%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> /XObject << /I1 24 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text /ImageC ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250717134812+00'00') /ModDate (D:20250717134812+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Annots [ 12 0 R 14 0 R 16 0 R 18 0 R 20 0 R 22 0 R ] /Contents 7 0 R >> endobj 7 0 obj << /Length 4042 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 291.236 521.469 455.498 re f 0.773 0.773 0.773 RG 0.75 w 0 J [ ] 0 d 45.641 291.611 520.719 454.748 re S 0.773 0.773 0.773 rg 61.016 306.986 m 550.984 306.986 l 550.984 307.736 l 61.016 307.736 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(REMEMBER TO CHECK YOUR JUNK EMAIL FOLDER)] TJ ET 0.400 0.400 0.400 rg BT 61.016 664.909 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 664.909 Td /F3 9.0 Tf [(January 01,1970)] TJ ET BT 173.588 664.909 Td /F2 9.0 Tf [( by )] TJ ET BT 188.096 664.909 Td /F3 9.0 Tf [(IT Communications)] TJ ET 0.153 0.153 0.153 rg BT 61.016 637.420 Td /F4 9.0 Tf [(To ensure that staff and students )] TJ ET BT 195.098 637.420 Td /F1 9.0 Tf [(aren't)] TJ ET BT 219.245 637.420 Td /F4 9.0 Tf [( exposed to malicious )] TJ ET BT 61.016 626.431 Td /F4 9.0 Tf [(phishing or spam emails our system administrators and security )] TJ ET BT 61.016 615.442 Td /F4 9.0 Tf [(team)] TJ ET 0.373 0.169 0.255 rg BT 81.023 615.442 Td /F4 9.0 Tf [( had to enable a stricter spam filter earlier this year as added )] TJ ET 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 81.023 614.291 m 325.130 614.291 l S BT 61.016 604.453 Td /F4 9.0 Tf [(protection.)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 603.302 m 103.037 603.302 l S 0.153 0.153 0.153 rg BT 61.016 584.464 Td /F4 9.0 Tf [(A spam filter assigns every message, received and sent, a spam )] TJ ET BT 61.016 573.475 Td /F4 9.0 Tf [(confidence level based on the likelihood that the message is )] TJ ET BT 61.016 562.486 Td /F4 9.0 Tf [(spam. Depending on its level an inbound message may be )] TJ ET BT 61.016 551.497 Td /F4 9.0 Tf [(relayed directly to the user's Junk Email folder. The filter looks at )] TJ ET BT 61.016 540.508 Td /F4 9.0 Tf [(certain criteria contained in the email it rates, for example too )] TJ ET BT 61.016 529.519 Td /F4 9.0 Tf [(many hyperlinks or a suspicious file attached. Tweaking the filter )] TJ ET BT 61.016 518.530 Td /F4 9.0 Tf [(can be tricky we don't want you to miss important emails, but at )] TJ ET BT 61.016 507.541 Td /F4 9.0 Tf [(the same time it's our responsibility to protect you and all our staff )] TJ ET BT 61.016 496.552 Td /F4 9.0 Tf [(from harmful attacks.)] TJ ET BT 61.016 476.563 Td /F4 9.0 Tf [(For this reason, it's important that you regularly look in your Junk )] TJ ET BT 61.016 465.574 