%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250719074302+00'00') /ModDate (D:20250719074302+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Contents 7 0 R >> endobj 7 0 obj << /Length 6801 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 125.618 521.469 621.116 re f 0.773 0.773 0.773 RG 0.75 w 0 J [ ] 0 d 45.641 125.993 520.719 620.366 re S 0.773 0.773 0.773 rg 61.016 141.368 m 550.984 141.368 l 550.984 142.118 l 61.016 142.118 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(WARNING: SEXTORTION SCAM)] TJ ET 0.400 0.400 0.400 rg BT 61.016 664.909 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 664.909 Td /F3 9.0 Tf [(January 02,2021)] TJ ET BT 173.588 664.909 Td /F2 9.0 Tf [( by )] TJ ET BT 188.096 664.909 Td /F3 9.0 Tf [(IT Communications)] TJ ET 0.153 0.153 0.153 rg BT 61.016 637.420 Td /F4 9.0 Tf [(There is a "sextortion" email making the rounds at the moment and with many personnel and students still working )] TJ ET BT 61.016 626.431 Td /F4 9.0 Tf [(andstudying from home, many are concerned about the risks.)] TJ ET BT 61.016 615.442 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 604.453 Td /F4 9.0 Tf [("The device has been successfully hacked" is a new ‘sextortion’ email scam for 2021. This email scam, like most )] TJ ET BT 61.016 593.464 Td /F4 9.0 Tf [(sextortion scams, relies on “social engineering”, a process through which the scammers induce shame, panic or guilt. The )] TJ ET BT 61.016 582.475 Td /F4 9.0 Tf [(scammers \(the authors of the email\) claim that they obtained material compromising the user \(because of a computer )] TJ ET BT 61.016 571.486 Td /F4 9.0 Tf [(hack, email account hack, router hack, etc\) and threaten to publish it if the ransom is not paid. None these claims are true )] TJ ET BT 61.016 560.497 Td /F4 9.0 Tf [(in any way; they are just deception.)] TJ ET BT 61.016 549.508 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 538.519 Td /F4 9.0 Tf [(The “The device has been successfully hacked” email message says that someone successfully hacked the recipient’s )] TJ ET BT 61.016 527.530 Td /F4 9.0 Tf [(device and monitored it for a long time. The hacker claims that this was made possible by a virus installed on the device )] TJ ET BT 61.016 516.541 Td /F4 9.0 Tf [(when the user visited the adult site. Using this virus, the hacker was able to record a video that compromises the user, and )] TJ ET BT 61.016 505.552 Td /F4 9.0 Tf [(gained access to the user’s personal contacts, instant messengers, and social networks. If the recipient pays $1300 in )] TJ ET BT 61.016 494.563 Td /F4 9.0 Tf [(Bitcoin, the hacker promises to delete all the data. Next, the scam email contains the bitcoin address to which the ransom )] TJ ET BT 61.016 483.574 Td /F4 9.0 Tf [(should be transferred. This email is just a sextortion scam, and all the statements are fake. )] TJ ET BT 61.016 472.585 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 461.596 Td /F4 9.0 Tf [(What to do when you receive the "The device has been successfully hacked" SCAM: )] TJ ET 0.153 0.153 0.153 RG 85.866 444.423 m 85.866 444.835 85.696 445.245 85.404 445.537 c 85.113 445.828 84.703 445.998 84.291 445.998 c 83.878 445.998 83.469 445.828 83.177 445.537 c 82.885 445.245 82.716 444.835 82.716 444.423 c 82.716 444.011 82.885 443.601 83.177 443.309 c 83.469 443.018 83.878 442.848 84.291 442.848 c 84.703 442.848 85.113 443.018 85.404 443.309 c 85.696 443.601 85.866 444.011 85.866 444.423 c f BT 91.016 441.607 Td /F4 9.0 Tf [(Do not panic.)] TJ ET 85.866 433.434 m 85.866 433.846 85.696 434.256 85.404 434.548 c 85.113 434.839 84.703 435.009 84.291 435.009 c 83.878 435.009 83.469 434.839 83.177 