March News from Information Security

Whew! We made it to March!

While there won’t be some of the typical shenanigans we are used to experiencing in March, like Spring Break (sorry, I had to mention it), there are plenty of things to be aware of. This newsletter may run a little longer than most, as we are “enjoying” the result of a confluence of tax season, potential economic stimulus payments, Zoom meetings, COVID vaccines, plus all the regular stuff. As Maverick from Top Gun would say, this is a “target-rich environment”, except not for potential dates, but for phishing emails.

Continue readingMarch News from Information Security”

November News from Information Security

We did it! We made it through October and Cybersecurity Awareness Month. I want to thank everyone who read the weekly articles, checked out the posters, and participated in the Virtual Scavenger Hunt. I want to congratulate Hanna Popa for her successful completion of the hunt and her luck in winning the Monster Clarity 102 AirLinks ear buds. She was one of the eight who completed the entire hunt out of the thirty-three who attempted some part of it.

If you enjoyed the hunt, or you missed it, but heard great things about it and wished that you had participated AND would like us to hold another one, just email infosec@berry.edu and tell us. While you’re at it let us know what information security topics you would like to see addressed here in articles or quick tips or even live (via Zoom for now) training sessions.

Speaking of live training, here in November there will be another opportunity to attend (via Zoom) live one-hour-ish lunchtime training on account management, covering everything from picking good passwords to using password managers, to enabling multi-factor authentication on all your accounts, particularly your Berry account. The event will be posted to the Event Calendar this week, once a final decision is made on the exact date, so check it out and sign up.

Our primary topic for this month is multi-factor authentication or MFA. MFA is now required for all Berry accounts and the Office of Information Technology (OIT) is rolling it out in phases. You will receive, if you haven’t already, an email detailing when MFA will be enabled on your account and how to set it up. The Network Operations group is holding training on MFA setup via Zoom, so if you have issues with the setup, be sure to attend. Details should be in the email you receive.

Why are we requiring MFA? You could potentially blame it on the corona-virus or COVID-19, but our attempts to require MFA have been in the works for many months before the virus hit our community. MFA places another layer of security on your Berry account, preventing someone who guesses or steals your password from accessing your account. It does this by requiring a second piece of evidence or a second “factor” in addition to your password to prove that you are you. That factor could be a fingerprint, or a temporary six-digit code texted to you or found in an app on your smartphone. In our case, the default second factor is just an approval via an app on your smartphone.

With MFA enabled, when you log in to your account, you will be required to enter your password, then a notification will pop up on your phone asking you to “approve” or “deny” the login request. You just touch “approve” if you are attempting to log in, or “deny” if you see a request when you haven’t tried to log in to your account. Without this second factor, the approval, or if you deny the login attempt, the login fails and the incident is logged so OIT can follow up and mitigate any potential threat to your account. This protects not just your email, but any web-based service you use here at Berry, from VikingWeb to the financial aid portal to the health center portal, so it is vital MFA is enabled on your account.

We’ve mentioned Zoom twice already in this newsletter, and we’re going to circle back to it now. One of the most critical aspects of using Zoom effectively is securing your Zoom sessions from “zoombombers” and others that wish to disrupt sessions. We depend on Zoom far too much these days, so we want to offer some information about how to properly secure your Zoom sessions.

Here is a Zoom document that discusses most of the security settings for Zoom. Don’t be daunted by the fact it is twelve pages long, there are pictures and cover pages and large type galore. Here are the high points, in a simple list:

      • Use the waiting room feature if your meeting is not too large. This lets you control who actually gets into the meeting, albeit manually.
      • Use a passcode for all meetings and use randomly generated meeting IDs, NOT your personal meeting ID.
      • Only allow registered users to attend. Be careful with this setting, but it is useful if done correctly.
      • Lock your meeting. Once everyone who is supposed to attend has arrived, you can lock the meeting to prevent anyone else from joining.
      • Know how to manage users during the meeting. Understand the settings to control screen sharing, mute everyone, remove participants, and configure chat and annotation to prevent abuse.