Td /F4 9.0 Tf [(Email folder in case the spam filter might have relayed it there.)] TJ ET BT 61.016 445.585 Td /F4 9.0 Tf [(The main purpose of Microsoft Outlook's Junk Email Filter helps )] TJ ET BT 61.016 434.596 Td /F4 9.0 Tf [(is to reduce unwanted email messages in your Inbox. Junk email, )] TJ ET BT 61.016 423.607 Td /F4 9.0 Tf [(also known as spam, is moved by the filter away to the Junk )] TJ ET BT 61.016 412.618 Td /F4 9.0 Tf [(Email folder. This is done at an institutional level by Microsoft \(as )] TJ ET BT 61.016 401.629 Td /F4 9.0 Tf [(mentioned above\), but you can also flag or "un"flag messages from a person or company as Junk email.)] TJ ET 0.373 0.169 0.255 rg BT 61.016 381.640 Td /F4 9.0 Tf [(How to change your spam filter's preferences.)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 380.489 m 243.806 380.489 l S BT 61.016 370.651 Td /F4 9.0 Tf [(How to tag an email as junk mail.)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 369.500 m 193.064 369.500 l S BT 61.016 359.662 Td /F4 9.0 Tf [(How to report spam or junk email to Microsoft.)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 358.511 m 244.571 358.511 l S 0.153 0.153 0.153 rg BT 244.571 359.662 Td /F4 9.0 Tf [( \(downloadable PDF-document\))] TJ ET BT 61.016 339.673 Td /F4 9.0 Tf [(If you have any questions, please log a request on the )] TJ ET 0.373 0.169 0.255 rg BT 279.149 339.673 Td /F4 9.0 Tf [(ICT Partner Portal.)] TJ ET 0.18 w 0 J [ ] 0 d 279.149 338.522 m 354.173 338.522 l S 0.400 0.400 0.400 rg BT 61.016 321.184 Td /F2 9.0 Tf [(Posted in:E-mail,Notices,Tips | | With 0 comments)] TJ ET q 225.000 0 0 225.000 325.984 421.211 cm /I1 Do Q endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 12 0 obj << /Type /Annot /Subtype /Link /A 13 0 R /Border [0 0 0] /H /I /Rect [ 81.0227 614.6092 325.1297 623.7667 ] >> endobj 13 0 obj << /Type /Action /S /URI /URI (https://blogs.sun.ac.za/it/en/2020/03/additional-microsoft-security-for-email-activated/) >> endobj 14 0 obj << /Type /Annot /Subtype /Link /A 15 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 603.6202 103.0367 612.7777 ] >> endobj 15 0 obj << /Type /Action /S /URI /URI (https://blogs.sun.ac.za/it/en/2020/03/additional-microsoft-security-for-email-activated/) >> endobj 16 0 obj << /Type /Annot /Subtype /Link /A 17 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 380.8072 243.8057 389.9647 ] >> endobj 17 0 obj << /Type /Action /S /URI /URI (https://support.office.com/en-us/article/changing-the-level-of-protection-e89c12d8-9d61-4320-8c57-d982c8d52f6b) >> endobj 18 0 obj << /Type /Annot /Subtype /Link /A 19 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 369.8182 193.0637 378.9757 ] >> endobj 19 0 obj << /Type /Action /S /URI /URI (https://support.office.com/en-us/article/Video-Block-unwanted-mail-a3cda7e7-03ab-4188-9a9c-0f05e6a41e75) >> endobj 20 0 obj << /Type /Annot /Subtype /Link /A 21 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 358.8292 244.5707 367.9867 ] >> endobj 21 0 obj << /Type /Action /S /URI /URI (http://admin.sun.ac.za/Infoteg/dokumente/Report_junkmail.pdf) >> endobj 22 0 obj << /Type /Annot /Subtype /Link /A 23 0 R /Border [0 0 0] /H /I /Rect [ 279.1487 338.8402 354.1727 347.9977 ] >> endobj 23 0 obj << /Type /Action /S /URI /URI (http://servicedesk.sun.ac.za) >> endobj 24 0 obj << /Type /XObject /Subtype /Image /Width 300 /Height 300 /ColorSpace /DeviceRGB /Filter /DCTDecode /BitsPerComponent 8 /Length 7855>> stream JFIF,,ExifMM*C    !'"#%%%),($+!$%$C   $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$,,"D !1A"Qaq2#5BRs6Sbr$&34Cc%t&!12AQ"qBRa ?R uh֏YdQ-n_m;.n=ܜ޾nSܠJ|wo>>\s""" """ """ """ """ """ """ ""lm.{Z7O8]4 k}_ϑ\󹐎]^|w;˓a;Xأ52Tc'wWUW i]^\ӇX;RmI$dv|A.0N,?hQUhnP&p98v.wSPm  0= e.վB Â`m)H[n]-7iBhh׌HAa""  }(mq={Ldw3Eh|22@-;;i_$m :[rg{=DYnr=z>>pb-SI%GuGzH+t)sv䪵Mq뺥|6@1 y^V;VQ\&tC2n޸#D#cgymZ.ofN\Ρ舢 7kUU+jOՖg85j-SHc8j^kE5C.Cp+׏ {xg'KFm*"#LָM#z|wp˭OS0!`$eVg<8`,)bX#کlOwtUH99/}ڗHh'MYz8LNw}ӗVԉCd/0v6+< 17 z*[ ܲtjM-TSs(+TGmF2؞`>^2v5kzK`{OY!\;LѷzlV&|{r״z"" """ """ """ "" 4 wS$AU ɤ2j}ўQ2=U霰{|6oY%N+89s$`8{ F|=+oNmNY*qN$˩.R~0)|k"cV>{Wu:_+UGUoa|' 2'ѹq.=5TOԒHl=jG[y:YQT6hGrmx>ʋ9iV<';_*gtދ?@K5猁汤XB湱C\Cs[xgn]1ßʴ/!Y \=; #o[ZUNJ3?=dעQFO #WMpvGaM*K6pd#q,VЏP>17.GxYp .,o<2+>Sn3\$X]SbU>J`bqf|qZ[P6#亂nϸ%c;41rFZ?==ߧf9VΘaT;cje!ɤJR^kM=:ݹMSqQ8pk9]XsNViI;f>7-xAue\ !ܶՂwseD@DDD@DDD@DDD@DD' VJm_.]|c/uY[\VҵQ 2(enq )M9;עq a SاsbWBbwt`.e%+g'g8' mU;?u)㥘:6y`YE|쬵2UO3'i9AgM/4 ښڗ"zK/ uqϓWӝhU$ c8ȎoSBa׶)$O q-WbS6\e彎P~BYmx7v]J 3[]AR%,;Р)Y4m9,A|oX'Y*˷߬|ۇ8sVeik+aXYUKG,w|zIvwQm穾x_XYn|H e7]acw? h=mM/8 nc yFFFOOj*_OSjM2ZN;mC$isCe}$drV3Gu;>+o_BRr@^GS8y(o|3SA΀Okn"+EEepa-c#أE$,hVwn\ї=0twS!&*inc' Ĩ+U. K 8d|qy1ӻ9f 26}MB7d/CjX੊ccËO5{XZᐩ@Whsw;{+\*3A ¬lP+P=m}{WYūg d$,H[2}{&'{Z0ҷ]XnT4Յ敷A+= ({iKVxUiBAxޭT10 G&gf?pߊFhGZ;VZOw5 ̢%20pwhzJttYVyܝ]=m#\;8fslVy2ϭ50tUc:9YcprF-+ LYJdF7 j2tR\঑DE|nY6x*|G* QǗ[k,w'淐!TF"AX_ڿZ҃Nbg?ڷi^iAn:F!U` 1GeoҚQ?S#끓Ug%U7Bxv+/i*ne|s7R@DDD@DDEoFlj]1_|G.kjϪ\wngrbG.gN+{{M-qi*x^al{{ji[4҃VҶiM(5M+'ap0ѡTfѼ+5*ژIJ=n8$0gX^B0Z*'޴E%E_"GwI%["4$-P+49ӿpxNț6+3] ˧ '\)i?F<_#˱k`ع96 DGj|۴ Ճ{`V]y:c-k7q }e h- )8p] gE}$qSkm*c-SCd\זU5[jKG";8ߐ\aS=f!JTf 8\+鄄apQ@DDD@QFIQFY/q;cۧ^A(=2hRjCopH^jMH0>_HZgw͟/۩_u4ӳ=*eO?H1zm録&wg|BũlmOkUt]H mO\*=I#WXaKn"zr[eªԲUkKDEpIy^9rwÆu8gJVC<xqw%j\;i(1<9mSč< 滷nf%U&|'I Oh_eKxwZA_p).T ,+tNTiH۫dtSAt_8$;qV]XpwqU 6Fzi{0>Čjh*cT:Va) Jm:6wY%r,<+~m=ƲeE۪Inv|aUj&Tgfc\={Z2I]rMJebL"퉄dxjSP|=hqX)(D`d-`1 6i {\BHZkMW; {Or6ݟ{-x\I|t4=LL`!7-ݽbv,I38Ij6vj*Y4o.S2Zqi]<텾:1miݻyNВ"T,SNl-o(Q4d5r(~(m6֌9,PDDD@^ajrZsObܮn dQK++ƌq5Ti*{i5 ))"xx-s{W^Ol ੗UAr tgO wLrO,Y^ 0V(gVշ3vpW^zG?9A׫;T#dݞ* > startxref 14748 %%EOF Tips « Informasietegnologie
Language:
SEARCH

