A phishing attack urging users to download undelivered emails was reported to DoIT Security this week. Here is an example of the malicious message.

From: "umbc.edu System Administrator" <admin@secureserver.net>

Subject: You have 4 undelivered emails. Download them now

Date: 03 Sep 2020 14:40:40 +0800

Undelivered Mail Notification

Email account: (redacted)@umbc.edu

Time of error 9/3/2020 2:40:40 p.m.

Due to a recent configuration error, some of your emails have not been properly synchronized with your mailbox. Login below to clear this error and download your mails.

Download your emails

If you do not retrieve your undelivered emails now, they may be lost forever.

umbc.edu Email Server

The link to “download” undelivered emails leads to a website which prompts users to enter their UMBC credentials, potentially giving malicious actors access to victims’ UMBC accounts.

Notice the warning signs in this email. First, check the sender address, and notice that the supposed "umbc.edu System Administrator" is not using a umbc.edu address. Next, check the time and time zone of the message. The time zone UTC+0800 is used in China and parts of Australia and Russia, for example, but not anywhere that a legitimate email about your UMBC account would likely originate. Finally, be wary of unexpected emails requiring immediate action. Malicious actors try to induce panic to make victims act before thinking about the risks.

See a similar email reported at the University of North Carolina at Chapel Hill:

https://its.unc.edu/phish-alert/you-have-9-pending-emails-download-them-now/

If you do receive this or any other email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

On June 19, 2020 an online antique Marketplace, LiveAuctioneers, suffered a data breach. Approximately 3.4 million records were leaked. The records include names, email and IP addresses, physical addresses, phone numbers and passwords stored as unsalted MD5 hashes.The information was sold online and redistributed to a hacking forum. 

29 UMBC accounts were victims of this breach. The victims are being notified via their UMBC emails and/or their alternate emails. If you have a LiveAuctioneers account, please contact them to see if you have been affected by this breach. To see if you were involved in any other breach visit: https://haveibeenpwned.com/.

More about LiveAuctioneers data breach:

https://www.bleepingcomputer.com/news/security/liveauctioneers-reports-data-breach-after-user-records-sold-online/

https://portswigger.net/daily-swig/liveauctioneers-data-breach-millions-of-cracked-passwords-for-sale-say-researchers

If you have any questions or concerns email us: security@umbc.edu 

Information about this breach was provided to us by Have I Been Pwned(HIBP). 

_____________________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Need to set up a recovery email for your UMBC account?

Follow the instructions here: https://my3.my.umbc.edu/groups/itsecurity/posts/94776

OKLAHOMA SUPERCOMPUTING SYMPOSIUM 2020
    Wed Sep 30 2020, 9:00am-5:00pm Central Time
    Our first all-videoconferencing edition!
    Contact: Henry Neeman (hneeman@ou.edu)
    
    http://symposium2020.oscer.ou.edu/
    
    Please feel free to forward this to anyone who might be
    interested -- undergraduates, graduate students, faculty,
    staff, professionals, colleagues etc.
    
    If you've received this note in error, or you've
    already registered, please ignore it, or forward it to others.
    
    DETAILS:
    
    Are you interested in the FREE Oklahoma Supercomputing
    Symposium 2020 on Wed Sep 30, live via videoconferencing
    all day?
    
    SPEAKERS WILL INCLUDE:
    
    * Amy Friedlander, National Science Foundation
    Office Director (Acting), Office of Advanced Cyberinfrastructure
    
    * John Shalf, Lawrence Berkeley National Laboratory
    Department Head for Computer Science
    
    * Dan Stanzione, Texas Advanced Computing Center, U Texas Austin
    Executive Director
    
    * Tom Lange, Technology Optimization & Management LLC
    
    For the 2020 Symposium, we've already had:
    
    * 50 registrations in under 15 hours;
    
    * 100 registrations in under 19 hours;
    
    * 150 registrations in less than a week;
    
    * 200 registrations in less than a month!
    
    Over the past 18 Symposia, we've had over 4500 attendees from
    127 academic institutions from 28 US states and territories,
    178 private companies, 36 government agencies (federal, state,
    municipal, foreign) and 21 non-governmental organizations.
    
    The 2019 Symposium had 175 attendees, from l7 academic
    institutions in 5 states, 11 private companies,
    8 government agencies and 3 non-governmental organizations.
    
    We'd be delighted to have you participate. It's a great way to
    learn what's happening on the advanced computing side of your
    research, teaching and professional areas.
    
    And, if you know of students -- graduate, undergraduate, community
    college, career tech, high school -- who are interested in these
    areas, this is a great opportunity to introduce them to
    conferences, especially because it's FREE.
    
    Contact:
    
    Henry Neeman (hneeman@ou.edu)
    Director, OU Supercomputing Center for Education & Research (OSCER)
    Associate Professor, Gallogly College of Engineering
    Adjunct Associate Professor, School of Computer Science
    OU Information Technology
    The University of Oklahoma
    

With Covid-19 being something we all face in our daily lives, malicious actors are not giving up on scamming people out of not only their personal and financial information, but are also trying to get their victims’ money or even just installing a malicious software onto their victim’s devices.

The article linked below from Forbes is a good reminder that there are still many types of Covid-19 themed threats from phishing scams to fake websites.

Phishing Scams

Phishing emails are one of the biggest scams out there. As time goes on the scammers get more and more creative with their phishing techniques. With many people worried about Covid-19 and working from home, scammers are posing as loan specialists, health officials, and national authorities. For example, some scammers send emails that appear to be from the World Health Organization (WHO) or the Center for Disease Control and Prevention (CDC).