434.548 c 82.885 434.256 82.716 433.846 82.716 433.434 c 82.716 433.022 82.885 432.612 83.177 432.320 c 83.469 432.029 83.878 431.859 84.291 431.859 c 84.703 431.859 85.113 432.029 85.404 432.320 c 85.696 432.612 85.866 433.022 85.866 433.434 c f BT 91.016 430.618 Td /F4 9.0 Tf [(Do not pay a ransom.)] TJ ET 85.866 422.445 m 85.866 422.857 85.696 423.267 85.404 423.559 c 85.113 423.850 84.703 424.020 84.291 424.020 c 83.878 424.020 83.469 423.850 83.177 423.559 c 82.885 423.267 82.716 422.857 82.716 422.445 c 82.716 422.033 82.885 421.623 83.177 421.331 c 83.469 421.040 83.878 420.870 84.291 420.870 c 84.703 420.870 85.113 421.040 85.404 421.331 c 85.696 421.623 85.866 422.033 85.866 422.445 c f BT 91.016 419.629 Td /F4 9.0 Tf [(If there’s a link in the scam email, do not click it, otherwise you might unwittingly install malware or ransomware on )] TJ ET BT 91.016 408.640 Td /F4 9.0 Tf [(your computer.)] TJ ET BT 61.016 388.651 Td /F4 9.0 Tf [(The mail will come from several e-mail addresses, which might very from user to user. Scammers use thousands of "throw-)] TJ ET BT 61.016 377.662 Td /F4 9.0 Tf [(away" e-mail addresses to send out these scams.)] TJ ET BT 61.016 366.673 Td /F4 9.0 Tf [( )] TJ ET BT 61.016 355.684 Td /F4 9.0 Tf [(If you do get such an e-mail use one of the two methods below to report it to IT Cyber Security as soon as possible. This )] TJ ET BT 61.016 344.695 Td /F4 9.0 Tf [(way IT can filter and block the senders)] TJ ET 0.592 0.592 0.592 rg 0.592 0.592 0.592 RG 305.016 337.997 m 306.516 337.997 l 305.766 337.247 l 305.766 337.247 l f 1.000 1.000 1.000 rg 1.000 1.000 1.000 RG 305.016 335.747 m 306.516 335.747 l 305.766 336.497 l 305.766 336.497 l f 306.516 337.997 m 306.516 335.747 l 305.766 336.497 l 305.766 337.247 l f 0.592 0.592 0.592 rg 0.592 0.592 0.592 RG 305.016 337.997 m 305.016 335.747 l 305.766 336.497 l 305.766 337.247 l f 0.153 0.153 0.153 rg BT 61.016 317.956 Td /F1 9.0 Tf [(By reporting it on the ICT Partner Portal.??)] TJ ET BT 61.016 297.967 Td /F4 9.0 Tf [(Go to https://servicedesk.sun.ac.za/jira/servicedesk/customer/portal/6/create/115. )] TJ ET BT 61.016 277.978 Td /F4 9.0 Tf [(Fill in your information and add the email as an attachment. Your request will automatically be logged on the system.??)] TJ ET BT 61.016 257.989 Td /F4 9.0 Tf [(If you have accidentally responded to the phisher and already provided them with your personal details, it is vitally )] TJ ET BT 61.016 247.000 Td /F4 9.0 Tf [(important that you immediately go to the USERADM page \(either http://www.sun.ac.za/password or )] TJ ET BT 61.016 236.011 Td /F4 9.0 Tf [(www.sun.ac.za/useradm and change your password immediately.\))] TJ ET BT 61.016 216.022 Td /F4 9.0 Tf [(Make sure the new password is completely different and is a strong password that will not be easily guessed, as well as )] TJ ET BT 61.016 205.033 Td /F4 9.0 Tf [(changing the passwords on your social media and private e-mail accounts, especially if you use the same passwords on )] TJ ET BT 61.016 194.044 Td /F4 9.0 Tf [(these accounts. Contact the IT HelpDesk if you are still unsure.)] TJ ET BT 432.949 174.055 Td /F4 9.0 Tf [([ARTICLE BY DAVID WILES])] TJ ET 0.400 0.400 0.400 rg BT 61.016 155.566 Td /F2 9.0 Tf [(Posted in:E-mail,News,Security | | With 0 comments)] TJ ET endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj xref 0 12 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000305 00000 n 0000000334 00000 n 0000000472 00000 n 0000000535 00000 n 0000007388 00000 n 0000007500 00000 n 0000007615 00000 n 0000007735 00000 n trailer << /Size 12 /Root 1 0 R /Info 5 0 R >> startxref 7843 %%EOF E-mail « Informasietegnologie
Language:
SEARCH