Our current environment can prove difficult to navigate at times, but making sure you know how to manage a Zoom session will go a long way to make sessions requiring Zoom effective and secure.

One last thing before we wrap up. I want to encourage you to report ALL phishing emails you receive, using the “Report Email as Phishing” button available in the email browser interface (https://mail.berry.edu), on mobile devices using the official Outlook mobile client, and on the desktop using Outlook 2016 (Click-to-run version only) or Outlook 2019 (all versions). Doing so will help OIT protect the community by mitigating dangerous phishing emails identified by you, our first line of defense against phishing.

I normally wrap up the newsletters with a pitch for you to sign up for MFA, and I still encourage you to do so, but if you don’t, understand you will be required to use MFA at some point in the next few weeks. If you’d like to get ahead of the curve, request MFA for your account by emailing computing@berry.edu.
If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me.

Photo Credit: Photo by Plann on Unsplash

CAM Week 3 – Phishing and Healthcare Devices

Welcome to week 3 of Cybersecurity Awareness Month!

I hope you are all advancing in the Virtual Scavenger Hunt (VSH), but if not, there are some clues later in the article to help you along. If you haven’t yet started, you still can, giving you a chance to win the Monster Isport Ear Buds Monster Clarity 102 AirLinks Wireless Ear Buds. If you’ve been paying attention, you’ll notice that our grand prize has changed. Unfortunately, everyone else thought the Isport Ear Buds were cool, too, and we ran into a supply problem, as in, we couldn’t get a pair. Fortunately, Monster makes several great sets of ear buds and we picked a comparable pair to replace the Isports. You can click the link above to check them out on the Monster website.  You can head over to the VSH start page using the link at the bottom of the article, but hang here for a little longer to read about the main topics.

Those main topics are phishing and what the Office of Information Technology (OIT) is doing to combat it, and securing Internet-connected devices in healthcare. While this second topic doesn’t seem appropriate, as Berry is a college, not a hospital, we will specifically talk about the many different healthcare devices that are available to consumers, from smart watches and athletic trackers to insulin pumps and smart asthma monitors.

Phishing And The Phish Alert Button

Before we talk about all those incredible Internet of Things (IoT) devices, let’s return to discussing phishing. If you read last week’s article, you’ll remember that there was a quick blurb at the end talking about the importance of detecting and reporting phishing emails you receive.

The first step, of course, is to detect a phishing attempt. How do you do that? What’s the secret to knowing that an email is a phishing attempt? Here’s some items to check in an email to make sure you don’t get hooked.

    1. Make sure the “From” address matches the purported sender.  For example, if an email claims to be from Amazon, but the “From” address is from some account at a Gmail address, it’s probably a phishing attempt
    2. If the greeting is generic, as in “Dear Customer” or “Dear Sir/Madam”, there’s a good chance it is a phishing attempt. Legitimate emails from companies you do business with will seldom start this way. They will either have no greeting, or the greeting will address you by name. Also beware of greetings (and subjects) that refer to you by your email username. These are most likely phishing emails as well
    3. Poor grammar and spelling. No legitimate company will send out email with poor grammar or spelling. It would reflect poorly on them.
    4. Urgency is another warning sign. Emails that require “immediate attention” or warn of dire consequences if you don’t act quickly are most likely phishing attempts.
    5. Links and attachments are both signs that an email is a phishing attempt. Even if you are expecting an attachment from someone, it can be a good idea to simply confirm with them via phone or other method that they sent it.
    6. Lotteries, donations, investment opportunities, get rick quick schemes, unsolicited job opportunities and inheritances from people you don’t know are almost always too good to be true.

If you would like to see real examples of phishing emails, you can visit the Berry College Phishbowl, located here on the InfoSec News and Alerts site.