  • Recent Posts

  • Categories

  • Archives

Tips

« Older Entries
Newer Entries »

Cybersecurity Awareness Month: Social Engineering – The weakest link

Thursday, October 25th, 2018

When we use the term “hacker” in our day-to-day conversation, we tend to associate it with an attacker who uses their technical expertise to break into protected computer systems and compromise sensitive data. We hear about this breed of hacker in the news and we invest millions of rands in new technologies to improve our network defences.

However, there is another type of attacker who use their tactics to bypass even the most expensive and effective cybersecurity technology. They use a variety of media, including phone calls and social media, and trick people into offering them access to sensitive information. These are the social engineers, hackers who exploit the one weakness found in every institution, also universities: human psychology. 

Social engineering is a term that covers a broad spectrum of malicious activity. It is a means of attack that leans on human interaction and involves manipulating people. All the methods listed in our previous article use social engineering.

The object of a social engineer is to convince people to bypass or suppress their natural reserve or suspicion in order to get access to technology systems or data. For example, someone who calls the secretary of a department pretending to be from the IT Department asking questions and getting them to reveal sensitive information such as login names, e-mail addresses, WiFi passwords, etc. They are in essence con-artists.

Whether it is through a phone call or an email, social engineering attacks are always very effective because they rely on the weakest link of security – human beings.

The best historical record of social engineering is the story of the Trojan War from Homer’s Illiad. After a ten-year siege on the Trojans, the Greeks pretended to accept their defeat. They left behind an enormous wooden horse as an offer of peace, and the Trojans opened their city gates to bring in the horse as a victory trophy. However, the Greeks soldiers were hiding inside the wooden horse, crept out at night, opened the city gates and allowed the Greek army to enter and destroy the city of Troy.

How to protect yourself:

  • First and foremost, be suspicious of anyone who contacts you via email or telephone and appears to know a lot about you. They may be very friendly and attempt to gain your trust, but if you’ve never dealt with this person before, ask yourself how they know so much about you and why they are contacting you.
  • If you are contacted by telephone, don’t blindly provide information. If you’re suspicious (that little voice in the back of your mind that says “something is not right here”), hang up.
  • Offer to call the person back. Ask them for a direct phone number. If they can’t provide one, discontinue the call.
  • If they do provide a number, do some research. Can you find a website for the company? Do a Google search on the phone number – does it come back linked to the company name you were given?

As a matter of habit, never give personal or sensitive information, for example, your login name, ID number, password and bank account number, over the phone or email. If the person is persistent, explain that you are concerned about security and will not provide this information over the phone. If they don’t accept your explanation, they should not be trusted.

Not only are your inboxes and phone lines being targeted, but so are your social media sites. Take a long, hard look at your social media presence. How much do you reveal about yourself to the world? Do you provide information about your position with a company? Do you share your habits – where you shop, gym or like to eat or socialize? Even the most mundane information you share could make you a target for a social engineering attack. Any social engineer will do their homework on you ahead of time. Whether it’s selfies or cat videos, most us like to tweet, tag, link, comment, like, and post online. Platforms like Facebook and Instagram are full of information social engineers can use.  

How many personal details are displayed on your department or Facebook page? Some departmental web pages even display personal cell phone numbers.

Over the past week, there has also been an increase in extortion phishing. Extortion phishing is the practice of obtaining money through force or threats via email. The victim receives an email suggesting they have been recorded through their webcam whilst watching adult websites. The criminals demand a ransom in Bitcoin or some untraceable cryptocurrency and threaten to circulate the recording to their contacts unless payment is made. Often scammers state that they know your password, installed malware on the computer and demand payment.

