Language:
SEARCH
  • Recent Posts

  • Categories

  • Archives

Security

PHISHING: Absa Surecheck Profile App

Monday, October 16th, 2017

Over the weekend and as already reported by a number of Tygerberg colleagues & students, a variant of last week’s ABSA phishing scam has started flooding our email.

The tactics have changed slightly and the criminals are now using a South African domain name to launch their attack. Below is the example of the phishing email, with the forged “ABSA Bank” login page to attempt to convince you to give your bank details willingly to the scammers.

The subject of the email is “Absa Surecheck Profile App – Upgrade | FICA information” which is designed to say absolutely nothing. It is what is known in information technology circles as “techno-babble”

While the methods used to steal a your banking details may differ, the process followed by fraudsters to steal money from their victims in South Africa are nearly always the same:

  1. Get the person’s Internet banking details, typically through a phishing attack. (as shown below)
  2. Get a banking account/s to which money can be transferred to and withdrawn.
  3. Clone the SIM card used by the victim.
  4. Create beneficiaries (using the list of banking accounts) and transfer money to these beneficiaries.
  5. Withdraw the money from these accounts.

Here are the obvious warning signs:

  1. The sender is not an ABSA email account (in this case a “throwaway” German email account used to send millions of phishing e-mails)
  2. Vague and deceptive subject lines (Techno-babble)
  3. An attached file (.htm) that contains a web page that opens up in your browser and links in the background to the server in South Africa.
  4. Impersonal salutation. “Dear Valued Customer”. Banks will never address you like this. They have your money – so it stands to reason that they will know your name as well.
  5. “Online verification” has **** to convince you that the email is genuine, but university addresses end with ac.za, not co.za.

 

The web page that you are directed to is actually the .htm file based on your computer (as an attachment, but links directly to the phishing server in the background.)

In this case is iteron.co.za which is listed as “undergoing maintenance” but is fully functional in the background.

 

 

If you have received an email that looks like this please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing email to the following addresses

help@sun.ac.za

…and sysadm@sun.ac.za as well.

 Attach the phishing or suspicious email on to the message if possible. There is a good tutorial on how to do this at the following link (Which is safe): http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

  1. Start up a new email addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing email from your Inbox into the New Mail Window. It will attach the email as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the email.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

[ARTICLE BY DAVID WILES]

PHISHING: “Confirm your email account”

Wednesday, October 11th, 2017

The latest phishing attempt uses a rather obtuse message about “confirming your email account” to prevent a shutdown of your account. It also used your email address in the salutation, which might fool some people, thinking it is genuine.

Information Technology would never send out an email like this, lacking personal salutations, direct contact via telephone, and threatening to close your account down. 

Here is the phishing e-mail example below with the dangerous parts removed. Do not click on the link or provide any personal information. Luckily the phishing email and the server comes from the Far East, so it should be rather obvious that it is a scam:

This is what the phishing website looks like. 

If you have received mail that looks like this please immediately report it to the Information Technology Security Team by sending an email to help@sun.ac.za.

 Attach the phishing or suspicious mail on to the message if possible. There is a good tutorial on how to do this at the following link (Which is safe) : http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

  1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the mail.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

[ARTICLE BY DAVID WILES]

 

PHISHING: ABSA account statement

Monday, October 9th, 2017

Please be wary of receiving so-called “Bank Account Statements” or alleged payment/transaction notifications that arrive in your mailbox from one of South Africa’s banks. In most cases, they are phishing scams designed to fool you into willingly giving the criminals your bank account details and password/PIN code.

The warning signs are obvious, but the amount of email that we all get every day and the day-to-day stress of the workday, often make us miss the warning signs. 

Below is a typical phishing scam some university accounts received this morning. It could just as well be FNB or Standard Bank, therefore it’s important that you note the warning signs:

  1. Do you have a bank account with the bank? If not why are they sending you an account statement?
  2. Unless you are directly responsible for your department’s finances and your department has a bank account with ABSA or your official university e-mail account is the contact address for your bank correspondence, you shouldn’t be getting emails from any bank.
  3. There is no personal salutation. Banks have your contact details and they will always address you personally, never as “Dear Customer”.
  4. The grammar and spelling are usually poor. This is because the scammers are often from countries where English isn’t the main language.
  5. There is always an attached file or link you should click on or open and type in your details including passwords to “verify” your identity. Email is NOT secure and revealing any details with this medium is very risky.
  6. Branding (e.g. logos and templates) of banks can easily be copied from the bank websites and forged. Just because the bank’s logo is in the e-mail it doesn’t make the mail is official.
  7. The website you are taken to will not be the official address. Often these are compromised websites which have been hacked by criminals and used for identity theft. See the example below. The address in the address bar is clearly not ABSA’s address.

