Recently DoIT has been notified that an email scammer has been trying to impersonate other UMBC staffers. The email comes from a scammer who is claiming to be someone from UMBC and has the Subject “Quick response.” An example of this phishing email can be seen below.

The email that is shown above is only the first email that the scammer will send to users to try and get their attention. In similar phishing emails, once the user responds  the scammers would claim that they were stuck in a meeting and ask the user if they could go to the store and buy them gift cards. 

Even though this email is short it still shows some red flags of a phishing email. 

• The email itself is not personalized and is very vague. The reason for this is so that the scammer can send the email to as many people as possible.

• There is a sense of urgency. Even with this email being so short, the sense of urgency comes with the subject line of “Quick response” trying to show that they need you to respond as soon as possible.

• The From email address is suspicious. Some scammers will use addresses of the form <johnsmith.umbc@gmail.com>. Without a closer examination some might assume it is coming from a UMBC source while in actuality it is coming from an unknown Google mail address.

• The email signature and name are meant to look legitimate. The scammer will try to base their phishing email on that of the person they are trying to impersonate. This will include an email signature meant to look like an actual UMBC staff member’s and the sender's name being that of the person they are trying to impersonate, often a supervisor. 

You can find other examples of similar scams here https://itsecurity.umbc.edu/critical/?id=94968 and https://itsecurity.umbc.edu/critical/?id=94950 or check out the DoIT Security page main page for more updated information.

If you do receive this or a similar email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

In February 2020, the guitar tuition website TrueFire suffered a data breach. Over 600,000 individuals were affected. Information such as names, emails, addresses, account balances, and passwords were exposed. 

Five UMBC email addresses were victims of this breach. These individuals were notified via their UMBC emails and/or their recovery emails. If you have a Truefire membership, please contact them to see if you were affected by this breach. If you have any questions or concerns email us: security@umbc.edu

Information about this breach was provided to Have I Been Pwned(HIBP) by dehashed.com.

More about Truefire data breach:

https://guitar.com/news/industry-news/truefire-data-breach/https://guitar.com/news/industry-news/truefire-data-breach/

_____________________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Need to set up a recovery email for your UMBC account?

Follow the instructions here: https://my3.my.umbc.edu/groups/itsecurity/posts/94776

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

The DoIT has recently been notified of a malicious actor trying to impersonate a UMBC staffer. This scammer is sending emails with the subject line “QUICK REQUEST” and asking victims if they are available with the goal of getting gift cards from the victim. An example of an email chain is shown below with the name of the From and the email signature removed for privacy reasons.

The scammer targets a department and tries to impersonate some senior person in that department. The scammer will send emails asking the victim if they are “available.” 

If the victim respondes, they will receive a second email asking the victim to purchase gift cards because the scammer is currently in a meeting and can’t do it themselves. Note that the second email has poor grammar and random capitalizations. This email also has a sense of urgency with the scammer claiming to be in a meeting and using words like “important” and the subject “QUICK REQUEST” all in caps.

Note that the sender’s address in both messages is <.umbc@gmail.com>. The full email from the scammer was shortened for privacy reasons. This address allows the victim to see the “umbc” and, without close examination, to assume that the message is coming from a UMBC source when in actuality it is coming from an unknown Google mail address. The email also had an email signature which was based on that of an actual UMBC staff member.

If you do receive this or any other email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

Recently the DoIT has been notified of a malicious actor trying to impersonate a UMBC staffer. The phishing email has the subject line “TASK” and a chain of emails from the scammer can be seen below. The example has had the name and email address of the victim removed for privacy reasons.

First the malicious actor sends an email asking if the user is available to help them. Note that in the first email there is a  sense of urgency as well as a lack of personalization to the recipient. These can be red flags of a phishing email.

In the second email, the scammer asks the user if they could run out to the store and get some gift cards for a meeting that the scammer is currently in. The text continues to foster a sense of urgency using words like “fast” and “quickly”.

