SEARCH
  • [:en]Recent Posts[:af]Onlangse bydraes

  • [:en]Categories[:af]Kategorieë

  • [:en]Archives[:af]Argiewe

phishing

[:en]Phishing remains prevalent[:af]Phishing steeds algemeen[:]

Wednesday, January 13th, 2016

[:en]

Attempts to harvest staff’s personal information in order to gain access to bank accounts, remains a thorny issue.

Unfortunately we can’t warn you against every potentially dangerous e-mail, but we can show you what to look for so you don’t fall prey to one of these scams. Look out for these signs:

1. The e-mail is never addressed to you personally – it’s a generic heading. (e.g. Dear client)
2. It asks the receiver to divulge personal information, for example your ID number, password or username.
3. The e-mail asks you to click on a link to “activate” your account. Don’t click on any links in e-mails (unless it’s an official IT e-mail) and also don’t copy and paste it in your web browser.
4. Usually a short time limit is given, for example “within 24 hours”.
5. Make sure the request is official and legal by calling the company and confirming.
6. Do not send sensitive information by e-mail. Legitimate companies won’t ask you to send data by e-mail.

Above all, the best defence is being attentive and cautious. Report suspect email to sysadm@sun.ac.za and also read our articles on security on our blog, as well as the fortnightly newsletter, Bits & Bytes.

[:af]

Pogings om personeel se persoonlike inligting te oes om toegang tot bankrekeninge te kry, bly `n netelige kwessie.

Ongelukkig kan ons nie personeel waarsku teen elke e-pos bedreiging nie, maar ons kan uitwys waarna om te kyk sodat jy nie `n slagoffer word nie. Let spesifiek op die volgende:

1. Die e-pos is nie persoonlik aan jou gerig nie, dis net `n generiese aanhef. (byvoorbeeld “Dear client”)
2. Dit vra persoonlike inligting, byvoorbeeld jou ID-nommer, wagwoord of gebruikersnaam.
3. Dit versoek dat jy op `n skakel kliek om jou rekening te “aktiveer”. Moenie kliek op skakels in e-posse nie (behalwe amptelike IT e-posse) en moet dit nie kopieer en plak in jou webblaaier nie.
4. Daar is gewoonlik `n kort tydsbeperking gekoppel aan die versoek, byvoorbeeld “binne 24 uur”.
5. Maak seker die versoeke is wettig deur die maatskappy se telefoonnommer te skakel en uit te vind.
6. Moenie sensitiewe informasie met e-pos stuur nie. Wettige maatskappye sal nie vra dat jy data per e-pos aan hulle stuur nie.

Bo en behalwe bogenoemde, is die beste veiligheidsmaatreël oplettendheid en versigtigheid. Meld verdagte e-posse aan by sysadm@sun.ac.za en lees ook artikels oor sekuriteit op ons blog, sowel as die twee-weeklikse nuusbrief, Bits & Bytes.

 

[:]

[:en]Phishing warning: Survey on peer review[:af]Phishing-waarskuwing: Opname oor portuurbeoordeling[:]

Thursday, November 12th, 2015

[:en]

It’s no secret that you can fake just about everything on the Internet, you can fake job references, fake news, fake academic credentials, and fake science.

Academic journals that distribute important research from universities, such a Stellenbosch have had to deal with a proliferation of fake peer reviews. Scams that mask themselves as academic journals which request payment, to accept and publish papers without any form of peer review whatsoever, are common, but now the peer review process itself is being hacked thanks to third-party services that can be paid to fabricate peer reviews for papers. In many cases, identity theft is also involved, with real scientists often never knowing that their identities have been stolen for the purposes of issuing false peer reviews.

Below is a mail sent to one of our own esteemed researchers, who was solicited to complete a survey about the peer review process. Although seemingly innocuous, a quick check on retractionwatch.com reveals that this particular survey has been flagged as a potential source of identity theft, malware and phishing. Dangerous parts of the mail have been removed.

If you are involved in writing and submitting academic papers and reviewing papers, be aware of the minefield of scammers out there who only want to use your good name and reputation, for their own monetary gain and status.