The phishing website looks like this – very similar to the login page of the ABSA website:

[ARTICLE BY DAVID WILES]

 

 

 

PHISHING: “Server Message: Verify your email account”

Wednesday, September 27th, 2017

There is a phishing scam going around disguised as an “e-mail upgrade”. Please do not respond to any e-mail asking you to click on links and provide any sort of personal information, including usernames and passwords.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords on these accounts.)

 

Here is an example of today’s phishing scam as reported by several colleagues and students already. (Links have been removed)


 

From: Mail Administrator [mailto:phishing@e-mail.address]
Sent: Saturday, 23 September 2017 3:37 AM
To: Your University E-Mail Address <somebody@sun.ac.za> <somebody@sun.ac.za>
Subject: Server Message:Verify your somebody@sun.ac.za email account.

 

Dear somebody@sun.ac.za

Access to your account will be temporarily limited for failing automated security server update.

Kindly upgrade your email with the link below to re-verify account ownership or your email account will be deactivated..
 
Click here to verify your details.

Thanks for taking this additional step to secure your account.

Email Administrator

 


[ARTICLE BY DAVID WILES]

 

How to recognise a phishing website

Friday, September 22nd, 2017

Over the past few years, as phishing started to gain a stronger foothold closer to home, we’ve tried to give you tips on how to recognise the typical phishing email. However, recognising the email is just the first step. The actual danger is in the website you reach after you’ve clicked the link. This is where your information is harvested to be used maliciously later. 

Considering Google is the expert on the internet, we’ve consulted their guide to recognising a phishing website. Here’s what they say:

1. What is phishing?

Phishing is a particularly popular scam in which a party creates an official-looking web page that asks you to provide your username and password, or other personal information such as your Social Security number, bank account number, PIN number, credit card number, or mother’s maiden name or birthday. 

In many cases, you’ll receive a link to this phishing page via an email which claims to come from an official-looking (but probably forged) address. You can also end up at these pages by following links that you find on the web or in IM messages.

2. How can I tell if a page is a fake?

The best thing to do is to check the page’s URL to make sure it’s actually controlled by the party it appears to be controlled by. The crucial part of the URL is the part between the HTTP:// and the next slash (‘/’). (If there’s no slash, start at the end of the URL.) This is the part of the URL that determines site ownership. Some popular domains, for instance, are amazon, google, and eBay: 

http://www.amazon.com 
http://www.google.com 
http://www.ebay.com 

In some cases, URLs will be a bit more complex; be sure to check the name listed immediately to the left of the top level domain (.com, .net, .co.uk, etc.). For instance, http://www.google.comhttp://news.google.com and http://www.google.com/firefox/ are all part of the same site. However, google.com.fraudulentdomain.com/login.html is NOT! Neither is www.g00gle.com (note that in this URL, the letter o is replaced by the number 0). 

Tip: Since a forged URL can look very similar to a genuine one, it’s safer to use a bookmark you’ve created or to type the URL into the location bar by hand instead of following links from your email. This is important for any page where you’re asked to log in or provider private information.  Additional Resources: antiphishing.org

3. How does Google know a page is bogus?

We use several techniques to determine whether a page is genuine, including the use of a blacklist containing pages that have been identified as suspicious and/or misleading based on automated detection or user reports. Our software also examines pages’ content and structure in order to catch potentially misleading pages. Google Safe Browsing can’t offer perfect protection, so you should always be on the lookout for indications that a site isn’t what it appears to be. But Google Safe Browsing can help identify and protect you against many of the sites designed to trick users.

4. What does an alert look like?

When we suspect that a page is bogus, an alert will appear on the page. The appearance of the alert will depend on your browser, but they all look like this: 

5. How do I report a page that I think is phishing?

If you find a page that you believe is pretending to be another page in an attempt to steal users’ information, please report it to us.

6. You’re flagging a legitimate page as a potential phishing site. How do I get this fixed?

If you believe that Google Safe Browsing is incorrectly identifying a page as suspicious, please do report it to our team. We work hard to act quickly on all such reports.

7. Does this feature protect me against viruses, spyware, and all other evil things?

Sorry, but no “Google Safe Browsing” protects against phishing and malware attacks, but it can’t offer foolproof protection (although we’re working on it). You still need to watch out for all the other bad things that can happen on the wild, wild web.

 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.