The new extortion phish threat plays on our own innate sense of guilt. More worrying, however, is that the passwords they have are often correct or close to correct because they have been leaked through data breaches. Usually, these passwords are old and haven’t been used for months or years. In some cases, they’ve remained unchanged or have only changed by a single letter or number. For example, how many times would I have to guess the correct password if the old password is “christopher” and the new password is “Christopher123”.

Your password and email address are potentially out there for all to see. One way to check if your username and password have been leaked in a data breach is to use a site like Firefox Monitor. You can enter in your e-mail address and the site will tell you if your information, e.g. email address and password have been compromised.

Social engineering attacks range from unsophisticated attacks, for example simply lying to get information, to very elaborate attacks, for example specifically designed websites. They have one thing in common – exploiting the weakest link, human beings. 

For this reason, these attacks will continue to increase, so being aware and cautious is the best defence.

Next time we will focus a little more on the type of attacks the university has suffered over the past year or so, and how to spot them.

Keep safe out there;

Email

Tags:
Posted in phishing, Security, Tips | Comments Off on Cybersecurity Awareness Month: Social Engineering – The weakest link

Cybersecurity Awareness Month: Identity Thieves Modus Operandi – Part 2

Friday, October 19th, 2018

In our previous article, we mentioned that identity theft isn’t always “high-tech”. It can happen to anyone, even if they don’t have a computer, use social media or own a cell phone. However, in this article, we’ll focus on “high-tech” methods of identity theft.

The identity thief’s goal is to obtain your personal information, such as your ID Number, bank or credit card account numbers, credit report information or the existence and size of your savings and investment portfolios. Once they have any of these, they can contact your financial institution pretending to be you or someone with authorized access to your account. The thief may, for example, claim that they have forgotten their chequebook and needs information about their account.

Credit or debit card theft – Many people believe credit card fraud and identity theft are the same. In reality, they are different crimes. The main difference between credit card fraud and identity theft is that credit card fraud typically involves a single credit account, but if your identity is stolen, the potential for damaging your credit history can be much greater, because someone can open numerous lines of credit in your name. Credit card fraud typically occurs when someone steals your credit card information and uses it to make unauthorized purchases. This can be done by stealing your purse or wallet or, if the criminal works at a retail store or in a restaurant, he or she may simply copy your credit card information during a transaction.

Pretexting – If you receive a phone call from someone from a reputable research firm asking you to participate in a survey, asking seemingly harmless questions like the name of your cell phone provider, bank, or even your preferred shopping centre, this is probably a pretexting scam. Pretexting is the practice of getting your personal information, such as telephone records, bank or credit card numbers, or any other information, under false pretences. A pretexter pretends they are someone else to obtain your personal information claiming they are from a survey firm and want to they ask you a few questions. Sometimes they will claim to be representatives from other types of organizations – not just survey firms –  but banks, SARS, insurance companies and ISPs.

Skimming – Identity thieves place small machines or skimmers, in the card slots of ATMs to steal credit and debit card numbers and pin codes from unsuspecting victims. This has also been reported to occur at some petrol stations where you can pay at the pump. It is not easy to look at a card reader and see that it has been altered in some way before you insert your debit or credit card, as some of the skimmers are so advanced that they are virtually undetectable. In some cases, a skimmer may remain in place for months at a time, unnoticed by employees of the “host” store and it could take months before victims realize that an identity thief has stolen their card number and PIN. Most victims only find out after the thief starts making illegitimate purchases or withdrawals from their accounts, often to the tune of thousands of rands.

Man-in-the-middle attacks – Smartphones and tablets have become a major point of access to the internet. There are many Wi-Fi networks that people can connect to from almost anywhere, for example, public libraries, airports, shopping malls and government or municipal facilities. Unfortunately, this also opens a “port of entry” for hackers which has led to the increase of “Man-In-The-Middle” attacks. A Man-In-The-Middle attack, also known under the acronym MITM, happens when a communication between two parties is intercepted by an outside entity. The perpetrator either eavesdrops on the communication or impersonates one of the two parties, making it appear as a regular exchange of data. A MITM attack targets users of enterprise email accounts, financial applications, and e-commerce websites in order to steal account details, credentials, bank account or credit card numbers and to monitor password changes.

