Showing posts with label spear phishing attack. Show all posts

Beware of Coronavirus (COVID-19) Phishing Scams

by Neal Fisch in attacks, awareness, coronavirus, counterfeit websites, COVID-19, data security, faculty, phishing scams, security, spear phishing attack, staff, students 0

Most of us have seen and read in the news about the Coronavirus outbreak, currently known as SARS-CoV-2 or Coronavirus Disease 2019 (COVID-19). We wanted to remind you that during media intense events like this, cyber attackers take advantage of this opportunity and attempt to scam you or launch phishing attacks that attempt to get you to click on malicious links or open infected email attachments. Here are some of the most common indicators that the phone call or email you received is most likely a scam or attack (additional information on identifying scam phone calls and emails may be found at the Federal Trade Commission Consumer Information website).

Any messages that communicates a tremendous sense of urgency. The bad guys are trying to rush you into making a mistake.
Any message that pressures you into bypassing or ignoring our security policies and procedures.
Any message that promotes miracle cures, such as vaccines or medicine that will protect you. If it sounds too good to be true, it probably is.
Be very suspicious of any phone call or message that pretends to be an official or government organization urging you to take immediate action.

For the latest updates consider visiting the World Health Organization website on Health and Disease Control, the Center for Disease Control website, or our own CSUCI Coronavirus (COVID-19) Information website. Please keep in mind Coronavirus scams and attacks can happen at work or at home, via email, text messaging or even over the phone. Don’t fall victim to bad guys playing on your emotions.

If you feel you have received a phishing attack at work, simply delete the message or if you have concerns report it to your information security team.

Information Resources:

CSUCI Coronavirus (COVID-19) Information

California Department of Public Health

U.S. Center for Disease Control and Prevention

World Health Organization

CSU Chancellor’s Office

U.S. Department of State

Johns Hopkins Real Time Map

County of Ventura

VC Emergency

Ventura County Public Health

Santa Barbara County Public Health

Federal Trade Commission Consumer Information

Equifax Breach Advisory

by Neal Fisch in attacks, awareness, cloud, data security, email, faculty, passwords, personal security, phishing scams, privacy, security, social networking, spear phishing attack, staff, students, tips 0

Given the recent announcement regarding the data exposure at Equifax we wanted to share some good “cyber hygiene” and some resources with you. With 143 million U.S. consumers affected it’s a good chance many of us are impacted.

Equifax has said there is no evidence of unauthorized activity in their credit reporting data bases but that there was potentially unauthorized access to information it stored from mid-May to July of this year. That information included social security number (SSN), dates of birth (DOB), addresses and in some cases Driver’s License numbers. Also reported is that approximately 209,000 consumers credit card numbers were exposed as well as other “dispute documents” for 182,000 consumers.

What can you do?

One of the first things typically suggested after a breach is to access credit reporting agencies and request your records to be sure there are no unauthorized accounts or charges. In this case you may want to consider the other agencies, Experian and TransUnion. Also check your online and credit card accounts for suspicious activity. You can check free credit reports from annualcreditreport.com. Check for any accounts or charges you don't recognize.
Be extra wary of scam emails and links. Avoid clicking on links or downloading attachments from suspicious emails. Equifax will send paper mail to consumersbut hackers are sure to use this to conduct Phishing campaigns.
Change your passwords, especially if you have/had an account with Equifax and use similar or the same password elsewhere.
You can check at Equifax here to get information and to check and see if your records are impacted. You can also access your Equifax credit report here which is probably a good idea so you can compare with the ones you get from Experian and/or TransUnion.

Additional Information:

New PayPal phishing scam hooking victims

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, news, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

With Phishing and Spearphishing on the rise people need to pay close attention to the email they receive. The research firm AppRiver is reported a new PayPal phishing scam is making the rounds with this version using a phony security message to obtain personal identifiable information.

Additional information about phishing can be found at here.

The full article may be found here at SC Magazine.