If you receive a phishing email, even if you are not 100% sure, report it. If it is not a phishing email, you’ll get a reply explaining why it is not. To help OIT combat phishing, please report these phishing attempts using the “Report Email as Phishing” button, which is available in the mail.berry.edu webmail interface and on mobile versions of Outlook, as well as the traditional Outlook client on PCs and Macs. In Outlook, it should appear in the ribbon menu as an open envelope with an orange hook. On the web and mobile, you will find the button under the “three dots” menu in the top right corner of the window when you open an email.

It’s very important to report these emails using the button and not to simply forward them to Information Security or delete them, as this allows us to take action on these emails to protect the community. OIT has invested in a system to be able to mitigate phishing emails, but its effectiveness relies on you reporting phishing attempts. So report all the ones you receive to help us protect you.

IMPORTANT OPPORTUNITY ALERT!!!

If you want to learn more about how to spot phishing emails, there is a Virtual LunchITS scheduled for October 22nd at noon. It will be held over Zoom, will last under an hour and will give you a definite edge in spotting phishing emails. I encourage you to sign up to attend. You can do that right in the event. Just click on it in the Event calendar on the InfoSec News and Alerts site and fill out an RSVP. There is no cost, but to make the Zoom meeting secure, you must request access to the LunchITS so I can send you the course resources and the meeting link and password.

Securing Internet-Connected Devices in Healthcare

Everything can be connected these days, from smart watches, like the Apple Watch, to dedicated fitness trackers like FitBits, to shoes like Under Armour’s HOVR running shoes. Healthcare devices are prime candidates for connecting to the network, as they can produce historical data that can be used to make health decisions, or can be controlled remotely with a smartphone app. Once they are connected, they are targets, just as we mentioned last week about IoT devices on your home.

How can we make sure that these devices are securely connected? Here are some tips to help you make a secure connection with your “healthy” devices.

    1. Choose well-known, reputable brands that won’t disappear on you after you purchase the product.
    2. Make sure you follow the vendor-provided instructions for connecting it to the network.
    3. Once it is connected to the network, make sure you update the device to the latest version of the software or firmware running on it.
    4. Be sure to continue to update the device, or, if it is capable, set it to auto-update when updates are available.
    5. Keep track of your devices, particularly those that collect data about you and your activities, like smart watches and fitness trackers.

Those of you who have consumer medical devices like insulin pumps, continuous glucose monitors, pacemakers, asthma monitors or inhalers and other devices that can potentially disrupt your health should be extra careful in following the tips above. Most of these devices have online communities and vendor supplied resources that can help you stay aware of any potential issues with your particular device. If you’re not connected to any resources like this, use your favorite search engine and see what’s out there.

One more thing before we get to the VSH clues…you will soon be receiving, or may have already received, an email informing you of when multi-factor authentication (MFA) will be enabled on your account. Don’t delete these emails or report them as phishing! They are real. The emails will provide you with resources about how to set up MFA. If you want to have MFA enabled on your account before your appointed date, email computing@berry.edu and let them know you want MFA.

OK, it’s time to throw some hints to those of you who can’t seem to make your Week 2 Virtual Scavenger Hunt answers get you to week 3.

    • For the first question – The Events calendar for the InfoSec News and Alerts Site is right on the main menu. Once you go there, choose the monthly view, if it is not the current view. You’ll see the event in question as the only single day event in October.
    • For the second question – be sure you put a leading zero on your answer to come up with a four digit month and day answer
    • For the third question – Be sure to jump into the section on ransomware to find the answer.
    • For the fourth question – The largest breaches in the Have I Been Pwned database are listed on the left side of the main page.
    • For the fifth question – Follow this link to the security awareness poster that is in the residence halls and in Krannert.

IMPORTANT: You don’t have to resubmit your answers on the week 2 form, but these clues should help you get the correct URL for week 3 of the scavenger hunt.

If you haven’t started the scavenger hunt, here is the start page. Good luck and happy hunting!

