Smelling something fishy? It could be the phishing scam that invaded some University Gmail accounts late last week.
On Feb. 19, Computing and Networking Services (C&NS) sent an e-mail to the University community warning about an e-mail phishing scam that circulated among some students.
A phishing e-mail is a message that claims to be from a legitimate source, but its identity is spoofed. These e-mails coerce the user to reply with personal information such as account usernames and passwords.
According to Brian Remigio, the assistant director of Computing and Network Services (C&NS), Student Computing was notified via AOL Instant Messenger of a suspicious e-mail on Feb. 17, requesting personal user account information. This message was seen as an isolated incident.
The next day, another student, whom C&NS would not identify, contacted the C&NS help desk to reset her password. She asked why her inbox had over 300 e-mails and when questioned, stated that she had responded to an email similar to the one reported the previous day. By disclosing her logon credentials, her account was compromised and potentially used to target additional students via the address book, according to Remigio.
C&NS immediately took preventative measures to mitigate the threat. The e-mail, which had originated from a Yahoo account, was reported to Yahoo’s phishing department. C&NS has confirmed that Yahoo had responded and took proper action. In addition, future suspicious e-mails should be detected and blocked by C&NS’ Intrusion Detection System (IDS).
Remigio stated that although C&NS has a number of systems that can quickly deal with these problems, it is not possible to prevent every attack.
Professor of Information Systems Winston Tellis said that he uses “IS 100 to raise students’ awareness of all types of attacks. Thus phishing is just one of many potential vulnerabilities that Internet access creates.”
Tellis advised students to keep AV software updated because “attackers are on the job trying to disrupt our lives.”
When hackers set up a phishing attack, they tend to target numerous sites and locations, independent of the organization’s size. Fairfield was one of many sites targeted. Often times, the messages are hastily written, contain numerous grammatical and spelling errors, and are sent from an e-mail address that can look legitimate at first glance.
Remigio insists that his department is doing everything possible to keep the network secure.
“C&NS’ IT security specialist and the network group are diligently monitoring the network and implementing new changes on a regular basis to better protect us from these attacks,” he said. “The best defense is for the campus community (faculty, staff, students, & guests) to recognize the problems and contact C&NS prior to opening a suspect e-mail or entering login credentials such as your NetID.”
Further information
Leave a Reply