Avoiding Online Tax Scams

by Neal Fisch in attacks, awareness, counterfeit websites, data security, faculty, news, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

It’s tax season again, which means it’s also time for tax scams. Some tax scams occur when fraudulent tax returns are filed in the victim’s name while other variants occur when the malicious actors call the victim and pretend to be Internal Revenue Service (IRS) agents. In addition, there are malicious actors who use the tax season to spread malware and phishing emails.

Tax scams where the malicious actor files the return in the victim’s name include both identity theft and identity fraud, as well as tax fraud. This scenario occurs when the malicious actor finds or receives information about the tax filer, including the filer’s name, address, date of birth, and Social Security Number. The malicious actor then uses this information to file a malicious tax return, citing as many deductions as possible, in order to create as large a tax return as possible.

The other variant of tax scams occur when the malicious actor contacts the victim and tries to convince the victim to do something, such as immediately paying a fine or providing their financial information so a refund can be issued. In these instances the malicious actor uses what they know about the victim, often information gained for a data breach or social networking website, to convince the victim that the caller has access to the victim’s tax information. Frequently during these calls the caller will pretend to be an IRS agent.

In the third type of tax scam, malicious actors use tax related spam, phishing emails, and fraudulent websites to trick victims into providing login names, passwords, or additional information, which can be used in further fraud. Other emails or websites may download malware onto the victim’s computer.

What to Watch Out For

Watch for “spoofed” websites that look like the official website but are not.
Don’t be fooled by unsolicited calls. The IRS will never call to demand an immediate payment or require you to use a specific payment method such as pre-loaded debit or credit cards, or wire transfers. They will never claim anything is “urgent” or due immediately, nor will they request payment over the phone.
The IRS will not be hostile, insulting, or threatening, nor will they threaten to involve law enforcement in order to have you arrested or deported.
Sometimes malicious actors change their Caller ID to say they are the IRS. If you’re not sure, ask for the agent’s name, hang up, and call the IRS (or your state tax agency) back using a phone number from their official website.

Recommendations

If you believe you are the victim of identity theft or identity fraud, there are a couple of steps you should take:

File a report with your local law enforcement agency.
File a report with the Federal Trade Commission (FTC) at www.identitytheft.gov.
File a report with the three major credit bureaus and request a “fraud alert” for your account (Equifax – www.equifax.com, Experian – www.experian.com, TransUnion – www.transunion.com)

If you receive spam or a phishing email about your taxes, do not click on the links or open any attachments, instead forward the email to phishing@irs.gov. Other tax scams or frauds can be reported according to the directions on this page: https://www.irs.gov/Individuals/How-Do-You-Report-Suspected-Tax-Fraud-Activity%3F.

Further Information

Tax scam information from the IRS: https://www.irs.gov/uac/Tax-Scams-Consumer-Alerts.
Security Awareness for Tax Payers guide by the IRS: https://www.irs.gov/pub/irs-pdf/p4524.pdf .
Identity theft information from the FTC: https://www.identitytheft.gov/.

This post was adapted from the Cybersecurity Tips Newsletter, February 2016 Volume 11 Issue 2

Protect Yourself Against Cyber Threats - Setting up Proper Controls

by Neal Fisch in awareness, data security, holiday scams, passwords, personal security, phishing scams, security, spear phishing attack, staff, students, tips 0

We are starting a new series of blogs targeted at protecting yourself against cyber threats. This series will run over the next few months and cover varying subject matter related to cyber threat protection.

Today's guest blog contributor is Eric Varela. Eric is a student here at CSU Channel Islands majoring in Information Technology with a minor in Security Systems Engineering.

Connect securely wherever you are: Only connect to the Internet over secure, password-protected networks. Free public WI-FI, from popular patronage sites such as Starbucks, McDonalds, Subway, etc. - provide convenience over security. If you must use public WI-FI, use it for browsing purposes only and not for private transactions such as banking or emails.

Think before you click: Do not click on links or pop-ups, open attachments, or respond to emails from strangers. Even if an email message has a sender address of someone you know, be sure the email attachments or links were requested from the source. It is possible for sender addresses to be spoofed or taken over. When it doubt, throw it out. A link or attachment could contain malware, and a single click is all it takes to get infected.

