%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250715125628+00'00') /ModDate (D:20250715125628+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Contents 7 0 R >> endobj 7 0 obj << /Length 6801 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 125.618 521.469 621.116 re f 0.773 0.773 0.773 RG 0.75 w 0 J [ ] 0 d 45.641 125.993 520.719 620.366 re S 0.773 0.773 0.773 rg 61.016 141.368 m 550.984 141.368 l 550.984 142.118 l 61.016 142.118 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(WARNING: SEXTORTION SCAM)] TJ ET 0.400 0.400 0.400 rg BT 61.016 664.909 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 664.909 Td /F3 9.0 Tf [(January 02,2021)] TJ ET BT 173.588 664.909 Td /F2 9.0 Tf [( by )] TJ ET BT 188.096 664.909 Td /F3 9.0 Tf [(IT Communications)] TJ ET 0.153 0.153 0.153 rg BT 61.016 637.420 Td /F4 9.0 Tf [(There is a "sextortion" email making the rounds at the moment and with many personnel and students still working )] TJ ET BT 61.016 626.431 Td /F4 9.0 Tf [(andstudying from home, many are concerned about the risks.)] TJ ET BT 61.016 615.442 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 604.453 Td /F4 9.0 Tf [("The device has been successfully hacked" is a new ‘sextortion’ email scam for 2021. This email scam, like most )] TJ ET BT 61.016 593.464 Td /F4 9.0 Tf [(sextortion scams, relies on “social engineering”, a process through which the scammers induce shame, panic or guilt. The )] TJ ET BT 61.016 582.475 Td /F4 9.0 Tf [(scammers \(the authors of the email\) claim that they obtained material compromising the user \(because of a computer )] TJ ET BT 61.016 571.486 Td /F4 9.0 Tf [(hack, email account hack, router hack, etc\) and threaten to publish it if the ransom is not paid. None these claims are true )] TJ ET BT 61.016 560.497 Td /F4 9.0 Tf [(in any way; they are just deception.)] TJ ET BT 61.016 549.508 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 538.519 Td /F4 9.0 Tf [(The “The device has been successfully hacked” email message says that someone successfully hacked the recipient’s )] TJ ET BT 61.016 527.530 Td /F4 9.0 Tf [(device and monitored it for a long time. The hacker claims that this was made possible by a virus installed on the device )] TJ ET BT 61.016 516.541 Td /F4 9.0 Tf [(when the user visited the adult site. Using this virus, the hacker was able to record a video that compromises the user, and )] TJ ET BT 61.016 505.552 Td /F4 9.0 Tf [(gained access to the user’s personal contacts, instant messengers, and social networks. If the recipient pays $1300 in )] TJ ET BT 61.016 494.563 Td /F4 9.0 Tf [(Bitcoin, the hacker promises to delete all the data. Next, the scam email contains the bitcoin address to which the ransom )] TJ ET BT 61.016 483.574 Td /F4 9.0 Tf [(should be transferred. This email is just a sextortion scam, and all the statements are fake. )] TJ ET BT 61.016 472.585 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 461.596 Td /F4 9.0 Tf [(What to do when you receive the "The device has been successfully hacked" SCAM: )] TJ ET 0.153 0.153 0.153 RG 85.866 444.423 m 85.866 444.835 85.696 445.245 85.404 445.537 c 85.113 445.828 84.703 445.998 84.291 445.998 c 83.878 445.998 83.469 445.828 83.177 445.537 c 82.885 445.245 82.716 444.835 82.716 444.423 c 82.716 444.011 82.885 443.601 83.177 443.309 c 83.469 443.018 83.878 442.848 84.291 442.848 c 84.703 442.848 85.113 443.018 85.404 443.309 c 85.696 443.601 85.866 444.011 85.866 444.423 c f BT 91.016 441.607 Td /F4 9.0 Tf [(Do not panic.)] TJ ET 85.866 433.434 m 85.866 433.846 85.696 434.256 85.404 434.548 c 85.113 434.839 84.703 435.009 84.291 435.009 c 83.878 435.009 83.469 434.839 83.177 434.548 c 82.885 434.256 82.716 433.846 82.716 433.434 c 82.716 433.022 82.885 432.612 83.177 432.320 c 83.469 432.029 83.878 431.859 84.291 431.859 c 84.703 431.859 85.113 432.029 85.404 432.320 c 85.696 432.612 85.866 433.022 85.866 433.434 c f BT 91.016 430.618 Td /F4 9.0 Tf [(Do not pay a ransom.)] TJ ET 85.866 422.445 m 85.866 422.857 85.696 423.267 85.404 423.559 c 85.113 423.850 84.703 424.020 84.291 424.020 c 83.878 424.020 83.469 423.850 83.177 423.559 c 82.885 423.267 82.716 422.857 82.716 422.445 c 82.716 422.033 82.885 421.623 83.177 421.331 c 83.469 421.040 83.878 420.870 84.291 420.870 c 84.703 420.870 85.113 421.040 85.404 421.331 c 85.696 421.623 85.866 422.033 85.866 422.445 c f BT 91.016 419.629 Td /F4 9.0 Tf [(If there’s a link in the scam email, do not click it, otherwise you might unwittingly install malware or ransomware on )] TJ ET BT 91.016 408.640 Td /F4 9.0 Tf [(your computer.)] TJ ET BT 61.016 388.651 Td /F4 9.0 Tf [(The mail will come from several e-mail addresses, which might very from user to user. Scammers use thousands of "throw-)] TJ ET BT 61.016 377.662 Td /F4 9.0 Tf [(away" e-mail addresses to send out these scams.)] TJ ET BT 61.016 366.673 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 355.684 Td /F4 9.0 Tf [(If you do get such an e-mail use one of the two methods below to report it to IT Cyber Security as soon as possible. This )] TJ ET BT 61.016 344.695 Td /F4 9.0 Tf [(way IT can filter and block the senders)] TJ ET 0.592 0.592 0.592 rg 0.592 0.592 0.592 RG 305.016 337.997 m 306.516 337.997 l 305.766 337.247 l 305.766 337.247 l f 1.000 1.000 1.000 rg 1.000 1.000 1.000 RG 305.016 335.747 m 306.516 335.747 l 305.766 336.497 l 305.766 336.497 l f 306.516 337.997 m 306.516 335.747 l 305.766 336.497 l 305.766 337.247 l f 0.592 0.592 0.592 rg 0.592 0.592 0.592 RG 305.016 337.997 m 305.016 335.747 l 305.766 336.497 l 305.766 337.247 l f 0.153 0.153 0.153 rg BT 61.016 317.956 Td /F1 9.0 Tf [(By reporting it on the ICT Partner Portal.??)] TJ ET BT 61.016 297.967 Td /F4 9.0 Tf [(Go to https://servicedesk.sun.ac.za/jira/servicedesk/customer/portal/6/create/115. )] TJ ET BT 61.016 277.978 Td /F4 9.0 Tf [(Fill in your information and add the email as an attachment. Your request will automatically be logged on the system.??)] TJ ET BT 61.016 257.989 Td /F4 9.0 Tf [(If you have accidentally responded to the phisher and already provided them with your personal details, it is vitally )] TJ ET BT 61.016 247.000 Td /F4 9.0 Tf [(important that you immediately go to the USERADM page \(either http://www.sun.ac.za/password or )] TJ ET BT 61.016 236.011 Td /F4 9.0 Tf [(www.sun.ac.za/useradm and change your password immediately.\))] TJ ET BT 61.016 216.022 Td /F4 9.0 Tf [(Make sure the new password is completely different and is a strong password that will not be easily guessed, as well as )] TJ ET BT 61.016 205.033 Td /F4 9.0 Tf [(changing the passwords on your social media and private e-mail accounts, especially if you use the same passwords on )] TJ ET BT 61.016 194.044 Td /F4 9.0 Tf [(these accounts. Contact the IT HelpDesk if you are still unsure.)] TJ ET BT 432.949 174.055 Td /F4 9.0 Tf [([ARTICLE BY DAVID WILES])] TJ ET 0.400 0.400 0.400 rg BT 61.016 155.566 Td /F2 9.0 Tf [(Posted in:E-mail,News,Security | | With 0 comments)] TJ ET endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj xref 0 12 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000305 00000 n 0000000334 00000 n 0000000472 00000 n 0000000535 00000 n 0000007388 00000 n 0000007500 00000 n 0000007615 00000 n 0000007735 00000 n trailer << /Size 12 /Root 1 0 R /Info 5 0 R >> startxref 7843 %%EOF E-mail « Informasietegnologie
Language:
SEARCH
  • Recent Posts