Virtual Scavenger Hunt Start Page

 

Photo Credit: Photo by Solen Feyissa on Unsplash

VM Notifications and Signature Requests are Fraudulent

Many of you have received (and some have reported – thanks!) two fairly new phishing emails to appear in our inboxes.

The first one is a (sometimes incorrectly) targeted voice mail notification. It appears to come from a Berry address if you don’t look closely. The subject line states “VM message from” and then has an area code and prefix, but the last four digits of the phone number are starred out. It also states that the VM was “received and processed” on a specific date. Opening the email shows an “Office365” logon and “Voicemail Service” in a large, plain type. It tries to get you to open an attachment which has an HTML link which most likely redirects to a fake Office365 login page.

Here is an image of the email:

The second type of phishing email is a fraudulent request for a signature on a document, ostensibly an auto proposal. These email also  purport to be from Berry, but actually come from another educational institution. The phishers have either compromised a mail server there or have simply rewritten the From address to look like “<your username>@<the other institution>.edu. The phishers also insert your username into the subject line, which is intended to grab your attention. The full subject line reads: Signature requested for “<your username> – Auto Proposal 20-21”

It gets weirder when you open the email to see the following in the body of the message:

Message Duration: 00:29 secs
Sent by berry.edu – Audlo Management Conferenclng System.

There is an attachment that is supposed to be a voice message, but is actually a document with a link in it, probably going to a fake login page, but you are not explicitly instructed to open it. Apparently, the phishers assume you will open it. Don’t do that…
If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

Photo Credit: Photo by Mael BALLAND on Unsplash

May News from Information Security

Wait?

It’s May already?

Where did April go?

It passed by as we were stuck at home and no, you didn’t miss the the April newsletter, as it was lost in the work-from-home shuffle. There’s a hint of a light at the end of the coronavirus tunnel as some businesses are opening and some restrictions lifted, but that’s all I’m going to say about that…

While we may not have been as busy during this time, phishers, scammers, and other bad actors have gone into overdrive. Some sources have placed the increased fraudulent traffic as 300% higher this last quarter over the same quarter from 2019. The amount of emails attempting to leverage the coronavirus and associated fears has grown astronomically and the phishers have an edge in this environment – we’re already stressed and uncertain.

There are emails purporting to have a cure for the disease, others with great deals on PPE (who figured that acronym would ever become common?), some trying to steal CARES relief funds, and others trying to convince people they have come in contact with someone with the virus. That’s just a tiny sample. There are some new articles on this site covering social media surveys, Skype password phishing, and complaint scams. The COVID-19 article was updated multiple times with new information. If you haven’t read those yet, you should check them out after you’re done reading this.

Myriad opportunities abound to phish, scam, and deceive people who have severe cases of cabin fever, restlessness and real fears about jobs and finances. No stress point is neglected in the daily attacks from bad actors trying to compromise accounts, steal credentials, and wreak havoc in an already chaotic environment. Many people are learning new ways to work, communicate, shop, eat, and socialize. All of the “new” is irresistible to scammers and phishers. Here is what I consider the number one safety tip (with some examples) to safely navigate this new (hopefully temporary) normal.

  • Almost all email should be considered suspect at this point. Apply a much higher grade of scrutiny to any and all emails you receive.
    • Emails like the ones mentioned in the Skype phishing article will appear to come from a variety of services, all of them trying to get you to click on that link or button in the email to check your notifications. Don’t!!! Simply log in to the site or service like you normally would, and if you have notifications, they will be there.
    • Emails asking for banking information or other financial information should be VERY carefully scrutinized. Most will be fraudulent. If you or a family member need to supply banking information to receive CARES funds or are having to deal with unemployment, make sure you are going to the right resources. Numerous government sites are available including the Health and Human Services site  and the primary government site about coronavirus information. The Georgia Department of Labor site is where to get answers about the process of receiving unemployment benefits.
    • Phishers haven’t given up on old themes. We have received plenty of emails to campus inboxes purporting to be from college department heads, all the way to President Briggs, asking you to for a “favor” or with an “urgent request”. Don’t fall for these! Check the From address and look for the external email banner to determine the validity of emails like this. The fact that they should be EXTREMELY rare should immediately render them suspect.