[ARTICLE BY DAVID WILES]


From: Scholarly Research Survey <scholarlyresearch@dummyaddress.com>

Reply-To: Scholarly Research Survey <noreply@dummyaddress.com>
Date: Thursday, 12 November 2015 at 12:05
To: Dr R.E. Searcher <emailaddress@dummyaddress.com>
Subject: Survey on peer review

   

Dear Dr. Searcher,

We are contacting you because you are the corresponding author on a paper that was published in XXXX-XXXX. We would like to invite you to complete a survey, which is about the attitudes of researchers to peer review and scholarly publishing in general. It should take no longer than 8-12 minutes of your time.

This study is being conducted on behalf of a major publisher whose identity will be revealed at the end of the study as we do not wish to bias responses. Your results will be kept confidential and used only for research purposes.

To begin the survey, please click on the link below (or paste it into your browser):

Click here for survey

Thank you very much for your time, we really value your input.

________________________________________________________________________________

If you would like to opt-out of mailings in relation to this research project, please click (here).
Please do not reply to this e-mail as the inbox is not monitored. If you are having trouble with this survey you can let us know (here) and we will address any technical problems as quickly as we can.

[:af]

Dis geen geheim dat feitlik enigiets op die internet nagemaak kan word nie – werksverwysings, nuus, akademiese kwalifikasies en wetenskap.

Akademiese joernale wat belangrike universiteitsnavorsing, soos die waarmee Stellenbosch te doen kry, moet die toename van onegte portuur beoordelings hanteer.Bedrogskemas, wat hulself versteek as akademiese joernale en betaling eis om verhandelinge te aanvaar en publiseer, sonder enige portuur beoordeling, is algemeen. Die portuurbeoordelingsproses self word nou egter gekraak deur middel van derde-party dienste wat betaal kan word op portuur beoordelings vir verhandelings te versin.

Identiteitsdiefstal is in baie gevalle ook betrokke en werklike wetenskaplikes besef nie dat hulle identiteite gesteel is met die doel om vals portuur beoordelings uit te reik nie.

Onder is `n e-pos wat gestuur is aan een van ons voorste navorsers waarin hy/sy lastig geval word met die versoek om `n opname oor die portuur beoordelingsproses te voltooi. Alhoewel dit onskadelik voorkom, het die webwerf retractionwatch.com gewys dat hierdie spesifieke opname aangemeld is as `n moontlike bron van identiteitsdiefstal, malware en phishing. Gevaarlike dele van die e-pos is verwyder.

Indien jy betrokke is by die skryf, indien en beoordeel van verhandelinge, wees bewus van die mynveld van kriminele wat slegs jou goeie naam en reputasie vir hulle eie geldelike voordeel en status wil misbruik. 

[ARTIKEL DEUR DAVID WILES]


From: Scholarly Research Survey <scholarlyresearch@dummyaddress.com>

Reply-To: Scholarly Research Survey <noreply@dummyaddress.com>
Date: Thursday, 12 November 2015 at 12:05
To: Dr R.E. Searcher <emailaddress@dummyaddress.com>
Subject: Survey on peer review

   

Dear Dr. Searcher,

We are contacting you because you are the corresponding author on a paper that was published in XXXX-XXXX. We would like to invite you to complete a survey, which is about the attitudes of researchers to peer review and scholarly publishing in general. It should take no longer than 8-12 minutes of your time.

This study is being conducted on behalf of a major publisher whose identity will be revealed at the end of the study as we do not wish to bias responses. Your results will be kept confidential and used only for research purposes.

To begin the survey, please click on the link below (or paste it into your browser):

Click here for survey

Thank you very much for your time, we really value your input.

________________________________________________________________________________

If you would like to opt-out of mailings in relation to this research project, please click (here).
Please do not reply to this e-mail as the inbox is not monitored. If you are having trouble with this survey you can let us know (here) and we will address any technical problems as quickly as we can.

[:]

Credit card fraud increasingKredietkaartbedrog neem toe

Friday, October 23rd, 2015

It’s Friday afternoon and you are looking forward to an effortless evening of movies and take-aways. You drop in at the closest pizza place on your way home. In your rush to silence your growling stomach, you forgot to draw cash. The closest ATM is 5 kilometres away, but at least you have a credit card.

Paying is no problem and the transaction is safe. You can see the card machine the shop assistant uses and you discreetly type in your PIN number. Besides, card cloning only takes place when someone takes your card out of sight. So they say.