  • Recent Posts

  • Categories

  • Archives

E-mail

« Older Entries
Newer Entries »

New variant of BIP Dharma ransomware found

Monday, June 11th, 2018

WHAT IS RANSOMWARE?

Ransomware, for example, CryptoLocker, WannaCry or BIP Dharma, is a type of malware that installs itself on a device, takes files on the device or network storage, encrypts them, and then extorts money from the user to unlock the files.  This type of programme can be installed by means of an e-mail attachment, an infected programme or unsafe website with malware installed on it. 

The software “kidnaps” your data by encrypting or limiting your access to it and then sending you a message demanding money to regain your access. The only way access is possible again is by acquiring an encryption key from the creator of the ransomware at a fee. However, paying this fee doesn’t guarantee that you will have access to your data again, so doing this is a huge risk.

According to Sophos security ransomware is one of the most widespread and damaging threats that internet users face today. 

HOW TO AVOID BECOMING A RANSOMWARE VICTIM 

You can practice the following security practices to avoid falling victim to ransomware.

1. Make backups

Ensure that you always have the latest backup of your work somewhere else, preferably off-site. If you do fall for a ransomware attack, you will still have your data. Having your data off-site also protects it from events such as a fire, flood or theft or damage to your device. Additionally, you can encrypt your device to ensure that if it ends up in the wrong hands, they won’t be able to access it. 

2. Do not open attachments

If you receive an attachment from someone you don’t know. And even if you do know the person, first confirm whether they did send it to you. Just because it’s from someone you know, it doesn’t mean it’s safe. Your colleague or friend’s account could have been hacked. 

3. Scan attachments

There are tools such as VirusTotal available for scanning attachments to ensure that they are safe to open. VirusTotal is an online scanning tool and can be found at https://www.virustotal.com/#/home/upload.

4. Keep Windows updated

Make sure all Windows updates are installed as soon as they come out. Also make sure you update all programmes, especially Java, Flash, and Adobe Reader. Older programs contain security vulnerabilities that are commonly exploited by malware distributors. Therefore it is important to keep them updated.

5. Security software

Make sure you have some sort of security software installed. If you are unsure whether you have adequate protection on your device, contact us to assess your security.

6. Difficult password

Use hard passwords and never reuse the same password at multiple sites.

 

[SOURCE: www.sophos.com]

 

Email

Posted in E-mail, Security | Comments Off on New variant of BIP Dharma ransomware found

Tripadvisor phishing scam

Monday, June 4th, 2018

It seems that there are a number of you who make some use of TripAdvisor.com for planning your overseas trips. TripAdvisor is travel and restaurant website that provides hotel and restaurant reviews, accommodation bookings etc. but the phishing scammers are currently targeting South African and Australian users with a phishing scam to try to get access to their TripAdvisor account.

Be on the lookout for a phishing scam that *might* target university personnel and student accounts over the next few days:

Hi <your name>,

Want to keep your username?
Since you haven’t been on TripAdvisor in a while, your username <your TripAdvisor username> will expire in two weeks. Want to keep it? Simply click on the button below:

Keep my username

While this might not seem to be much of an issue for some people, the real danger is that, in many cases, university personnel and students – some making use of TripAdvisor,  use the same password for all their Internet accounts. According to a recent Ofcom report, over 55% of Internet users older than 16 used the same password for most – if not all! – the websites they tended to use.

If you do use the same password for lots of sites, and one of those sites are hacked, (like Tripadvisor) and hackers could start using your “leaked password” on multiple sites, they could gain access to more areas of your life such as your email, banking, social media and other accounts.

A very useful site to check if any of your online account have been hacked is https://haveibeenpwned.com/ This site helps you to check if you have an account that has been compromised in a data breach. 

I concede that remembering passwords can be a real challenge, especially if you have a lot of online accounts. I recommend using password management software – also sometimes known as a password vault – like 1Password, KeePass and Lastpass.

Password management software can remember all your hard-to-crack passwords for you (they can even generate them to make sure they’re super complex), and store them securely behind one master password.

Please be very careful out there. Don’t become a statistic or a victim of identity theft!

[Article by David Wiles]

Email

Posted in E-mail, Security | Comments Off on Tripadvisor phishing scam

Phishing mail using intimidation and threats

Friday, June 1st, 2018

There is no need to panic or be in anyway concerned for your personal safety about the latest batch of “phishing” emails that are going out with “death threats” or extortion regarding your “alleged” online activity around pornography sites etc.

A simple Google search using the following term “I Was Paid To Kill You scam” gave me 43 million results, all of the first 100 or so pages reporting this mail as a scam. A further search, narrowing the results down to only South Africa and only from last week, resulted in a little over 100 000 results, all of which were reporting as a hoax.

A similar scam first surfaced in the USA in 2006. An email from a would-be assassin was sent to a number of users from a Russian e-mail address. The “assassin” apparently appointed by a close acquaintance of his target, offers the victim the opportunity to buy him or herself a new lease on life by paying between $50,000 and $150,000.