Respond only to trusted messages: Do not respond to online requests for personal information such as your date of birth or your credit card numbers; most organizations-banks, universities, companies, etc.-do not ask for your personal information over the internet. (Tip: CSUCI will never ask for your password or login information via email.)

Use passwords properly: Select strong passwords, with a minimum of eight characters and a mix of upper and lowercase letters, numbers and symbols, and change them frequently. Password protect all devices that connect to the internet and user accounts.

You should also remember to:

Not share your password with others.
Make your password is unique to your life and not something that is easily guessed.
Have a different password for each online account.
Write down your password and store it in a safe place away from your computer.
Change your password several times a year. (Tip: At the beginning and end of each semester.)

Stay aware: Routinely monitor bank and credit card accounts for unauthorized charges and unauthorized accounts that have been opened under your name. Annually, you are entitled to a free credit report by the three big credit reporting agencies by federal law. Take advantage of these free reports and stay current on your credit score and history.

Don't be a victim of identity tax theft! The IRS is helping to protect false tax claims.

by Neal Fisch in attacks, awareness, data security, faculty, personal security, phishing scams, security, spear phishing attack, staff, students, tips 0

One of the hot identity theft scams is submission of false tax returns in order to receive unearned or earned refunds. The IRS has a process to try and detect these false returns. If they suspect a false return they will mail a letter to the address the taxpayer listed in their previous year return. The IRS letter directs the taxpayer to visit an IRS site to verify the tax return submitted. Legitimate letters should direct taxpayers to idverify.irs.gov. More details are contained in this link: http://www.irs.gov/uac/Newsroom/Taxpayers-Receiving-Identity-Verification-Letter-Should-Use-IDVerifyirsgov.

The IRS also has a great website page detailing active tax scams: http://www.irs.gov/uac/Tax-Scams-Consumer-Alerts.

If taxpayers suspect they are a victim of tax fraud/identity theft, they should contact the Treasury Inspector General for Tax Administration at 1-800-366-4484 or via the web at: http://www.treasury.gov/tigta/contact_report_scam.shtml

Taxpayers can forward scam emails to phishing@irs.gov.

Tax Identity Theft Awareness Week Begins Today!

by Neal Fisch in attacks, awareness, cloud, counterfeit websites, data security, email, faculty, holiday scams, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

Two Ways Tax Scammers Might Target You

It’s that time of year — tax time. It’s also a great time to get up to speed on tax-related scams. Here are two ways tax scammers might target you:

Tax identity theft

This kind of identity theft happens when someone files a fake tax return using your personal information — like your Social Security number — to get a tax refund or a job. You find out about it when you get a letter from the IRS saying:

more than one tax return was filed in your name, or
IRS records show wages from an employer you don’t know

If you get a letter like this, contact the IRS Identity Protection Specialized Unit at 800-908-4490. You can find more about tax identity theft at ftc.gov/taxidtheft and irs.gov/identitytheft.

IRS imposter scams

This time scammers aren’t pretending to be you — they’re posing as the IRS. They call you up saying you owe taxes, and threaten to arrest you if you don’t pay right away. They might know all or part of your Social Security number, and they can rig caller ID to make it look like the call is coming from Washington, DC – when it could be coming from anywhere. Leaving you no time to think, they tell you to put the money on a prepaid debit card and tell them the card number right away.

The real IRS won’t ask you to pay with prepaid debit cards or wire transfers, and won’t ask for a credit card number over the phone. When the IRS contacts people about unpaid taxes, they usually do it by mail.

If you have a question about your taxes, call the IRS at 800-829-1040 or go to irs.gov. You can report IRS imposter scams to the Treasury Inspector General for Tax Administration (TIGTA) online or at 800-366-4484, and to the FTC at ftc.gov/complaint.

Social Engineering: The Basics

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, holiday scams, news, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

What is social engineering? What are some of the most common tactics used. Here's a short guide on how you lessen your likelihood of becoming a social engineering statistic.