On a somewhat different topic, check out the new voicemail notification Quick Tip here on the site. It explains how to tell if a voicemail notification received via email is valid or not.

Here’s hoping that things will get back to normal soon, even if normal is slightly different. As always, if you ever have a question about an email or other questions about information security, please don’t hesitate to contact me at infosec@berry.edu, extension 1750 or 706-236-1750. I’m still working at home, like many others.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted (whenever we get to the point we can do that).
Photo Credit: Photo by Jose Antonio Gallego Vázquez on Unsplash

Watch Out for Social Media “Surveys”

With everyone spending more time at home, traffic on social media sites has grown tremendously. One particular item to avoid during this time of boredom meltdown, even though they may be fun, are so-called “surveys” on social media sites. You know, the ones that ask about favorite colors, pet’s names, mother’s maiden name, what schools you attended, favorite songs, movies, cars, or whatever? Do these questions sound familiar?

If you have ever set up backup “security questions” for a web site, you’ll notice the surveys ask for many of the same bits of information. A fair percentage of these surveys are simply intended to grab your username for the social network, then slyly ask you to hand over potential security question answers.

Don’t fill out these surveys. Yeah, they can be fun, maybe, but if the information you willingly hand over may allow someone to reset your password by knowing the answers to your security questions, then they are a really bad idea!

With that in mind, whenever you fill out these backup security questions, you should never put real information in as your answers. Make up answers for these questions, then record those answers somewhere safe, like in a password manager, along with your unique password for the site! This way, you can provide the answers to these questions, but no one else will be able to discover than information from the far reaches of the Internet, or from your answers to a social media site “survey”.

If you would like more information on password managers, check out the short password manager article here on this site.

 

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

 

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit: Photo by William Iven on Unsplash

“Complaint” Emails are Fraudulent

UPDATED (4/28/2020): A new variation on this phishing theme in these days of remote meetings is an email that invites you to a Zoom meeting with HR to discuss a matter important to your employment (first quarter review, personnel issue, contract termination, any job situation that would immediately raise your anxiety level). As usual, the grammar is poor and word choice is unusual for American English speakers.

The Zoom link in the email will bring you to a fake Zoom login page. It is so fake that it will explicitly ask you for your organization email username and email password. There’s no reason Zoom would ask for this information. A real Zoom login page would have a link to sign in with your organization’s credentials, but it does not call them “email username” and “email password”. 

Be very careful out there and think before you click. If you need to confirm a suspicious meeting with HR or anyone else, please call or email them directly. Don’t click on the link without confirming!

A common phishing email that recently has been increasing in frequency tries to convince you a complaint has been lodged against you, and that the police have been contacted. Other versions of this same phishing theme have mentioned docking your salary because of the complaint..

The emails seen here at Berry were simple, with poor grammar.

This is the text of the email

, good afternoon
We received a client complaint #2/691 on you in Berry College.
Complaint forwarded to local police department

Notice the comma at the front of the first line. This indicates that the phishers tried to mail merge these and failed or simply used a mail merge template, as there should be a name in front of the comma. Again, the grammar is terrible and the “#2/691” in the email is a link that might be tempting for you to click to see who complained about you. Don’t!!! The email came from an external email address, not from within the Berry email system as would be expected if this were real.

Other version of this phishing email purports to come from a “corporate lawyer” who “tried to reach you” but couldn’t. It asks for a time when can you be contacted and also provides a helpful and tempting link to review the complaint.

This is not how Berry does business, of course, and it should be obvious that this is a phishing email.

 

 

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit: Photo by David Clode on Unsplash