Office of Information Services » Security Alerts

Security Alert! Another Phishing Attempt

Bien Kortmann — Tue, 19 Feb 2013 17:20:07 +0000

The message below is being circulated via the Internet. This is not a legitimate E-Mail message. This is a Phishing attempt. The sender is trying to acquire protected or sensitive information such as usernames, passwords, credit card details and social security numbers by masquerading as a trustworthy entity. Phishing emails may contain links to websites that are infected with malware. Phishing is an example of social engineering techniques used to deceive users and exploits the poor usability of current web security technologies.

Do not respond to these messages or click on any embedded links. Please forward these messages as an Outlook attachment to abuse@purduecal.edu.

Purdue University, other organizations or businesses will never ask you for sensitive or protected information via E-Mail.

If you have any questions or concerns or you feel your computer was contaminated by malware, please E-Mail the Customer Service Center at csc@purduecal.edu or you can call them at extension 2888 option 2.

—–Original Phishing Message—–

From: noreply@purdue.edu [mailto:noreply@purdue.edu]

Sent: Tuesday, February 19, 2013 6:35 AM

Subject: Email Box Security Alert…

Purdue User,

This is to notify you that an unauthorized IP address 845.173.12.1 has been detected by our web admin login into your Email box. You are requested to verify and upgrade your Email account manually for our new online security service by login into your Email account with the below link. You need to verify your Email User name and Password to secure your mailbox.

http://webmailadmin-login.voici.org/

Thank You

purdue.edu Admin

—–End of Message—–

Security Alert: Phishing attempt

Bien Kortmann — Sat, 03 Nov 2012 01:11:42 +0000

The E-Mail below is being circulated. This is not a legitimate request. This is a Phishing attempt falsely claiming to be an established legitimate enterprise in attempt to scam the user into surrendering private and protected information that will be used for identity theft. The E-Mail can direct users to visit a Web site where they are asked to update or enter passwords and or credit card numbers, social security numbers, bank account numbers, that the legitimate organization already has. The Web site is bogus and set up only to steal the users information.

Purdue Calumet, other organizations or businesses will never ask you for your password or other sensitive and protected information via E-Mail. Please be careful when you click.

If you have any questions or concerns please contact the Customer Service Center via E-Mail at csc@purduecal.edu or via phone at extension 2888 option 2.

From: William P McLauchlan [mailto:mclauchl@purdue.edu]
Sent: Friday, November 02, 2012 3:42 PM
To: mclauchl@purdue.edu
Subject: Info.

Dear Email User,

This to inform you that you have almost exceeded your mailbox size in our database. You have used 19.2GB out of your allocated 20.5Gb. You will be unable to send/receive mails as soon as you reach your mailbox limit. Please delete your sent items and empty your deleted items (thrash) to free up some space in your mail box, you are also required to upgrade to our new 25GB Webmail. Click UPGRADE NOW below to automatically upgrade your mailbox.

UPGRADENOW

This will automatically reset/upgrade your mailbox size into the new 25GB faster and better webmail system.

You will be notified as soon as upgrade is completed.

Thanks for your co-operation.

William P. McLauchlan.

Microsoft Exchange Zimbra Server.

***********************************************************************************************

Do not reply to this email, click on the link to automatically upgrade your mailbox.

***********************************************************************************************

Important Security Alert-Java 7 (1.7) Vulnerability

Bien Kortmann — Wed, 19 Sep 2012 20:03:02 +0000

Researchers have found a zero-day Java vulnerability that attackers are using to hijack computers on the web.

The bugs are in Java 7 also known as version 1.7 and affect Windows, Mac OS X and Linux operating systems running a Web browser with a Java plugin enabled.

Researchers are advising computer owners to disable Java in all browsers. That would be the only solution, right now. The flaws allow a remote attacker to execute code via a Java applet launched by a victim clicking on a link on a hacker’s website or on a hijacked site. The applet can run with the same permissions that the user would normally have. It can do anything that you can do with your computer. It can upload documents, install keyloggers and backdoors, basically anything.

Information Services manages the Java version levels for all University owned computers. We are currently running Java Version 6 (1.6) on University owned computers. Please do not update your Java version. Updating your Java version could cause other critical applications on University owned computers to stop working because of compatibility issues. We are checking computers via inventory systems to detect if any University owned computer is running Java version 7 (1.7).

Please take time to check your personal computers at home.

If your University owned computer is running Java Version 7 (1.7) or if you suspect your University owned computer may have a virus, please contact the Customer Service Center ASAP via E-Mail csc@purduecal.edu or you can call them at extension 2888 Option 2.

Security Alert! Opening an infected PDF file

Bien Kortmann — Thu, 14 Jun 2012 12:03:57 +0000

A trusted third party information source has notified Purdue University that we have been explicitly targeted in an active, targeted, persistent spear phishing campaign. The attacker’s attempt to trick users into opening an infected PDF file in order to compromise a system. The attachment may come as one of the following or similar examples:

a) Staff_Changes(purdue).zip, or similar
b) Any_Staff_Changes_About_Purdue_University.exe or similar
c) Leveraging_Ethernet_Card_Vulnerabilities_in_Field_Devices.pdf or similar

If you receive e-mails with or without attachments from unknown sources or you receive information you did not request in the form of an attachment, do not open these attachments or click on any links embedded in the e-mail.

If you receive one of these e-mails or other suspicious E-Mails, please forward them to abuse@purduecal.edu as an Outlook Item attachment.