But did you notice that the machine swallowed a little bit more of your card than other times. Usually you can still fit your thumb on the card while you complete the transaction, but now it’s hardly visible.

Coincidence. Actually no. Your card was just skimmed.

Last year R450 million was lost to credit card scams, 23% more than in 2013. The increase was particularly sharp at take-away outlets. But even handheld devices in restaurants can be tampered with. Between 2005 and 2015 1377 compromised devices were confiscated.

Card cloning is just one form of credit card fraud. When you use your card on the internet, whether it’s for banking or online shopping, there’s always some risk involved.

According to Kaspersky Lab, one of the leaders in internet security, 5000 websites are compromised daily. Malware and phishing through e-mails are still one of the biggest problems at Stellenbosch University.

How do you avoid becoming a victim?

Keep an eye on your card at all times.

  • Place your credit card in the machine yourself so you can feel if it goes in easily. With a chip card, you should still be able to comfortably fit your thumb on the card, even when it’s in the machine.
  • Never send your banking details with e-mail.
  • Also never click on a link asking these details – even if it looks like you bank’s branding.
  • Install spam blocking software to eliminate phishing e-mails.
  • Ensure that your antivirus software is up to date and regularly updated.
  • When you purchase online with your credit card, only use official, safe websites. Even then, see if the address starts with “https:”, otherwise it’s not secure.
  • Don’t use public wi-fi for any personal transactions or purchases. (read more here)

[SOURCE: www.mybroadband.co.za]

 

Dis Vrydagmiddag en jy sien uit na `n rustige aand van fliek en wegneemetes. Jy stop gou by die naaste pizzaplek. In die haas om jou grommende maag stil te kry en by jou fliek uit te kom, vergeet jy om geld te trek. Die naaste OTM is 5 km weg, maar gelukkig het jy `n kredietkaart.

Jy betaal moeiteloos en die transaksie is veilig. Jy sien die kredietkaartmasjien waar die winkelassistent jou kaart insit en jy tik diskreet jou PIN -nommer in. Kaartkloning kom tog net voor wanneer `n kredietkaart onder jou oë uitglip, sê hulle.

Maar het jy opgelet dat die masjien jou kaart `n klein bietjie dieper ingesluk het as voorheen? Normaalweg kan jy jou duim op die kaart hou terwyl jy die transaksie voltooi, maar dié keer het dit feitlik heeltemal verdwyn.

Toevallig? Eintlik nie. Jou kaart was sopas in `n “skimming” toestel. 

Verlede jaar het kredietkaartbedrog R450 miljoen in Suid-Afrika beloop, 23% meer as in 2013. Die toename was veral skerp by wegneemwinkels. Selfs handtoestelle in restaurante kan mee gepeuter word. Tussen 2005 en 2014 is daar beslag gelê op 1377 blootgestelde handtoestelle.

Die kloning van kaarte is een metode van kredietkaartbedrog. Wanneer jy jou kredietkaart op die internet gebruik, of dit vir aankope of banksake is, daar is ook `n risiko by betrokke.  

Volgens Kaspersky Lab, een van die leiers in internetsekuriteit, word daar daagliks 5000 webwerwe geaffekteer. Malware en phishing deur middel van e-posse is ook steeds van die grootste sondebokke.

Hoe keer jy dat jy ook in die slaggat trap?

  • Moenie dat jou kaart onder jou oë uit gaan nie. 
  • Sit jou kaart self in die masjien sodat jy kan voel of dit maklik ingly. Wanneer jy jou kaart (met `n skyfie) insit, behoort jy steeds gemaklik jou duim op jou kaart te kan hou. 
  • Moet nooit bank-inligting per e-pos verskaf of aanstuur nie.  
  • Moet ook nooit op `n skakel kliek waar hierdie inligting van jou gevra word nie – selfs al lyk dit asof dit vanaf jou bank kom.
  • Sorg dat jou anti-virus sagteware op datum is en gereeld opdateer word.
  • Installeer sagteware wat gemorspos blokkeer. Dit sal help om phishing e-posse minder te maak.
  • Wanneer jy aanlyn aankope maak met jou kredietkaart, gebruik slegs veilige, bekende webwerwe. Kyk selfs dan dat die adres begin met “https”, anders is dit nie sekuur nie.
  • Moenie publieke wi-fi gebruik vir persoonlike transaksies of aankope nie. (meer daaroor hier

[BRON: www.mybroadband.co.za]

 

 

 

E-mails with a hidden agendaE-posse met `n versteekte agenda

Wednesday, October 14th, 2015

Two e-mails trying to scam staff out of their information, and potentially money, materialised in our mailboxes last week.

