phishing « Informasietegnologie

phishing

Phishing scam with subject “YOUR EMAIL HAS BEEN COMPROMISED”

Tuesday, June 13th, 2017

On the 17 April this year we sent out a warning to you about a phishing scam warning you “YOUR EMAIL HAS BEEN COMPROMISED” and giving you a link to “Certify your email HERE”

The mail was sent from a student account that has ALREADY really been compromised, by the criminals and they might already be using the account to launch further attacks.

Just because mail seems to come from a university address, doesn’t mean to say that it is legitimate.

The subject line is all in capital letters and is meant to frighten you into clicking on a link and filling in your details. This was probably how the original student account was compromised.

This is a typical phishing scam. Do not respond or click on any of the links. Many thanks to all our observant students and personnel who picked it up and pointed it out to me.

Below is an example of the mail (with the dangerous bits removed)

David Wiles

From: Compromised, Student account <12345678@sun.ac.za>
Sent: 2017/06/13 15:51 (GMT+02:00)
To: fake@email.address
Subject: YOUR EMAIL ACCOUNT HAS BEEN COMPROMISED

Certify Your email HERE

—

[ARTICLE BY DAVID WILES]

Tags: phishing
Posted in E-mail, Security | Comments Off on Phishing scam with subject “YOUR EMAIL HAS BEEN COMPROMISED”

SARS phishing e-mail

Monday, June 12th, 2017

Take note that a phishing e-mail promising a SARS payback is circulating on campus. Below is an example of the e-mail sent from a legitimate looking @sars.gov e-mail address with a web page attached which the receiver should click on and complete.

Please do not click on the html file or enter any personal information. SARS would contact you via SMS if (in the unlikely event) they want to pay you money.

Also look out for the telltale signs of a phishing e-mail below:

Addressed to a generic name – “Dear Taxpayer”. SARS would at least include your full name and tax reference number.
Grammar, spelling or punctuation errors.
SARS won’t ask you to complete any forms. They already have your information.

Dear Taxpayer,

After calculations of last year annual fiscal activities,we realised that you are eligible to receive a Tax refund of R9,250.75. please download the attached Tax refund form REFUNDSARS.html and complete the process of your Tax refund. Note:the refund will take 48hours to reflect in your account.

Thank you,

South Africa Revenue Services (SARS)

Tom Moyane Commissioner

Tags: phishing, sars, SARS e-mail
Posted in E-mail, Security | Comments Off on SARS phishing e-mail

How to avoid ransomware attacks

Friday, June 2nd, 2017

Ransomware is a type of malware designed to encrypt users’ files or lock their operating systems so attackers can demand a ransom payment. According to a 2016 Symantec report, the average ransom demand is almost $700 and “consumers are the most likely victims of ransomware, accounting for 57 percent of all infections between January 2015 and April 2016.”

Similar to a phishing attack, ransomware executes when a user is lured to click on an infected link or e-mail attachment or to download a file or software drive while visiting a rogue website. Sophisticated social engineering techniques are used to entice users to take the desired action; examples include

an embedded malicious link in an e-mail offers a cheap airfare ticket (see figure 1);
an e-mail that appears to be from Google Chrome or Facebook invites recipients to click on an image to update their web browser (see figure 2); or
a well-crafted website mimics a legitimate website and prompts users to download a file or install an update that locks their PC or laptop.

Figure 1. Phishing e-mail with ransomware embedded in a link

Figure 2. A fake Google Chrome e-mail

To avoid becoming a victim of ransomware, users can follow these tips:

Delete any suspicious e-mail. Messages from unverified sources or from known sources that offer deals that sound too good to be true are most likely malicious (see figure 3). If in doubt, contact the alleged source by phone or by using a known, public e-mail address to verify the message’s authenticity.
Avoid clicking on unverified e-mail links or attachments. Suspicious links might carry ransomware (such as the CryptoLocker Trojan).
Use e-mail filtering options whenever possible. E-mail or spam filtering can stop a malicious message from reaching your inbox.
Install and maintain up-to-date antivirus software. Keeping your operating system updated with the latest virus definitions will ensure that your security software can detect the latest malware variations.
Update all devices, software, and plug-ins on a regular basis. Check for an operating system, software, and plug-in updates often — or, if possible, set up automatic updates — to minimise the likelihood of someone holding your computer or files for ransom.
Back up your files. Backup the files on your computer, laptop, or mobile devices frequently so you don’t have to pay the ransom to access locked files.

**Figure 3. An example ransomware e-mail message**

Tags: CryptoLocker, phishing, ransomware
Posted in E-mail, Security | Comments Off on How to avoid ransomware attacks

Dangerous phishing scam disguised as a University salary increase notice

Thursday, May 18th, 2017

With the criminals first partly successful spear-phishing attack in April with an email about a salary raise and directing their victims to go to a forged webpage that looks EXACTLY like the e-HR website, they are at it again with a few variations:

The subject is now “URGENT: Your May Salary Issue” and says the following:

Hello,

In accordance with the Fiscal Year 2017 Salary Allocation Guidelines, this is to inform you that your monthly salary starting May 31st, 2017 will reflect a 13.98% (percent) merit increase.

Your new salary is as analyzed herewith. The documents are attached below: (attached link to the forged website)

This is an EXTREMELY dangerous e-mail, because its earlier version fooled a number of university personnel into giving the scammers their login details and passwords.

Clicking on the link will take you to a forged version of the SUN e-HR site. If you enter your username and password (because the site looks like the SUN e-HR site), the criminals will have been given access to your personal details on SUN e-HR.

Here is what the forged site looks like:

Note the forged address marked in yellow at the top. IT blacklisted and blocked access to that site from within the university, but please support them by following the procedures on the following page: http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

[ARTICLE BY DAVID WILES]

Tags: phishing
Posted in E-mail, Security | Comments Off on Dangerous phishing scam disguised as a University salary increase notice

Compromised student account used for phishing

Tuesday, April 18th, 2017

Just because mail seems to come from a university address, doesn’t mean to say that it is legitimate.

The latest phishing scam making its rounds at the university is being sent from a compromised student account. The subject line is all in capital letters and is meant to frighten you into clicking on a link and filling in your details. This is probably how the student account that is now sending it was originally compromised.

This is a typical phishing scam. Do not respond or click on any of the links. Many thanks to all the observant students who picked it up and pointed it out to us.

Below is an example of the mail (with the dangerous bits removed)

From: Compromised, Student account <12345678@sun.ac.za>
Sent: Monday, 17 April 2017 12:19 PM
To: fake@email.address
Subject: YOUR EMAIL ACCOUNT HAS BEEN COMPROMISED

Certify Your email HERE

[ARTICLE BY DAVID WILES]

Tags: phishing, security, spam
Posted in Security | Comments Off on Compromised student account used for phishing

IT links

SU Links

Recent Posts

Categories

Archives

phishing

Phishing scam with subject “YOUR EMAIL HAS BEEN COMPROMISED”

SARS phishing e-mail

How to avoid ransomware attacks

Dangerous phishing scam disguised as a University salary increase notice

Compromised student account used for phishing