Phishing – The Internet scam known as “phishing” (the “ph” substitution distinguishes the activity from the real “fishing” but the activity is intrinsically the same) is a spam email message that contains a link to what appears to be from a legitimate business, such as your bank, but it is actually a fake website. The email often states that you must update your account information through a bogus link to a phisher’s website and the user, unknowingly, gives out personal information to the fake website.

Pharming – A relatively new Internet scam is “pharming”. Using a virus or malware, the victim’s Internet browser is hijacked without their knowledge. If the address of a legitimate website is typed into the address bar of a browser the virus redirects the victim’s browser to a fake site.  All identifying information, such as bank passwords and credit card numbers, is collected by the scammers who steal the user’s identity.

Vishing – This is similar to “phishing”. However “vishing” scams attempt to trick targets into divulging personal information such as credit card, bank account and social security numbers using new telephone technology. Typically, “vishing” targets will receive a phone call from what appears to be a legitimate business, such as their bank or credit card issuer, and the victim is informed that their account has been compromised. The “visher” usually requests that the caller enter their account or credit card number or even their social security number to secure their account, thereby compromising the victim’s identity.

SMiShing (SMS phishing) – This form of “phishing” specifically targets smartphones. Smishing uses the scammers’ old favorite—phishing, to send out an email to entice their intended victims to click a link that downloads malicious software or virus on the smartphone. As its name implies, smishing comes from “SMS phishing”. A smishing attack goes after the smartphone via text message and usually occurs when a message is received from an unknown number that offers some sort of incentive. It might be telling you about a free offer, a coupon, that there’s something wrong with your account, or even more likely, it might claim that “your friend” has sent you a “greeting card” or message. Unlike viruses of the “old days” that sought to lock up your computer or disable your files, smishing attacks remain hidden and continue to feed information back to the smisher. Information like contacts list, email address books, and passwords are sent to the scammers.

Spear-phishing – Our last method is spear phishing. With this method, the scammer is targeting you specifically instead of just sending out random “shot in the dark” emails that someone might fall for. Spear-phishing is very successful, especially within environments like the university, because scammers pay attention to your internet activity and send you requests that look like the real thing, claiming to be from entities within your own environment. Scammers can pull off spear phishing attempts based on the information you share about yourself, as well as other bad habits such as using the same password for multiple websites. As soon as you post updates to social media, especially about accounts, people you interact with, purchases you’ve made, etc. you’re handing over vital information a scammer can use to target you.

How to protect yourself from identity theft:

  • Don’t give out your personal information on the phone, email or snail mail unless you’ve initiated the contact or unless you are sure it’s safe. And don’t feel guilty about saying No.
  • Never use your pet’s name, children’s name or a nickname as a password.
  • Ask your financial companies about their policies for preventing identity theft.
  • Be VERY careful about answering surveys — and certainly don’t give out any personal information to anyone who calls on the phone or asks via email. If you do answer survey questions, use common sense and don’t give out any information that could be sold or used by identity thieves. In other words “control” the information that you give out.
  • Tell your colleagues, family and friends about the dangers of identity theft. Awareness and sensitisation empower even the most “non-technical” person.

In the next article, we will be providing a bit of information about social engineering. Keep safe out there.

Email

Posted in phishing, Security, Tips | Comments Off on Cybersecurity Awareness Month: Identity Thieves Modus Operandi – Part 2

Cybersecurity Awareness Month: Identity thieves’ modus operandi – Part 1

Friday, October 12th, 2018

Identity Theft takes place whenever a criminal gets hold of a piece of your information and uses that information for their own personal gain.

While a lost or stolen wallet, purse or cell phone may simply mean the loss of your cash and credit cards, it may also be the beginning of an identity theft case. The return of the item does not guarantee cards were not copied or that your personal information was not used to commit identity theft.

In the previous article we pointed out 5 low-tech areas in your world where identity theft could take place.

  • Old-fashioned letters (including junk-mail)
  • The trash can
  • Flash disks
  • Your driver’s license or ID Document
  • Household paperwork.

