Language:
SEARCH
  • Recent Posts

  • Categories

  • Archives

E-mail

How to protect yourself from ransomware

Friday, May 19th, 2017

A serious virulent ransomware threat known as WannaCrypt0r/WannaCry has been affecting Windows computers on shared networks in around 150 countries worldwide. Once one computer on a network is affected, the malware infection easily spreads to other Windows computers on the same network, shutting down entire government agencies and national infrastructure companies. More on this attack. 

Ransomware forms part of a group of malicious computer software called malware,  which installs itself on your PC. It can be installed by means of an e-mail attachment, an infected programme or unsafe website with malware installed on it.  The software “kidnaps” your data by encrypting or limiting your access to it and then sending you a message demanding money to regain your access.  The only way access is possible again, is by acquiring an encryption key from the creator of the ransomware at a fee and this isn’t necessarily guaranteed.

But how do you protect yourself from ransomware

  • If you use Windows, install the patch that Microsoft has released to block the specific exploit that the WannaCry ransomware is using. Instructions can be found in the Microsoft Knowledge Base. You can also directly download the patches for your OS from the Microsoft Update Catalogue. (Take note that this is mostly applicable to devices that are not on the university network.)
  • Update your Antivirus software definitions. Most AV vendors have now added detection capability to block WannaCry. (Devices running on the SU network should be up to date)
  • If you don’t have anti-virus software enabled on your Windows machine, enable Windows Defender, or Avast! AV or Avira AntiVirus, which is free.
  • Backup regularly and make sure you have offline backups. That way, if you are infected with ransomware, it can’t encrypt your backups.
  • For further reading, this is an excellent detailed write-up on the WannaCry ransomware.  
  • Get the word out.

[INFORMATION SUPPLIED BY DAVID WILES]

Dangerous phishing scam disguised as a University salary increase notice

Thursday, May 18th, 2017

With the criminals first partly successful spear-phishing attack in April with an email about a salary raise and directing their victims to go to a forged webpage that looks EXACTLY like the e-HR website, they are at it again with a few variations: 

The subject is now “URGENT: Your May Salary Issue” and says the following: 

Hello,

In accordance with the Fiscal Year 2017 Salary Allocation Guidelines, this is to inform you that your monthly salary starting May 31st, 2017 will reflect a 13.98% (percent) merit increase.

Your new salary is as analyzed herewith. The documents are attached below: (attached link to the forged website)

This is an EXTREMELY dangerous e-mail, because its earlier version fooled a number of university personnel into giving the scammers their login details and passwords. 

Clicking on the link will take you to a forged version of the SUN e-HR site. If you enter your username and password (because the site looks like the SUN e-HR site), the criminals will have been given access to your personal details on SUN e-HR. 

Here is what the forged site looks like:

Note the forged address marked in yellow at the top. IT blacklisted and blocked access to that site from within the university, but please support them by following the procedures on the following page: http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

[ARTICLE BY DAVID WILES]

 

Critical ransomware attack targeted Windows computers

Saturday, May 13th, 2017
A serious virulent ransomware threat known as WannaCrypt0r/WannaCry has been affecting Windows computers on shared networks in at least 150 countries worldwide. Once one computer on a network is affected, the infection easily spreads to other Windows computers on the same network, easily shutting down entire government agencies and national infrastructure companies. More information on this attack

Ransomware is a malicious script or software that installs itself on your computer without you knowing. Once it’s installed and running, it will lock down your system and won’t allow you to access any files or programs on that computer. To unlock your system and regain access to the computer being held hostage, the lock screen informs you that you must pay for an unlock tool or decryption key from the hacker.

If your Windows computer is connected to a shared network, such as those at the University, Information Technology will automatically keep your Windows up-to-date so you don’t have to.

If you are running Windows and automatic updates are enabled you should be okay. If you don’t and haven’t updated recently you should update to the most recently released version immediately. Information Technology does manage automatic updates on many of our computers, but users also have to check their computers, especially with laptops that are taken home, in hostels and connect to other less well-managed networks. 

Keep an eye open for phishing e-mails requesting that you click on links and fill in your username and password. Beware sites that you visit that have suspicious popups that ask you to install software or “inform” you that your computer is infected with viruses.

Just because the mail looks like it has been sent from a university address or the site that you visit looks like a university or Internet banking website, don’t be fooled. Check the address and what you are being asked to do. If in doubt ask Information Technology, or your local “computer nerd”. They will be able to help and advise you.

More articles on ransomware.

[ARTICLE BY DAVID WILES]

Salary increase e-mail not quite good news

Tuesday, April 4th, 2017

Several of our observant personnel have picked up that a very suspicious e-mail is making the rounds at the moment.

The subject is “NOTIFICATION: Your 13.69% Salary Increase”. 

This is a very dangerous e-mail. Clicking on the link will take you to a forged version of the SUN e-HR site. If you enter your username and password (because the site looks like the SUN e-HR site), the criminals will have been given access to your personal details on SUN e-HR. The ramifications of this will mean that the scammers will potentially be able to get details such as your banking details, ID number, place of residence, that are all stored on the SUN e-HR system. They will potentially then be able to steal your salary.

The e-mail contains the following message:


Hello,

Attached herewith are two (2) documents summarizing your April salary as reviewed for a 13.69% merit increase in Financial Year 2017.

This review is with immediate effect starting Friday April 28th Paycheque.

Deductions and bonuses are advised therein

The documents are attached below:


 

Below is what the forged site looks like. The address is not a university server BUT very few people notice such details and tend to skim over them.

 

[ARTICLE BY David Wiles]

Phishing scam disguised as a “server warning”

Friday, March 10th, 2017

There are reports that some students and personnel have already received this mail in their mailboxes. It is a typical phishing scam but uses a different tactic to trick the recipient into divulging personal details like passwords and should not be responded to in any way. That mail was sent by a “throwaway” outlook.com mail account. It started making its appearance in June last year in Yahoo!Mail accounts.

According to this e-mail, which claims to be a “Server Message”, telling the potential victim that they recently initiated an action to shut down their e-mail account. The e-mail advises that, if they did not initiate the supposed shut down action, they should click a ‘Cancel De-activation’ link to restore your account to its normal settings.

However, the e-mail is not from the university, and no account shut down action has been initiated. The e-mail is just a crude phishing scam designed to steal your university account login details. The scammers hope that at least a few recipients will click the cancel link in the mistaken belief that they must do so to save their account.

If you do click the link, you will be taken to a fraudulent web page that has been built to emulate a genuine login screen. A form on the page asks you to enter your e-mail address and account password and click a button labelled ‘Sign in to Cancel De-activation”.  After signing in on the fake page, you will be automatically redirected to the university webmail website.

Meanwhile, the scammers can collect the login details you entered and use them to hijack your university e-mail account. Once they have gained access to your account, they can use it to send out spam and scam e-mails in your name. (as has been happening in recent weeks)

E-mail phishing scams like this one are very common. Be very wary of any e-mail that claims that you must click a link or open an attached file to rectify a supposed account problem. It is always safer to log into all of your online accounts by entering the address into your browser’s address bar or via an official app.

Here is an example of the mail that is in circulation with the dangerous parts removed. 

 

[ARTICLE BY DAVID WILES]

 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.