In the  last email the scammer asks the user for five one hundred dollar Steam gift cards. Steam gift cards are used on Steam, a video game digital distribution service. The scammer will ask the user to send them a copy of the codes on the back of the gift cards.

If you do receive this or a similar email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

During the pandemic, Microsoft has seen a rise in phishing campaigns. One such campaign uses the Office 365 phishing via malicious OAuth apps. The phishing attack attempts to trick individuals into giving a malicious Office 365 app permission to their legitimate Office 365 account.

Open Authentication(OAuth) is an open standard protocol which allows users to give websites and applications access to their information without the use of a password or username. Popular sites that use OAuth include Google, Twitter etc.

When granting such access, you may see something like this:

Once the malicious Office 365 app is linked to your Office 365 account, the hackers can access your private information and any other sensitive data stored on your Office365 account. This malicious Office 365 app asks for permissions which include but are not limited to:

• Reading your contacts.

• Reading your mail.

• Reading all OneNote notebooks that you can access. 

• Reading and writing to your mailbox settings.

• Having full access to all files you have access to.

Microsoft has taken legal actions against 6 domains that store the malicious Office 365 applications.

However, you can check the apps and services that you have given consent to access your Office 365

information.

To disable these permissions:

1. Visit: https://account.live.com/consent/Manage?uaid=a11edb2059b64ae499fce9f494c2f53f

2. Click Edit

3. Click Remove these permissions

Source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-office-365-phishing-via-malicious-oauth-apps/

https://www.bleepingcomputer.com/news/security/phishing-attack-hijacks-office-365-accounts-using-oauth-apps/

_________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

According to an article by the Cybersecurity and Infrastructure Security Agency (CISA), there has been a recent phishing email campaign trying to deploy malware onto victims' devices. This malware will allow the malicious actor to steal files, capture keystrokes, take screenshots, and execute arbitrary code on infected devices.

This campaign works by sending out emails containing a Microsoft Word document. This document will have an application macro hidden within it to deploy the malware onto the victim's device. This malicious macro code can change font color from light gray to black (to trick victims into enabling content), check whether the Windows operating system is 32 or 64-bit, and construct and execute a command line to download additional files.

Once the malware is installed onto the victim's device, the malicious actor has many different techniques available to exploit the targeted system. Among these are:

• Collect user information from the infected device, for example their IP addresses, username and file data.

• Create shortcuts named Anti virus service.lnk in an attempt to hide as a legitimate file.

• Capture keystrokes.

• Take a snapshot of the current processes state of the user's machine.

• Use PowerShell to download and execute different versions of the malware.

• Execute arbitrary code on the infected device.

• Delete files.

• Gather the operating system version, architecture information, connected drives, hostname, and the computer name. Also has been able to get a snapshot of the current system state of the targets machine.

• Download and execute files on the victim's machine.

• Take screenshots of the victim's machine.

• Steal data from the victim's clipboard.

• Drop a Windows shortcut into the victim's startup folder and/or just onto the machine.

• Steal profile credential information from Firefox, Chrome, and Opera.

For more information on what the malware can do, a link to the article can be found below. The article also lists some tips for victims and administrators to strengthen their security.

• Maintain up-to-date antivirus software.

• Keep your operating system up to date.

• If possible either disable file and printer sharing services. If you have to have this enabled, use strong passwords or Active Directory authentication.

• Do not add victims to the local administrator group unless required.

• Keep and enforce strong passwords.

• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known.

• Make sure you have your firewall up to date and enabled.

• Disable unnecessary services on workstations and servers.

• Scan for and remove suspicious email attachments.

• Exercise caution when using removable media, for example USBs and CDs.

• Scan any file that you download before using it.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please do not download any attachments from a suspicious email as that could put your device at risk. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information on this topic, please check out: 

https://us-cert.cisa.gov/ncas/alerts/aa20-227a

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19