Don't be Duped by Internet Fraud

by Neal Fisch in awareness, counterfeit websites, data security, email, faculty, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

We all get offers that seem too good to be true. Whether they come by email or appear on web sites, they are often clever schemes designed to dupe the gullible. Don't be tricked by Internet Fraud. For more information see http://www.lookstoogoodtobetrue.com.

by Neal Fisch in attacks, awareness, data security, faculty, news, personal security, phishing scams, security, social networking, spear phishing attack, staff, students 0

Email phishing continues to increase and the attackers are constantly looking for better ways to trick you. Phishers have their sites focused on PayPal now more than ever. Read this SC Magazine article summarizing "The Internet Threats Trend Report April 2014" to learn more.

Computer Security and You.

by Neal Fisch in attacks, awareness, data security, email, faculty, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips, virus 0

Scammers, hackers, and identity thieves are looking to steal your personal information – and your money. But there are steps you can take to protect yourself, like keeping your computer software up-to-date and giving out your personal information only when you have a good reason.

Visit our friends at OnGuardOnline.gov and see what you can do to better protect yourself and your personal information.

October is National Cyber Security Awareness Month

by Neal Fisch in awareness, data security, devices, email, faculty, Peer-to-Peer (P2P), personal security, phishing scams, security, social networking, spear phishing attack, spyware scams, staff, students, tips 0

Each and every one of us needs to do our part to make sure that our online lives are kept safe and secure. That's what National Cyber Security Awareness Month—observed in October —is all about!

Please take the time to review some of our resources available to help you become more aware of the current landscape for cyber-threats.

How to spot a phishing email.

by Neal Fisch in awareness, data security, email, faculty, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips, vishing 0

With the recent flurry of phishing emails being received these days I thought I would post this quick guide to assist you in determining if the email you received may actually be a phishing email.

It could be a phishing email if:

There are misspelled words in the email or it contains poor grammar.
The message is asking for personally identifiable information (PII), such as credit card numbers, account numbers, passwords, PIN's or Social Security Number.
There are "threats" or alarming statements that create a sense of urgency. For example: "Your account will be locked until we hear from you" or "We have noticed activity on your account from a foreign IP address".
The domain name in the message isn't the one you're used to seeing. It's usually close to the real domain name but not exact. For example:

Phishing Website: www.regionsbanking.com
Real Website: www.regions.com

Think Before you Click!

by Neal Fisch in awareness, data security, email, faculty, personal security, phishing scams, security, spear phishing attack, staff, students, tips 0

Be cautious about all communications you receive, and clicking on links in an email, instant message or a website. Even if you know and trust the sender of the email, or an instant message, or are on a known website or a friend's social networking page, it is still prudent to use caution when navigating pages and clicking on links or photos, because links, images or other content contained on the pages may include malicious code placed there by hackers.

For more information, please visit:
SANS OUCH! Newsletter on "Email Phishing Attacks"

Don't Reply to Unsolicited Email Messages (SPAM).

by Neal Fisch in awareness, counterfeit websites, data security, email, faculty, passwords, personal security, security, spear phishing attack, staff, students, tips 0

By responding to these messages, you're only confirming that your email address is active. Another thing you shouldn't do is click the "remove me" link in the message. Links in email can point to an IP address other than what is being represented or referenced. The best thing you can do is delete the message.

Many free email service providers (MSN hotmail, Yahoo!, AOL or GMail) will allow you to easily report it as spam if you received it through their email systems.

Scan Your Computer

by Neal Fisch in awareness, data security, email, faculty, passwords, personal security, phishing scams, security, social networking, spear phishing attack, spyware, staff, students, tips 0

Once an anti-virus and/or anti-spyware package has been installed on your computer, you should scan your entire computer periodically. If your anti-virus package has the ability to automatically scan specific files or directories and prompt you at set intervals to perform complete scans, enable this feature.

What can I do to protect my computer?

Don't click on pop-up ads that advertise anti-virus or anti-spyware programs
Use and regularly update firewalls, anti-virus, and anti-spyware programs
Properly configure and patch operating systems, browsers, and other software programs.
Turn off ActiveX and Scripting, or prompt for their use.