If you receive mail like this, you should never panic. If you look at the extortion mail there are clues that reveal that the mail is a hoax:

  1. The subject line: “I Was Paid To Kill You”, “YOU SHOULD BE ASHAMED OF YOURSELF”, “YOUR PRIVACY HAS BEEN COMPROMISED”
    These are designed to cause anxiety, stress and panic.
  2. Time limits: “You have 48 Hours to pay…”
    How can the scammer know that you have received the mail and when you have read the mail and keep track of time to see if “48-hours” has passed?
  3. Engagement: “Contact me back via e-mail…”
    Never make contact with the scammers. This immediately alerts them that a “real person” read their mail and they will be able to concentrate their nefarious efforts on you.

If you ever receive emails like these, please report is to the Information Technology Cybersecurity Team using the following method:

Send the spam/phishing mail to help@sun.ac.za and sysadm@sun.ac.za.

Attach the phishing or suspicious mail on to the message if possible.
1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the mail.

[Article by David Wiles]

Email

Tags: ,
Posted in E-mail, Security | Comments Off on Phishing mail using intimidation and threats

Phishing scam disguised as the university’s single-sign on page

Wednesday, May 16th, 2018

Due to the vigilance of an observant personnel member from the US Business School, we have encountered a dangerous phishing scam being sent from a compromised UNISA account.

The Subject is “Dear SUN E-mail User © Copyright 2018 Stellenbosch University” which should immediately raise eyebrows. The phishing email “warns” you about the pending expiration of your e-mail account and prompts you to click on a link to reactivate it.

See below what the mail looks like:

The danger is that the phishing scammers have perfectly forged the university’s SINGLE SIGN-ON page, that is used by students an personnel to access the portal pages, the my.sun.ac.za page, SUNLearn etc., as you can see below. Not many people will notice that the address is not a university address, neither is it secure.

It is imperative that you do not click on the link in the mail, and do not provide the scammers with your username and password as they might be able to access the university’s systems that are accessible through the Single Sign-On page.

Last year scammers were able to forge the e-HR login page through a phishing scam and several staff members had their bank accounts details and other personal details exposed to the scammers.  In the light of the issues that Tygerberg staff have been having with general network access earlier this month, and this week’s issue with e-mail, the arrival of this sort of mail at this time can fool some people into thinking that it is legitimate and lead to compromised network and e-mail accounts.

Here’s how to report any phishing or spam mail:

Send the spam/phishing mail to help@sun.ac.za and sysadm@sun.ac.za.

Attach the phishing or suspicious mail on to the message if possible.
1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the mail.

[Information supplied by David Wiles]

Email

Tags: ,
Posted in E-mail, Security | Comments Off on Phishing scam disguised as the university’s single-sign on page

Clear the clutter

Thursday, April 26th, 2018

In June 2016 we were introduced to Office365, but do we really know how all the functions of this online mail service work?

One such a function is the “Clutter Folder”. 

We have had many students (and some staff) who have reported that “email was missing” or that they were not receiving mail sent to them by mailing lists. While we initially thought that this was caused by users deleting mail or a problem with the email servers, an investigation revealed that in many cases the Clutter folder was the culprit. 

As it was originally designed, the Clutter folder was supposed to help users filter low-priority email, saving time for more important messages. Supposedly, the email server would keep track of the email users read and the ones they didn’t and put them into the Clutter folder. For all new students, as well as staff, the mailbox feature “Clutter” is turned on. Once it is turned on, Clutter is automatic.

Because mail is left unread for a couple of days, Outlook 2016 starts sending a lot of mail to the Clutter Folder, leaving students to complain that mail is not being delivered and “important mail is missing”. All the “missing” mail is still there. It is just in the Clutter Folder.

The best solution is to disable the Clutter folder entirely, so unread mail is not sent there. Here is how to do it:

  1. Sign in to Outlook Web Access (http://www.sun.ac.za/webmail)
  2. In the top right-hand corner, click the small cog icon. A sidebar will appear.
  3. Near the bottom of the sidebar is a heading saying My App Settings.
  4. Click Mail underneath this and you will be taken to the Mail Options page.
  5. On the left menu, underneath the Automatic Processing menu item, click Clutter.
  6. Uncheck the box that says Separate items identified as clutter
  7. Click the Save button at the top of the page.

Once the Clutter filter has been disabled, you can then move all your “missing” mail in the Clutter Folder to your Inbox. 

 

[Information supplied by David Wiles]

 

Email

Posted in E-mail, Tips | Comments Off on Clear the clutter

« Older Entries
Newer Entries »
 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.