Purdue University, other organizations or businesses will never ask you for your password and/or sensitive and protected information via e-mail. Please be careful where you click.

If you have any questions or concerns please e-mail the Customer Service Center at csc@purduecal.edu , or you can call them at extension 2888 option 2.

Latest scam circulating around campus

Bien Kortmann — Tue, 05 Jun 2012 12:45:58 +0000

The following scam is being circulated on the Internet. Please do not respond to this message or click on any of the associated links imbedded in the message. If you suspect you have a virus on your computer please contact the Customer Service Center as soon as possible.

You can reach the Customer Service Center by sending them an e-mail at csc@purduecal.edu or you can call them at extension 2888 option 2.

Purdue University, other organizations or businesses will never ask you for passwords, sensitive or protected information via e-mail. Please be careful where you click.

Warning! New phishing site called mypurdue.net

Bien Kortmann — Fri, 11 May 2012 13:42:52 +0000

We received notice today from IT Security on the West Lafayette campus about a phishing site called mypurdue.net. If you receive an email with this site link in it, please do not click on this link.

Please report IT security issues, spam or phishing attempts to abuse@purduecal.edu

Purdue Calumet, other organizations or businesses will never ask you for your password or other sensitive and protected information via E-Mail. Please be careful when you click.

Latest Phishing Email Circulating AroundCampus

Bien Kortmann — Wed, 14 Mar 2012 19:20:03 +0000

There is currently an email circulating around campus with the subject line ′Your e-mail box has reached its maximum of 50MB′

This is not from anyone at Purdue University Calumet and you should delete it. The message is designed to steal your login and password.

For more detailed information on these types of email messages please refer to safe e-mail practices.

Thank you for helping to keep our email safe and secure.

Safe Email Practices

Bien Kortmann — Mon, 12 Mar 2012 18:45:46 +0000

Recently our campus email system has been hit by several phishing attempts that are devised to acquire your login and password. Hackers then use your email address to flood the Internet with millions more email messages that attempt to get the credentials of others. The end result of these emails is to cripple our email servers, and cause Purdue Calumet to get placed on the email blacklists of many of the major email carriers (Google, yahoo, etc.). We would also be blacklisted by other entities that subscribe to these services as well. The result of this is that the legitimate email that you thought you were sending to a colleague or business contact gets rejected and thrown away. The other consequence is the considerable amount of time that Information Services technical staff has to spend tracking these down and repairing the damage caused by these events.

How does this happen?

Phishers tend to rely on the fear factor and try to create a sense of urgency when sending these emails.
In most cases, they communicate the need for immediate action on the part of the user or essential services, such as the use of email, will be cut off. They are betting that by creating that small bit of panic in the back of your mind that you will not look as closely at the email as you normally would and somewhat blindly do what the email tells you.

How can you help?

First of all, Purdue Calumet uses Microsoft Outlook for employee email services. Notification of ′running out of space′ messages is done from within Microsoft Outlook and the clearing of space is performed by each individual user by either archiving or deletion. By the nature of this method, you will never see a message from anyone at Purdue asking for action on your part to prevent your account from being disabled.
Second, Purdue Calumet does not now and never has had any form of WEB-MAIL. The only way to access Purdue Calumet email using the web is to use the Outlook Web Access Client. This is a web based client and not web mail.
Third, be sure to carefully read messages before responding to them. Make sure that any link in an email goes to where it is intended to go and if in doubt, don’t click it. In the last phishing attack, there were no references to purduecal.edu or purdue.edu anywhere in the email yet people responded and willingly gave their credentials.
Fourth, if a link looks legitimate, place your mouse pointer over the link, the link information will appear in a small box. Make sure it matches and goes to where you intend.
Lastly, regardless of the situation, no one at Purdue will ever ask for your password whether it be via email, on the phone, or in person. Anyone that asks for your password should be reported to the Office of the Vice Chancellor for Information Services.

If you have any questions please contact James R. Pardonek, Assistant Director for Information Security and Assurance, at (219)989-2745 or e-mail pardonjr@purduecal.edu.

New Phishing Email Circulating-Subject ATTENTION WEB-MAIL USER

Bien Kortmann — Fri, 09 Mar 2012 15:19:38 +0000

We have received several reports of mail messages that contains the subject line “ATTENTION WEB-MAIL USER”.

This email is being used as an attempt to obtain your login and password credentials for the purpose of using your email address to propagate more of these types of messages to others.

This email is not from anyone at Purdue Calumet and you should not click on any of the links in the message. Purdue Calumet does not use any form for WEB-MAIL.

Purdue University Calumet Information Services will never ask for your password.

Please delete the email.

If you have any questions please contact James R. Pardonek, Assistant Director for Information Security and Assurance, at (219)989-2745 or e-mail pardonjr@purduecal.edu.

New Phishing Email Circulating

Bien Kortmann — Fri, 02 Mar 2012 20:35:21 +0000

We have received several reports of a mail message that appear to be sent by a “Dorothy Hawkins” that contain the subject line “Helpdesk Upgrade”.

This email is being used as an attempt to obtain your login and password credentials for the purpose of using your email address to propagate more of these types of messages to others.

This email is not from anyone at Purdue Calumet and you should not click on any of the links in the message.

Please delete the email.

If you have any questions please contact James R. Pardonek, Assistant Director for Information Security and Assurance, at (219)989-2745 or e-mail pardonjr@purduecal.edu.