Here are some tip to look for to try and spot a phishing email:

• Unfamiliar email address

• Generic greetings

• Spelling and grammatical errors

• Sense of urgency or demand for immediate action

• Request for banking or personal information
  
  

At UMBC we see phishing emails with scammers saying that they are from places like Cisco or Corestaff trying to give work from home opportunities to students. We have also seen attempts in which a compromised umbc account will be used to send out phishing emails. For more information on these scams or other tips please check out the DoIT security articles which are linked below.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu. 

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

Bogus Websites

Another common scamming technique is the use of fake websites. Scammers will provide a link to these websites in their phishing emails to make the scam more believable. The scammer tries to make the website look as legitimate as possible. They may do this by using similar domain names such as <www.umbc.net>; instead of <www.umbc.edu>;.

There are ways to try and make sure the website you are visiting is legitimate. Before you click, check the link! If you move your cursor over the link without clicking, the real link address should appear at the bottom of your browser. 

Here are some other tips to help verify that a website is legitimate:

•  Check to see if the website has a secure connection, this can be seen at the top left of the search bar where there is a little lock icon.

• Look for https in the URL instead of http, (the s stands for secure).

• Verify the website's privacy policy if possible.

• Check for contact information on the website, if there is no privacy or contact information that is a big red flag.

• Watch out for signs of malware, meaning suspicious pop-ups and fake-looking ads.

Fake Advertisements

Similar to the creation of fake websites, scammers are creating fake ads. Scammers use fake ads to trick people into providing information for things like Covid-19 loans and stimulus checks. 

Just as with phishing emails, these ads will have a sense of urgency to them. Using terms like “Act now before funds run out.” The important thing to remember here is to not click on ads on unfamiliar websites and pages. Please do not give out personal or financial information online if the person or site that you are giving it to is not secure and trusted.

Phony Phone Calls and Texts

Phishing campaigns are not limited to emails, but can appear in phone calls, text messages, and direct messages (DMs) on social media sites like Facebook and Twitter. If you receive a strange message or voicemail from an unknown sender or caller, do not respond or click on any links.

For text messages and DMs, use the same precautions as with phishing emails. Do not click on links from unsolicited messages, watch out for spelling and grammatical errors, and do not provide any personal or financial information.

For more information on tips to help protect against phishing scams done over text or DMs (also known as “smishing”) please check out this article: https://itsecurity.umbc.edu/critical/?id=94345.

When it comes to phone calls, use caution. Do not give away any personal or financial information over the phone, especially your Social Security number or bank account information. If you feel the call is suspicious, hang up. If the scammers are claiming to be from a company or a bank and you feel the call is suspicious, do not interact try to find the actual customer service number from the company’s website, to confirm if the call was legitimate or not.

For more information, please check out: 

https://www.forbes.com/sites/mikekappel/2020/08/05/cybersecurity-threats-during-covid-19/#68b36c80113c

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

With Covid-19 still very present in our day to day lives, many states have started to roll out contact tracing programs to help control the spread of disease. This is done by informing people who have come in contact with someone who has tested positive and warning them to watch for symptoms. But with anything new that starts, malicious actors are quick to jump on the bandwagon and exploit the chance to try and scam people out of personal and financial information.

These scams work by sending an unsolicited message to you via text, email, or a social media app. These messages will explain that you’ve come in contact with someone who has tested positive for Covid-19.  The message will instruct you to self-isolate and provide a link for more information. The link can contain malware that could cause harm to your device.

Another version of this scam involves a robocall claiming to be part of “contact and tracing efforts.” The call will inform you that you have come in contact with someone who tested positive for Covid-19. After you elect to speak to a representative, the “contact tracer” asks to verify your personal information. This starts with your full name, date of birth, but can quickly move to personal identifiable information and/or financial information.

Here are some tips to help tell if you are talking to a real contact tracer:

• Contact tracers will ask you to confirm your identity, but not financial information. They will ask for you to confirm your name, address and date of birth. They may also ask about your current health, medical history, and recent travels. They will not ask for any government ID numbers or bank account details. 

• Contact tracers will identify themselves. They should start the call with their name and stating that they are calling from the department of health or another official recognized organization.

• Contact tracing is normally done by phone call. Not through social media or texting.

• A real contact tracer will never reveal the identity of the person who tested positive. 

• If you receive a link and are not sure if it is real, double check it. If the contact tracer is claiming to be from the government the URL should end in .gov (for the United States) or .ca (for Canada). 

If you live in Maryland, please visit https://coronavirus.maryland.gov/pages/contact-tracing for more information on Maryland’s contact tracing efforts. According to the link above, the caller ID for a Maryland contact tracer should be marked as “MD COVID”. If you do not have caller ID, the phone number you are looking for is (240) 466-4488.

If you do receive a message that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address or phone number is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information, please check out: 

https://www.bbb.org/article/news-releases/22560-scam-alert-covid-contact-tracing-work-inspires-copycat-scams

To read more articles published by DoIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

The job scam below was recently reported to DoIT. The subject of the email is just “Internship” and has a very short message as can be seen below. The name and email of the from and to fields were removed for privacy reasons.

Please note that the phishing message above is supposedly coming froman umbc email but the reply-to in the emails header is set to <charlenabolinlyco21@gmail.com>. This would mean if the user tried to respond to the email above they would not be responding to the umbc email address, but instead they would be directly emailing the scammers at <charlenabolinlyco21@gmail.com>.

If you do receive this or any other email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19