The first is a familiar one attempting to get you to reactivate to increase your webmail quota.

The source of the scam is Russia, and  it uses a man-in-the-middle method to send out the mail. This method takes the e-mail credentials from a staff member who has inadvertently given their e-mail details to the scammers. It typically occurs when you respond to a “you have won/inherited X-amount of money in a lucky draw/online survey/death of a unknown relative/government official” e-mail or click on an advert on a compromised website.

The scammers use your e-mail address and, if it is also infected with malware or a virus, your PC, to send an e-mail to all accounts within the same organisation.

The use of a university e-mail as the alleged sender often lulls us into thinking it is legitimate and we respond. We forget that “senders” and most mail details in an e-mail can be forged by these scammers.

The mail below is an example of one such scam. It might be useful to remember that personnel currently have 1Gb of mailbox storage, and students have 50Gb through Office365. The dangerous links have been removed.

The second e-mail targets Pick & Pay clients with an e-mail on Smart Shopper credits. (see example below with active links removed)

Take note of the following:

1. The e-mail is never addressed to you personally – it’s just a generic heading.
2. It asks the receiver to divulge personal information, e.g, Smartshopper number and ID number.
3. The wording is somewhat threatening –  “make sure” and “must”.

With the information sourced by the e-mail, Smartshopper cards can be duplicated. Since your ID number is also joined with your Smartshopper card, not only your credits are at risk, but also the possibility of identity theft.

Never respond to this sort of mail. Information Technology will never send such a mail about your mailbox size and Pick & Pay also won’t communicate with its clients in this way. If in doubt phone the IT Service Desk.

 


From: University, Personnel, Address <faultyaddress@sun.ac.za>

Sent: Wednesday, 14 October 2015 08:24
Subject: 500MB

Dear E-mail User,

Your webmail quota has exceeded the set quota which is 500MB. you are currently running on 1.3GB. To re-activate and increase your webmail quota please verify and update your webmail Account In order to  re-activate and increase your webmail quota click linkhttp://phishing.site.in.russia/   LOGON WITH YOUR LOGIN DETAILS TO COMPLETE UPGRADE.

Failure to do so may result in the cancellation of your webmail account. You may not be able to send or receive new mail until you re-validate your mailbox.

Thanks, and sorry for the inconvenience.

Admin/ Webmaster/ Local host


 

From: Pick N Pay [mailto:faultyaddress@pnp.co.za]

Sent: Tuesday, 20 October 2015 05:42
Subject: Your R700 Pick N Pay (PNP) Shopping Voucher ready for claim

Attention PNP Smart Card Owner,

You have qualified to receive a shopping voucher of R700 to shop for groceries at any “PNP” outlet near you. Make sure you have your SMART SHOPPER CARD with you before you can proceed.

CLICK HERE TO PROCEED

Regards,

PNP

 [INFORMATION SUPPLIED BY DAVID WILES]

Twee e-posse wat hul bes probeer om jou inligting vas te lê, het die week in universiteitsposbusse verskyn.

Die eerste is `n e-pos wat beweer dat jy moet heraktiveer sodat jou webmail spasie vergroot kan word.

Die oorsprong hiervan is Rusland en dit gebruik die “middelman” metode om die e-pos uit te stuur. Die “middelman” metode gebruik die e-pos besonderhede van `n personeellid wat onbewustelik hul e-pos inligting aan kuberkrakers verskaf het. Dit gebeur gewoonlik as `n persoon reageer op `n “jy het X-bedrag gewen/geërf in `n gelukkig trekking/aanlyn opname/afsterwe van `n onbekende familielid/regeringsamptenaar”- e-pos of  gekliek op `n webwerf wat besmet is.

Die kuberkrakers gebruik dan die e-posadres en soms ook die rekenaar, indien dit ook besmet is met `n virus of malware, om e-pos te stuur aan al die e-posadresse binne dieselfde organisasie. 

