The Federal Trade Commission warns of a phishing email scam aimed at college students. The malicious actor sends emails out claiming to be from the Financial Department of the student’s university. The email tells readers to click on the provided URL to get messages about their economic stimulus check. Once readers click on the URL it will require a university login to proceed.

These emails are phishing scams and once the URL is clicked on, the reader is either giving the malicious actors their personal information or even allowing malware to be installed onto their devices.

To help spot and avoid scams similar to the one above:

• If you have concerns about an email, look up a phone number or website of the sender/department that the email is claiming to be from. This helps to confirm you are calling someone who is real and not a malicious actor.  If there is no contact information, it very likely is a scam.

• Look out for bad grammar and spelling as this can be a tip-off that the email might be from a malicious actor. 

• Look out for wrong department names. For example the article found that one version of this phishing email claimed to be from the Financial Dept instead of the Financial Aid Department.  

• If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu and delete the message.
  
  

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

UMBC’s Office of Financial Aid and Scholarship:

https://financialaid.umbc.edu/

For more information, please check out:

https://www.consumer.ftc.gov/blog/2020/05/covid-19-scams-targeting-college-students

The Federal Trade Commission warns of a phishing email scam aimed at college students. The malicious actor sends emails out claiming to be from the Financial Department of the student’s university. The email tells readers to click on the provided URL to get messages about their economic stimulus check. Once readers click on the URL it will require a university login to proceed.

These emails are phishing scams and once the URL is clicked on, the reader is either giving the malicious actors their personal information or even allowing malware to be installed onto their devices.

To help spot and avoid scams similar to the one above:

• If you have concerns about an email, look up a phone number or website of the sender/department that the email is claiming to be from. This helps to confirm you are calling someone who is real and not a malicious actor.  If there is no contact information, it very likely is a scam.

• Look out for bad grammar and spelling as this can be a tip-off that the email might be from a malicious actor. 

• Look out for wrong department names. For example the article found that one version of this phishing email claimed to be from the Financial Dept instead of the Financial Aid Department.  

• If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu and delete the message.
  
  

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

UMBC’s Office of Financial Aid and Scholarship:

https://financialaid.umbc.edu/

For more information, please check out:

https://www.consumer.ftc.gov/blog/2020/05/covid-19-scams-targeting-college-students

As the global health crisis continues, many organizations are making the decision to continue remote work into the summer, and some are even hiring new employees remotely. Malicious actors are also still working and are capitalizing on uncertainty and preoccupation with other challenges. One of their most common goals is to obtain private information, such as passwords, personally identifiable information like social security numbers, or internal business decisions, all of which can be sold on the dark web or used in future scams targeting both individuals and organizations.  Whether you are already teleworking or simply want to be prepared for any opportunities that may arise, familiarize yourself with these simple tips to keep you, your devices, and your organization safe in the virtual workspace.

•  Read and follow your organization’s policies on telecommunications and telework. Know what you are and are not allowed to access from your personal devices.

•  Secure your Internet connection. Use a unique password for your home Wi-Fi and avoid accessing private information over public connections.

•  Lock your devices. Use a unique password, facial recognition, etc. to ensure that others cannot access private information through your phone or computer.

•  Keep your devices up to date. Update regularly or enable automatic updates to get the latest security patches as quickly as possible.

•  Use any additional security tools your organization provides. For example, UMBC offers access to the GlobalProtect VPN for secure remote connection to the campus network, and Duo Two-Factor Authentication to help prevent unauthorized logins to your UMBC account.

UMBC DoIT Security continues to receive reports of malicious emails claiming to offer part time job opportunities to UMBC students. 

From: Charlotte Oliver <charlotteoli26900@gmail.com>

Date: Sat, May 30, 2020 at 10:55

Subject: UMBC STUDENT PART TIME JOB OPPORTUNITY

Dear Student,

 

We got your contact through your school database and I'm happy to inform you that our reputable company Cisco Systems Inc® is currently running a student empowerment program. This program is to help devoted and hardworking students secure a part time job which does not deter them from doing any other, you just need a few hours to do this weekly and with an attractive weekly wages.

 

KINDLY EMAIL BACK WITH YOUR  (RESUME) PERSONAL EMAIL ADDRESS AND PHONE NUMBER IF INTERESTED IN THIS JOB POSITION.

 

Best Regards,

 

Charlotte Oliver

HR Manager/Consultant

Cisco Systems Inc®

DO NOT REPLY TO THIS PHISHING EMAIL!

This phishing campaign is designed to collect students’ personal information. A reply confirms that your account is active and could lead to more spam. Additionally, if you provide your alternate email address and phone number as requested, you could be vulnerable to phone and text message scams in addition to being pressured by the fake employers for more personal information.

This job scam is similar to a COVID-19 themed variant reported in early May. While the message and subject of the emails have changed, the basic premise has not. See the original post at https://itsecurity.umbc.edu/critical/?id=92997.