Identity theft isn’t always “high-tech”. It can happen to anyone, even if they don’t have a computer or cell phone or don’t use social media.

Dumpster diving – literally digging through your trash – remains a popular method for stealing large amounts of your personal information. South Africans receive over 1.2 million tons of junk mail every year and much of this mail, such as pre-approved credit cards, credit card bills, and bank statements, includes your personal information. Dumpster-diving identity thieves root through your trash because they know the documents you discard as garbage contain personal identity information they can use in a variety of illegal manners, such as employment-related, loan, bank, benefits and tax fraud.

Mail theft – Mail theft is the number 1 white collar crime in the USA today. Mail theft is defined as anyone taking mail, be it a letter or a package, for any purpose. This includes stealing from post office workers, private mailboxes, collection boxes and even from mail trucks. One of the main motivators in mail theft is to steal a person’s identity and gain access to private information, including bank accounts and credit cards.

Social engineering – Social engineering is the art of manipulating people to give up confidential information. The types of information these criminals are seeking can vary, but when individuals are targeted, the criminals are usually trying to trick you into giving them your passwords or bank information. Criminals use social engineering tactics because it is usually easier to exploit your natural inclination to trust than it is to find ways to hack your software. For example, it is much easier to fool someone into giving you their password than it is for you to try hacking their password. That is why phishing is so successful, often victims willingly give their personal information to the scammers, as they feel they can trust the person asking for the information.

Shoulder surfing – Shoulder surfing occurs when someone watches over your shoulder as you key it into a device such as an ATM or tablet, to steal valuable information, such as your password, ATM PIN, or credit card number. When the shoulder surfer uses your information for his financial gain, it becomes identity theft.

Theft of personal items – When a personal item like a handbag, a wallet or purse, a cell phone, or a laptop is stolen, all the information can potentially be used for identity theft. The value of the stolen items is often not much, and replacement is an inconvenience to many of us. However, your personal information can never be recovered, and is intrinsically more valuable than the stolen item.

What can you do to minimize “low-tech” identity theft?

  • Never give out personal or financial information over the phone or in an email.
  • Password-protect your cell phone.
  • Shred credit card receipts, junk mail and other such documents with sensitive personal or financial information.
  • Be aware of your surroundings at all time.
  • Tilt the screen of your cell phone screen away from the person next to you and don’t work in crowded airplanes, trains, airports, cafes, hotel lobbies and other public spaces.
  • Work with your back to a wall, preventing others from standing behind you and looking over your shoulder.

Next time we will look at the modus operandi of high-tech identity thieves.

 

Email

Posted in Security, Tips | Comments Off on Cybersecurity Awareness Month: Identity thieves’ modus operandi – Part 1

Cybersecurity Awareness Month: Where do scammers get your information?

Friday, October 12th, 2018

In the last article, we provided you with a few tips on how to create strong passwords in order to make the hacker’s job harder at accessing your personal data. Using weak passwords is one way hackers and scammers get your information?”.

But where do scammers get your information?

The graphic below depicts the world where most of us find ourselves, and where scammers might obtain important snippets of our personal data that, in many cases, is there for the taking:

This is your world

Your personal information is in places beyond your control.

The cell phone has become an indispensable communications tool in the 21st century. According to the Pew Research Centre, South Africa is placed 24th on the world list with a smartphone usage of 37% of the total population. However, according to a recent global survey by McAfee and One Poll, 36% of those smartphone users have no form or password, pin or fingerprint protection on their devices. This means that if their phone falls into the wrong hands, they risk opening up all sorts of personal information such as bank details and online logins to whoever finds or steals the smartphone.

How much of your personal information have you placed out there on the internet?

  • Over 30% of South African Internet users share at least 3 pieces of personal information posted on their social media profiles that can make stealing their identity easy.
  • 60% of South African Internet users have revealed they had no idea what their privacy settings are and who could see their personal information on those sites.

Old-style junk mail, invoices, receipts and ordinary letters can still provide scammers with a wealth of information. Dumpster-diving can reveal documents with your ID Number, old bank statements with your account details, old credit cards, unwanted junk e-mail, payslips and tax forms. Even old prescriptions & medical aid claims can provide scammer with a wealth of information from your personal information.

