It seems that phishing scammers are again using some student accounts, either by direct access or address “spoofing” (a technique commonly used by spammers to hide the origin of their e-mails by using a forged return address ) to send phishing mail such as the one below to many university accounts.

The phishers attempt to trick the recipients of their mail into thinking that because the mail is from a “sun.ac.za” account, it is genuine.

The mail below is an obvious phishing scam and should not be responded to. Also, don’t click on the enclosed links or provide any usernames, passwords or personal details to the senders.

Looking at the mail below, note the following 5 “warning signs”.

1. No personal salutation – Just “Valued Customer”.
2. Intimidating threats should you not comply – “Failure to Update”.
3. Request to click a link to verify your details or to provide usernames and passwords
4. The link takes you to a webpage that might look legitimate but is not based in the university network. (this phishing scam originated in Sri Lanka)
5. Poor grammar and spelling.

Never be fooled if a mail seems as if it was sent from a university address.

In this case, the e-mail address of an Agricultural Sciences student was used.

Information Technology does have a good automated mechanism for submitting spam. It is quite simple to use, but being automated there will be no indication or acknowledgement that the mail has been received by Information Technology:

1. Start a new mail addressed to sysadm@sun.ac.za
2. Use the Title “SPAM” (without quotes) in the Subject field.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an attachment and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the e-mail.

Do not “Forward” the Spam mail to this address. When you forward the original sender and all the information that the spam filters use to filter out the mail is lost and the Forwarded mail will be rendered useless for the filters.

Here is the mail that is circulating at the moment (malicious links have been removed):

From: Compromised, Student Account <12345678@sun.ac.za>

Sent: 23 February 2017 16:00

Subject: Mandatory Update 

Dear Valued Customer, 

STANDARD BANK MONETARY SERVICES 

We wish to inform you that your Credit Card has been listed for suspension due to recent Error/Traffic on your previous transaction. 

You are MANDATED to re-update your details here: https://dont.click.on.this.link.com 

Failure to Update within 24Hours will Lead to your Banking Services Suspension/Interruption.

We are sorry for any inconveniences this might have caused you.

[ARTICLE BY DAVID WILES]

Be aware that a ransomware attack using fake SA Post Office e-mail has made its appearance recently on the Tygerberg network.

The hacking attack, originating in Russia, uses fake e-mails from the SA Post Office to inform the victim of a parcel intended for delivery. The mail contains a link which downloads malicious software – in this case a nefarious variant of the Cryptolocker malware.

Crypto ransomware is a type of malware used to extort money from victims by preventing access to their computer or files. Recovery of infected systems is virtually impossible without clean backups.

When the victim opens the malicious e-mail attachment, the virus attacks the target PC system, encrypts victim’s files and displays a ransom note, which informs the victim that in order to restore access to their files, a ransom of between $100 and $500 must be paid. Victims have only a certain amount of time to pay a ransom or they will lose access to their files forever.

If you have been backing up your data and have extra copies of your photos, documents, and other files, you won’t need to pay a ransom. Reformatting your drive, and restoring the drive from backup is the only reliable way of undoing the damage.

Cryptolocker ransomware is a nasty infection. Criminals only seek to earn easy money and frequently manage to do so. For victims of this ransomware, I want to emphasise that paying the ransom will not solve the problem. There is no guarantee that your data will be restored. Making the payment will not help to remove Cryptolocker ransomware.

Here is some advice to prevent becoming a ransomware victim:

• Use spam filters and be cautious when opening e-mails, especially if there are attachments.
• Make sure you are using reputable, up-to-date security products.
• Make sure your operating system and applications are up to date and fully patched.
• Run a regular scan of your computer.
• Set and use strong and unique passwords.
• Set passwords on all your hardware devices (modems and routers).
• Back up your data.
• Keep a backup copy of your data in a safe place, disconnected from your computer and the internet.
• Only visit reputable websites and online services.

[ARTICLE BY DAVID WILES]