Die bekende @sun adres maak ons gerus. Ons dink dis veilig en reageer sonder om twee keer te dink daaroor. Ons vergeet dat skelms slim is en feitlik enigiets kan namaak. 

Onder is `n voorbeeld van die e-pos. Die aktiewe skakels is ook verwyder vir jou eie veiligheid.

Onthou dat personeel tans `n 1GB e-pos stoorspasie het en studente 50GB op Office365.

Die tweede teiken Pick & Pay kliënte met `n e-pos oor Smart Shopper-punte. 

Let op die volgende:

1. Die e-pos is nie persoonlik aan jou gerig nie, dis net `n generiese aanhef.
2. Dit vra persoonlike inligting soos jou ID-nommer en Smartshopper nommer.
3. Die bewoording is dreigend – “make sure” and “must”.

Met die inligting wat ingewin word deur die e-pos, kan Smartshopper kaarte gedupliseer word. Aangesien jou ID-nommer ook aan jou Smartshopper-kaart gekoppel is, is die risiko nie net dat jy punte of krediet gaan verloor nie, maar dat dit ook verdere implikasies hê.

Sien ook onder `n voorbeeld waar die skadelike skakels reeds verwyder is.

Moet nooit reageer op hierdie tipe e-posse nie. Informasietegnologie sal nooit so `n e-pos stuur oor jou posbus grootte nie en Pick & Pay sal ook nie so met sy kliënte kommunikeer nie . As jy twyfel, skakel eerder die IT Dienstoonbank.


From: University, Personnel, Address <faultyaddress@sun.ac.za>

Sent: Wednesday, 14 October 2015 08:24
Subject: 500MB

Dear E-mail User,

Your webmail quota has exceeded the set quota which is 500MB. you are currently running on 1.3GB. To re-activate and increase your webmail quota please verify and update your webmail Account In order to  re-activate and increase your webmail quota click link : http://phishing.site.in.russia/   LOGON WITH YOUR LOGIN DETAILS TO COMPLETE UPGRADE.

Failure to do so may result in the cancellation of your webmail account. You may not be able to send or receive new mail until you re-validate your mailbox.

Thanks, and sorry for the inconvenience.

Admin/ Webmaster/ Local host 


 From: Pick N Pay [mailto:faultyaddress@pnp.co.za

Sent: Tuesday, 20 October 2015 05:42
Subject: Your R700 Pick N Pay (PNP) Shopping Voucher ready for claim

Attention PNP Smart Card Owner, 

You have qualified to receive a shopping voucher of R700 to shop for groceries at any “PNP” outlet near you. Make sure you have your SMART SHOPPER CARD with you before you can proceed.

CLICK HERE TO PROCEED

Regards,

PNP

[INLIGTING VERSKAF DEUR DAVID WILES]

Tax season = cyber scamsBelastingseisoen = kubermisdaad

Friday, July 24th, 2015

Only people with an unusual desire for pain and discomfort look forward to a trip to the dentist. The same goes for tax.

Criminals know this and prey on our vulnerability. Every year at this time, e-mails like the one below end up in SU staff inboxes. It informs you that the taxman owes you money and all you have to do to receive it, is to click on a link.

This is a scam, and you should never respond or go to the site or open up the attached file, as this could compromise your banking security.

  1. SARS has your banking details on record and keeps it in secure and encrypted form. They do not need you to confirm or enter your banking details.
  2. SARS will always either SMS or send you a registered letter in the post to inform you of tax returns. They will never contact you by unsecured e-mail.
  3. They also have enough data to address the mail to you PERSONALLY and not via some vague “Dear Taxpayer” or “Good Day” salutation.
  4. There is no EFiling@sars.gov.za address.
  5. The attached file is usually a html (webpage) file and will connect you to a server controlled by the criminals. This server downloads a Trojan virus to your computer that will install software, malware and do all sorts of nasty things to your computer and data. Another tactic is to present you with a “login page” where you enter your banking account details, your PIN code etc.
  6. Unless you have added your university e-mail address as the primary contact address on the SARS system, you should never receive mail on your university account.

This phishing scam will allow the criminals to log into and take control of your bank account via the internet.

They can create themselves as beneficiaries, transfer your money to their account, and then delete the evidence pointing to their account.