  • Categories

  • Archives

E-mail

Phishing attack from compromised staff account with attached “Secure Message”

Wednesday, May 6th, 2020

With most students and personnel all working from home during the national lockdown, and with the reduced security (and watchfulness) of home computers and personnel/students in their home environment, and with many forced to use unfamiliar means of communication and collaboration like Teams, Zoom, Skype and Skype For Business, the environment is ripe for exploitation by phishers.

The following e-mail (with an infected attachment) is making its rounds at the moment from  a staff email.

If you get an email that look like the following do not open or respond to it. It is quite likely that the personnel doesn’t even know his account is compromised.

Please be careful when opening up attachments “sent” by colleagues especially if they are unannounced or the e-mail makes you feel a bit suspicious. Always trust your instincts.

“Sextortion” scams

Tuesday, April 28th, 2020

There has been a resurgence of “sextortion” phishing scams recently but with a slight twist.

“Extortion phishing” or “sextortion” is an aggressive form of a phishing attack that targets potential victims in an e-mail demanding bitcoin in exchange for a promise of non-disclosure of an alleged sexual offence.

The aim of these sextortion e-mails is clear – to force their intended victims to pay up for their silence, or the footage will be shared on social networks. Ultimately this is a typically insidious scam that could easily snare an unsuspecting user.