For more information, please visit:

New Social Networking Security Awareness Video Now Available

by Neal Fisch in awareness, data security, news, personal security, security, social networking, spear phishing attack, tips 0

A new video released by SANS.org is available this month to help you learn some of the most common risks of online social networking and the steps you can take to protect yourself and your family.

March 2013 - secureCI Monthly Newsletter

by Neal Fisch in attacks, awareness, newsletter, phishing scams, spear phishing attack 0

secureCI presents Ouch!

The SANS Monthly Information Security Bulletin at Channel Islands

Link to SANS Institute Ouch! Monthly Newsletter

Email Phishing Attacks

In This Issue…

Overview
Phishing Attacks
Protecting Yourself

GUEST EDITOR
Pieter Danhieux is the guest editor for this issue. He works for BAE Systems Detica in Australia (www.baesystemsdetica.com.au) and is an instructor for the penetration testing courses at the SANS Institute.

OVERVIEW
Email is one of the primary ways we communicate. We not only use it every day for work, but also to stay in touch with our friends and family. In addition, email is how companies provide many products or services, such as confirmation of an online purchase or availability of your online bank statements. Since so many people around the world depend on email, email attacks have become one of the primary attack methods used by cyber criminals. In this newsletter, we explain the most common email attacks and the steps you can take to protect yourself.

PHISHING ATTACKS
Phishing was a term originally used to describe email attacks that were designed to steal your online banking user name and password. However, the term has evolved and now refers to almost any email-based attack. Phishing uses social engineering, a technique where cyber attackers attempt to fool you into taking an action. These attacks often begin with a cyber criminal sending you an email pretending to be from someone or something you know or trust, such as a friend, your bank or your favorite online store. These emails then entice you into taking an action, such as clicking on a link, opening an attachment or responding to a message. Cyber criminals craft these emails to look convincing, sending them out to literally millions of people around the world. The criminals do not have a specific target in mind, nor do they know exactly who will fall victim. They simply know the more emails they send out, the more people they may be able to fool. Phishing attacks work one of four ways:

Harvesting Information: The cyber attacker’s goal is to fool you into clicking on a link and taking you to a website that asks for your login and password, or perhaps your credit card or ATM number. These websites look legitimate, with exactly the same look, imagery and feel of your online bank or store, but they are fake websites designed by the cyber attacker to steal your information.
Infecting your computer with malicious links: Once again, the cyber attacker’s goal is for you to click on a link. However, instead of harvesting your information, their goal is to infect your computer. If you click on the link, you are directed to a website that silently launches an attack against your computer that if successful, will infect your system.
Infecting your computer with malicious attachments: These are phishing emails that have malicious attachments, such as infected PDF files or Microsoft Office documents. If you open these attachments they attack your computer and, if successful, give the attacker complete control.
Scams: These are attempts by criminals to defraud you. Classic examples include notices that you’ve won the lottery, charities requesting donations after a recent disaster or a dignitary that needs to transfer millions of dollars into your country and would like to pay you to help them with the transfer.

Don’t be fooled, these are scams created by criminals who are after your money.

Use common sense,

if an email seems odd or too good to be true,

it is most likely an attack.

PROTECTING YOURSELF

In most cases, simply opening an email is safe. For most attacks to work you have to do something after reading the email (such as opening the attachment, clicking on the link or responding to the request for information). Here are some indications if an email is an attack:

Be suspicious of any email that requires “immediate action” or creates a sense of urgency. This is a common technique used by criminals to rush people into making a mistake.
Be suspicious of emails addressed to “Dear Customer” or some other generic salutation. If it is your bank they will know your name.
Be suspicious of grammar or spelling mistakes; most businesses proofread their messages carefully before sending them.
Do not click on links. Instead, copy the URL from the email and paste it into your browser. Even better is to simply type the destination name into your browser.
Hover your mouse over the link. This will show you the true destination where you would go if you actually clicked on it. If the true destination of the link is different than what is shown in the email, this may be an indication of fraud.
Be suspicious of attachments and only open those that you were expecting.
Just because you got an email from your friend does not mean they sent it. Your friend’s computer may have been infected or their account may have been compromised, and malware is sending the email to all of your friend’s contacts. If you get a suspicious email from a trusted friend or colleague, call them to confirm that they sent it. Always use a telephone number that you already know or can independently verify, not one that was included in the message.