During the  COVID-19, unemployment numbers have been rising and more people are looking for work. Some people have unknowingly gotten involved in breaking the law. According to the article from Idaho News 6 linked below, police found thousands of dollars worth of stolen merchandise in a garage belonging to a homeowner who thought he was renting space to people  working on a reshipping job.

The article warns that malicious actors post legitimate looking “work from home” help wanted or job openings on places like social media, message boards and even job posting sites. These ads will claim the work will be easy, pays big, and can be done from home. The malicious actor uses stolen credit cards to purchase goods and has the victim reship the items. In fact, the malicious actor is using the victim as part of a money laundering operation.

The article encourages readers to stay safe while job searching, to make sure that the employer has a readily available phone number for human resources, and has a company website. Scammers on the other hand usually will communicate through email or messenger only and are very secretive about the work, their business, and what the employee will be doing. The article also warns against paying upfront fees since malicious actors will often ask for fees for background checks or other pre-employment checks.

For more information, please check out:

https://www.kivitv.com/news/bbb-watch-for-work-from-home-scams

May 22, 2020

Next Week, Maryland will begin a state-wide effort to trace the spread of COVID-19.  The effort will involve health workers making phone calls to Maryland residents.  This is a very important step in identifying potential disease clusters and everyone’s help is needed.

At the same time, Maryland in general and UMBC in particular have been targets of a wide variety of scams taking advantage of people’s fears and uncertainties around this disease.  It is very possible that unscrupulous people will take advantage of Maryland’s effort as a cover for phone scams.  North Carolina, for instance, started a contact tracing effort last month and has gotten reports of scammers pretending to be health officials and gathering information from residents.

Phone Calls

When you get a call, your caller ID should read “MD COVID”.  You will be asked about your health and about your location and interactions within a period of time.  You will be asked for your birth date, contact information, and information about any COVID-19 test if you have had one.  You will get guidance about potential symptoms to watch for and about self-isolation.

You will NOT be asked for:

• ·        a Social Security number

• ·        financial or bank account information

• ·        personal details unrelated to COVID-19

• ·        photographs or videos

• ·        passwords

• ·        payment

If anyone asks you for this or other information having nothing to do with COVID-19, please do not give it to them. 

Text Messaging

So far, Maryland has not announced that text messaging will be part of the contact tracing effort.  If you receive a text message that asks you to click on a link for contact tracing, do not click it. At best, it will take you to a scam questionnaire requesting your personal information.  Worse, it could download malware to your phone and start harvesting personal information itself.

New Jersey has received reports of text messages pretending to be from contact tracers and telling people that they have already had contact with a potential COVID-19 carrier.  These messages also contain links which will lead to information theft and/or malware.  Contact tracers don’t work like this.

For More Information

Launch of Maryland’s contact tracing effort

• https://www.baltimoresun.com/coronavirus/bs-md-maryland-contact-tracing-operation-coronavirus-reopening-20200521-jn4wfqgjcjdqbkbu454fhqngim-story.html

• https://www.wbaltv.com/article/maryland-contact-tracing-ramps-up/32631045#

FTC Warning about COVID-19 contact tracing text message scams

• https://www.consumer.ftc.gov/blog/2020/05/covid-19-contact-tracing-text-message-scams
  

Scam Warning from North Carolina Attorney General

• https://ncdoj.gov/watch-out-for-covid-19-contact-tracing-scams/

Warning from New Jersey state officials about text message scams

• https://www.nj.com/coronavirus/2020/05/beware-of-coronavirus-contact-tracing-scams-nj-officials-warn-thousands-of-fraud-cases-reported.html

As part of our ongoing commitment to security, the Unix Infrastructure group will be conducting its quarterly system patching on Saturday, May 23rd and Thursday, May 28th.  While many of the systems will be patched without any service disruption, there are some systems which require the downtime of key services.  The schedule below outlines which key services will be offline and for how long.

Saturday, 05/23/2020 between 9am and 11am(most systems will only be down for a short period during this time):

• myUMBC lite page will be up resulting in reduced myUMBC functionality
• Wiki will be unavailable
• The sites (wordpress) web hosting environment will be unreachable

Thursday, 05/28/2020 between 4pm and 10pm (most systems will only be down for a short period during this time): 

• Between 4pm and 5:30pm only: LDAP-Master and Webadmin will be taken down for system maintenance.  During this time account creations and password changes will be unavailable.  Account authentication and logins will not be affected.
• Access to Cyrus and UMBC Webmail (accounts not migrated to UMBC Gmail)
• All mail will be queued up and delivered after the server is patched
• All HFS (user) servers will be offline
• Between 9:15pm and 10pm only: Certain software licenses will be unavailable (autodesk, cadence, idl, schrodinger, xilinx, mathematica). 
• Between 9:15pm and 10pm only: The web hosting environments (virthost) will be partially unavailable (pages will be available but any database calls will not work)

Please let us know if you have any concerns or questions.

Thanks!

Tim Champ

Manager of Unix Infrastructure

UMBC DoIT