The modern equivalent of a filing cabinet, a flash disk poses a huge risk to the security of your personal data. Flash disks are small and cheap and can often be forgotten plugged into computers, fall out of pockets and be stolen, providing scammers with all the data stored on that device.

Your bank, your employers and SARS all store and work with your personal information. You have placed a tremendous amount of trust in these organizations to keep your personal data safe. How many people at your bank, for instance, have access to your personal data, who can they potentially give that data to?

Your driver’s license has a lot of information on it, including fingerprints, date of birth and ID number. The new style “smart” licenses will hold even more information, and if the license gets into the wrong hands it can be used for identity theft. For instance, in order to open up a cell phone contract, you would need an ID document or driver’s license, bank account details and proof of address, almost all of which can be obtained by dumpster-diving or someone rifling through your paperwork.

Finally, your computer (at work or at home) or your laptop holds a huge amount of your personal information. If stolen, the hard-drives can easily be trawled for personal information. If there is no password or a weak password on the laptop it makes stealing this information much easier.

This is your world:

  • Since 2007, more money has been made from trafficking financial data acquired by identity theft, than money made from drug trafficking.
  • 8.8 million South Africans were victims of identity theft in 2015.
  • 1 in 3 South Africans do not have a password on their cellphones or computer.
  • 70% of South Africans change their passwords after being compromised. (So 30% of South Africans don’t do anything even after they have been compromised)
  • 1 in 3 South Africans admits sharing passwords with other people.

There are 4 areas where we all neglect the security of our personal information:

  1. Indifference – Lack of Feeling
  2. Ignorance – Lack of Knowledge
  3. Inability – Lack of Training or Education
  4. Inaction – Lack of Respect

What can you do to improve your personal data security and to prevent identity theft?

When someone comes and knocks on your front door, do you just open the door and let them in? No, you check who it is and then you decide if you want to open your door to them or not. The power of access is in your hands because you control the door.

The same principle applies to your personal data. Be careful and vigilant and be the gatekeeper of your personal data! Control what data is given out and who receives it. You have the control!

Next time we will look at the modus operandi of identity thieves. 

 

Email

Tags: ,
Posted in phishing, Security, Tips | Comments Off on Cybersecurity Awareness Month: Where do scammers get your information?

New IT online request service

Thursday, October 4th, 2018

Information Technology recently implemented a new, user-friendly request and incident logging system for staff and students. Our aim was to deploy the system in such a way that you weren’t affected and the process of logging calls remained simple. The only difference is our new, clean and user-friendly look. We would like to encourage you to make use of the online logging system, also known as the ICT Partner Portal, to ensure faster service. 

Log in on our ICT Partner Portal at servicedesk.sun.ac.za.

The ICT Portal is the central point where you can easily log your IT-related issues without calling the IT Service Desk. Here you will also be able to keep track of the progress of your requests online.

As soon as you request a service or log an incident or error, the system automatically assigns a call number. The call number will appear in future email correspondence and updates related to your call. This will ensure that calls are grouped together and the information is easier accessible and better integrated. 

Even though the platform interface looks different, you will be able to perform the same actions as before. Staff and students are automatically registered as users – you only need to log on at servicedesk.sun.ac.za with your SU username and password.

This is what the new interface looks like:

Alternatively, if you prefer not to use the online logging service, you can send an email to help@sun.ac.za. This will automatically log your request on our system. Keep in mind that if you use this method, it will take slightly longer to attend to your call as a helpdesk agent has to classify it first.

If you’ve recently requested a service by sending an email you might have noticed that the confirmation email looks slightly different. Your email will include a reference number, for example, ICT-123, your name and links to view your request. By clicking on the link, you will be diverted to the ICT portal where you can view the status of your request and leave a comment for the technician working on your request.

This is what the new email from IT will look like when you request a service:

For any additional enquiries, please contact the IT Service Desk at 021 808 4367.

Email

Tags: , , ,
Posted in General, Tips | Comments Off on New IT online request service

« Older Entries
Newer Entries »
 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.