If after reading an email you think it is a phishing attack or scam, simply delete the email. Ultimately, using email safely is all about common sense. If something seems suspicious or too good to be true, it is most likely an attack. Simply delete the email.

RESOURCES
Some of the links have been shortened for greater readability using the TinyURL service. To mitigate security issues, OUCH! always uses TinyURL’s preview feature, which shows you the ultimate destination of the link and asks your permission before proceeding to it.

OnGuard Online –
http://www.onguardonline.gov/phishing

Recognizing Phishing Attacks:
http://preview.tinyurl.com/3c2axs8

OpenDNS Phishing Protect:
http://www.opendns.com/phishing-protection

Common Security Terms:
http://preview.tinyurl.com/6wkpae5

SANS Security Tip of the Day:
http://preview.tinyurl.com/6s2wrkp

LEARN MORE
Subscribe to the monthly OUCH! security awareness newsletter, access the OUCH! archives, and learn more about SANS security awareness solutions by visiting http://www.securingthehuman.org. OUCH! is distributed under the Creative Commons BY-NC-ND 3.0 license.

If you're not sure you've seen an incident, report it anyway

by Neal Fisch in attacks, awareness, data security, passwords, personal security, phishing scams, security, spear phishing attack, tips 0

Most security folks (and IT folks, for that matter) would rather hear about a problem from you than to figure it out afterwards while troubleshooting a system failure. If you receive a phone call from "User Support" doesn't sound quite right, if a common email announcement is just a little off, or if a caller on the phone is too stressed to remember his or her password and asks you to provide it — don't be pressured and don't be rushed. Rush and pressure are among the "social engineering" hacker's best tools.

What should you do? Ask for help! Call your supervisor, call your IT group, and call your InfoSec group on the spot for assistance. You are just as responsible to the whole organization as the folks who support information security for the organization! Don't let one person's stress jeopardize the organization's information security.

If you encounter any of these scenarios, please contact the T&C Helpdesk (helpdesk@csuci.edu or (805) 437-8552) or the Information Security Office (infosec@csuci.edu) for assistance and remember, no T&C staff member will ever ask you for any personal information, including your passwords.

How to Spot a Phishing Scam

by Neal Fisch in awareness, counterfeit websites, data security, personal security, phishing scams, security, spear phishing attack, tips 0

We've all received them, emails from a seemingly trusted source like a bank, delivery company or even your own place of employment, claiming there was some type of issue or another requiring you to offer up some personal information or to click on a link or button to help clear the issue up. If you receive an email similar to this DO NOT CLICK ON ANY LINK OR OFFER UP ANY INFORMATION!

This is a common form of security attack called a phishing or spear phishing scam.

Groups attempting to steal personal information will often use e-mails that appear to originate from a trusted source to try and trick a user into entering valid credentials at a fake website. Typically the e-mail and the web site look like they are part of a bank or some other organization the user is doing business with.

For example, it could be a phishing email if...

There are misspelled words in the e-mail or it contains poor grammar.
The message is asking for personally identifiable information, such as credit card numbers, account numbers, passwords, PINs or Social Security Numbers.
There are "threats" or alarming statements that create a sense of urgency. For example: "Your account will be locked until we hear from you" or "We have noticed activity on your account from a foreign IP address."
The domain name in the message isn't the one you're used to seeing. It's usually close to the real domain name but not exact. For example:

Phishing website: www.regionsbanking.com
Real website: www.regions.com

If you receive an email like this and you think it may be fraudulent, please report it immediately to the T&C Helpdesk at X8552, helpdesk@csuci.edu, or infosec@csuci.edu. Our technicians will assist you and instruct you on how to effectively remove it.

Please remember... nobody from T&C will ever ask you for any personal information, including your password!