These scam e-mails will never stop. It is always difficult to block them too because scammers change their addresses, details and methods on a daily basis. So it is always best to dump these mails in the junk mail folder, blacklist the sending domain and delete the mail immediately.

Why do these criminals continue to send their mail? Because they catch people regularly. In 2012 R14+ million was stolen from South Africans alone using phishing tactics such as this one.

Also read more on this on the mybroadband website.

EXAMPLE OF E-MAIL:

From: SARS eFiling [mailto:eFiling@sars.gov.za]
Sent: Saturday, 27 June 2015 10:14
Subject: Your account has been credited with R3,167.14
efiling

Your account has been credited with R3,167.14

Please click below to accept and verify payment.

Accept Payment

During this process, there will be verifications. If you don’t receive codes on time, come back to finish verification when received

SARS eFiling

[ARTICLE BY DAVID WILES]

Net iemand met `n ongewone voorliefde vir pyn en ongemak sien uit na `n uitstappie na die tandarts. Dieselfde geld vir belasting.

Kuberkriminele buit ons SARS-vrese uit en misbruik belastingseisoen om e-posgebruikers uit te vang.  

Elke jaar rondom Julie maak e-posse (soos die een heel onder) hul opwagting in US-personeel se posbusse. Op die oog af lyk dit soos `n SARS e-pos wat jou in kennis stel dat Jan Taks geld aan jou wil betaal. Om dit te kry, moet jy net op `n skakel te kliek.

Natuurlik is dit `n slenter. Moet nooit hierop reageer, op die skakel kliek, na die webwerf gaan, of die aangehegte dokument oopmaak nie. Jy sal bloot jou bankrekening in gevaar stel. 

  1. SARS het reeds jou bankbesonderhede en dit word veilig gestoor in enkripteerde formaat. Hulle het nie nodig om te vra dat jy dit weer bevestig nie. 
  2. SARS sal jou SMS of `n geregistreerde brief per pos stuur om jou in kennis te stel van belastinguitbetalings. Hulle sal jou nie met onsekure e-pos kontak nie.
  3. SARS het jou inligting en sal jou persoonlik aanspreek –  nie as “Dear Taxpayer” of met `n vae “Good Day” nie.
  4. Daar bestaan nie `n EFiling@sars.gov.za adres nie.
  5. Die aangehegte leêr is gewoonlik `n html (webblad) leêr en sal jou verbind aan `n bediener wat deur kriminele beheer word.  Hierdie bediener laai `n Trojan-virus wat sagteware en malware installeer op jou rekenaar en verskeie onreëlmatighede met jou data wil uitvoer. `n Alternatiewe metode herlei jou na `n aantekenblad waar jy jou bankrekeningdetails, PIN-kode, ens. invul.
  6. Behalwe as jy jou universiteit e-posadres as die hoofkontakadres op die SARS-stelsel ingevul het, sal jy nooit kommunikasie van SARS op jou sun e-pos kry nie.

Bogenoemde phishing-poging sal kuberkrakers toelaat om aan te teken en beheer te kry  oor jou bankrekening via die internet. Hulle kan hulself as begunstigdes byvoeg, geld oorplaas na hul rekeninge en daarna bewyse van die transaksies verwyder.

Dit bly moeilik om hierdie e-posse te blok aangesien adresse, details en metodes op `n daaglikse basis verander word. Die enigste oplossing is om dit dadelik in die gemorspos (junk mail) vouer te gooi, die domein waarvandaan dit gestuur word te swartlys, en die e-pos onmiddellik uit te vee.

Hoekom word hierdie e-posse steeds gestuur? Omdat dit suksesvol is. In 2012 is meer as R14 miljoen rand van Suid-Afrikaners gesteel alleenlik met phishing pogings.

Lees ook meer hieroor op mybroadband se webwerf. 

VOORBEELD VAN E-POS: 

From: SARS eFiling [mailto:eFiling@sars.gov.za]
Sent: Saturday, 27 June 2015 10:14
Subject: Your account has been credited with R3,167.14
efiling

Your account has been credited with R3,167.14

Please click below to accept and verify payment.

Accept Payment

During this process, there will be verifications. If you don’t receive codes on time, come back to finish verification when received

SARS eFiling

[ARTIKEL DEUR DAVID WILES]