This variant however has an added twist, in that the phishing scammers are displaying a stolen password (from other websites) that their victims use, to grab their victim’s attention.

It is usually those other websites (e,g,. hotmail, Instagram, Paycity or Facebook) that hackers use to gain access to our data, so changing those passwords are very important.

As in the example below we received earlier this week:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Several students and personnel say that they have also received similar phishing e-mails, and that password that they had used were displayed in the subject line. They were all concerned that their network account was under attack.

If you receive such a mail, there is little danger to you UNLESS you

  1. respond to the sender
  2. still use that same password for other non-university accounts and use a variation of that password.

If it is an old password that they are displaying, then the danger to you is relatively small, but if you are still using it on a different website or application please change and update immediately.

[ARTICLE BY DAVID WILES]

Phishing emails, SMS and WhatApp messages offering payment relief during lock down

Wednesday, April 1st, 2020

A new potential threat has emerged as we enter the 2nd week of the national lock down and facing the beginning of the new month with bills  to be paid.

Phishers are already targeting the South African public with so-called COVID-19 phishing scams, attaching malware infected attachments and encouraging victims to click on a link to download “important information about the COVID-19 pandemic”.

However this week’s scam involves emails, SMS and WhatsApp messages being sent with information about “Payment Relief” from South African banks.

While it is true that most major South African banks are offering payment relief measures to their customers, phishing scammers have grasped this opportunity and adapted their tactics to send emails with content like the following:

“Dear Valued Customer,

“At ABSA Bank, we realise that this is a difficult time for our customers and businesses whose financial means are being negatively affected. After careful consideration and engagements with The Minister of Finance the, Hon. Tito Titus Mboweni, we are pleased to offer you, as a valued customer, a once-off access to a comprehensive relief programme. Please click on the following link to see if you qualify for payment relief.

VERIFY YOUR ACCOUNT

This is a once-off offer made to selected customers and will close at midnight on 2 April 2020.”

This is one such e-mail, but similar scams with forged identities from other South African banks, as well as Whatsapp and SMS messages will also surface. Note the specific deadline and the call to verify your account. Your bank won’t ever ask you to verify your account by email and certainly won’t give you a day to make such a decision. 

If you need to make use of a relief programme, rather contact your bank directly than reply to an online message. 

Here is a collection of the current verified details for payment relief from South Africa’s 4 major banks:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 [ARTICLE BY DAVID WILES]

Sending emails to large groups

Monday, March 2nd, 2020

Occasionally it is necessary to send emails to external students or other large groups of people who are not part of the sun domain. If you are currently using Outlook distribution lists we recommend that you switch to the much more user-friendly and functional Sympa mailing list management platform.

The reason for this is that Microsoft has started to limit the number of emails a sun email address can send to to 30 external email addresses per minute. Therefore, if you send to more recipients, Microsoft automatically blocks your account as their attempt to prevent spam. More detailed information on Microsoft’s policies regarding email limits, can be found on their website.

For many years the university has been using Sympa as mass mailing solution successfully. In fact, many of our staff and students use it to administer their lists. 

Sympa is a mailing list management (MLM) software and has its roots in the academic computing community in France. Its name, which is an acronym for Système de Multi-Postage Automatique (i.e. Automatic Mailing System), also means “nice” or “friendly” in French. We’re not sure exactly why the French decided to call their mailing list system “nice”, but we can confirm that it is “friendly” to use.

By using Sympa as a platform for your group emails, you will have better control over your emails and access to handy functions such as:

  • appoint one or several moderators;
  • manage subscriptions and unsubscriptions;
  • add a shared document web space at the subscribers’ disposal;
  • answer questions from subscribers and potential subscribers about the list
  • read the list archive;
  • search in the message archive;
  • review members of the list;

As you can see, Sympa offers much more functionality than your normal Outlook distribution list. Any staff member can use Sympa, simply go to https://sympa.sun.ac.za/sympa.
If you need any assistance in setting up your Sympa distribution list, please log a request for assistance on the ICT Partner Portal.

New warning banner for your email

Tuesday, February 4th, 2020

The nature of cyber-attacks is always evolving and Information Technology, with the help of staff and students, has to do everything within our power to try and prevent them.

In an attempt to tighten cyber security on campus, we will soon provide a new warning which can identify the origin of an email. By establishing the origin of email, it’s easier to protect against cyber security risks such as malware, spoofing and phishing. 

From now on, every time you receive email from outside campus a yellow banner will be displayed at the top of your email:

Click for a larger image

 

Click for a larger version

When staff or students receive a potentially dangerous email which seems to have been sent from a colleague with a sun.ac.za address, they will immediately be able to see that it is, in fact, not from their colleague, but from an address outside the university.

Just keep in mind that the banner does not indicate that the email is necessarily a security risk, but that the possibility exists and that you need to be extra careful when responding to it.

We will continuously assess the effectiveness of this decision and reconsider if necessary. For any additional enquiries, please send an email to help@sun.ac.za.

 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.