). For instance, http://www.google.com, http://news.google.com and http://www.google.com/firefox/ are all part of the same site. However, google.com.fraudulentdomain.com/login.html is NOT! Neither is www.g00gle.com (note that in this URL, the letter o is replaced by the number 0). 

Tip: Since a forged URL can look very similar to a genuine one, it’s safer to use a bookmark you’ve created or to type the URL into the location bar by hand instead of following links from your email. This is important for any page where you’re asked to log in or provider private information.  Additional Resources: antiphishing.org

3. How does Google know a page is bogus?

We use several techniques to determine whether a page is genuine, including the use of a blacklist containing pages that have been identified as suspicious and/or misleading based on automated detection or user reports. Our software also examines pages’ content and structure in order to catch potentially misleading pages. Google Safe Browsing can’t offer perfect protection, so you should always be on the lookout for indications that a site isn’t what it appears to be. But Google Safe Browsing can help identify and protect you against many of the sites designed to trick users.

4. What does an alert look like?

When we suspect that a page is bogus, an alert will appear on the page. The appearance of the alert will depend on your browser, but they all look like this: 

5. How do I report a page that I think is phishing?

If you find a page that you believe is pretending to be another page in an attempt to steal users’ information, please report it to us.

6. You’re flagging a legitimate page as a potential phishing site. How do I get this fixed?

If you believe that Google Safe Browsing is incorrectly identifying a page as suspicious, please do report it to our team. We work hard to act quickly on all such reports.

7. Does this feature protect me against viruses, spyware, and all other evil things?

Sorry, but no “Google Safe Browsing” protects against phishing and malware attacks, but it can’t offer foolproof protection (although we’re working on it). You still need to watch out for all the other bad things that can happen on the wild, wild web.

Email

Tags:
Posted in E-mail, Security | Comments Off on How to recognise a phishing website

PHISHING: “Invoice” from a colleague

Wednesday, September 20th, 2017

Today’s phishing attack takes the form of an invoice apparently sent by a “colleague”. Because this comes from a “Doctor” and the e-mail message tone is not formally worded, it can often be misconstrued as legitimate and can be trusted.

This is a common phishing scam. The attachment is a fake invoice that, when opened, will infect your computer with malware, which gives the criminals access to your personal information, but primarily to steal online banking details.

Some departments within the university are particularly vulnerable because they may receive invoices regularly from a number of sources.

The email may appear as if it was sent by a well-known supplier or other trusted source. (in this case a so-called “Doctor” with a uniquely South African surname) Often the email address of a legitimate supplier or a colleague or friend will be mimicked or “spoofed” in a bid to trick you into thinking the invoice is genuine.

The attached invoice will look like a standard document or spreadsheet, however, to view the file you must enable a “macro”, which is a set of pre-programmed instructions for a computer. This macro installs the malware, which can infect the university network.

In the case below, you are directed to a website which tries to open up an infected “Word” document that records your online banking details, along with other financial information, before sending it on to the criminals who then attempt to steal money from your accounts.

 

—–Original Message—–

From: Cornelissen

Sent: 18 September 2017 03:56 PM

To: University Address <Your e-mail address>

Subject: Invoice #66633 (This number random and will change)

 

Hello,

I’ve tried to call you but couldn’t get thought. Need to know the status of this invoice I’ve sent to you a while ago. provided a copy below.

Invoice #66633:

Phishing site address

(Your name will go here)

Kind Regards,

Cornelissen, LM, Dr

 

Here are some handy tips to detect and deal with this “fake invoice” phishing scam.

  • Be on the lookout for unexpected invoices or unusual payment requests.
  • Avoid enabling any macros on an untrusted document.
  • If you’re suspicious – don’t reply to the email but instead call your supplier on the number that you have on file to check the authenticity of the invoice.
  • Ensure you have the latest anti-virus and security updates installed on your computer and consider using high-level macro security settings in software applications.
  • Ensure strong firewalls are in place to help detect malware and prevent data leaving the network without permission.
  • Consider using a separate computer dedicated to making online payments to minimise security risks, especially if you use personal Facebook or other social media sites.

 

 

If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to help@sun.ac.za

 Attach the phishing or suspicious mail on to the message if possible. There is a good tutorial on how to do this at the following link (Which is safe) : http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

1. Start up a new mail addressed to help@sun.ac.za)

2. Use the Title “SPAM” (without quotes) in the Subject.

3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.

4. Send the mail.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

[ARTICLE BY DAVID WILES]

Email

Tags:
Posted in E-mail, phishing, Security | Comments Off on PHISHING: “Invoice” from a colleague

PHISHING: “Important notice from IT”

Thursday, September 7th, 2017

A phishing attack on Stellenbosch University via an internal sun email address was launched again early this morning. See the example below with dangerous links removed.

Unfortunately, this email used our own template to lure you into trusting it. Take note that we will never ask you to update your information in this way.

Please do not click on this email, do not fill in your personal information and delete the email immediately. If you follow the link and supply your information, it will be used by phishing criminals to gain access to your personal information, including your bank details.

If you have any inquiries, please let us know by logging a request on ServiceNow or calling our Service Desk at 808 4367. For more information on this and other phishing attacks, refer to our blog and Twitter account.

Email

Tags:
Posted in E-mail, phishing, Security | Comments Off on PHISHING: “Important notice from IT”

« Older Entries
Newer Entries »
 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.