Spear Phishing

We’ve been noticing more questions recently about suspicious emails that look like phishing. These days we tend to see more “spear phishing” campaigns.  “Spear phishing” is just a way of saying it’s a targeted phishing campaign. People are studying our website to see our organizational structure to figure out who are people in authority. Then they send an email pretending to be that person from a free account they created (not associated with Augsburg or Luther Seminary).

These campaigns try to instill a sense of urgency from a person of authority needing help.  These are techniques to try to lure you in and in the end get money from you.

Here’s a recent example:

Notice the carefully crafted signature to make it appear to be from Provost Kaivola. But also notice the email address it is from kaivola@my.com. That is not an institutional email address. That odd email address should be a red flag.

The best course of action is to mark this as spam so Google will be more likely to block it. We see most of these getting blocked as they are becoming very common.

If you did reply they will reply back saying that they are in a meeting and need your help with something important (sense of urgency).

If you reply again they will ask for you to buy a gift card from some online store — we’ve seen iTunes and Steam recently — and they say they’ll reimburse you for it.  Again they will say it is urgent. This is a script we’ve seen over and over with these spear phishing campaigns.

What should you do?

1. If it seems fishy or odd, it is likely a scam. Mark it as spam so Google will be more likely to block it.
2. If you’re truly not sure, contact the person directly by phone or institutional email address to confirm. Do not reply to the suspicious message.

What happened?

The afternoon of May 3 saw a widespread phishing attack across the internet.  The phishing attack is an email that looks like a Google document sharing request as shown below.

It is a convincing phish but note the odd To: address.  That should be a warning sign that something is off.  In some cases people recognized the name of the person but perhaps it was spelled slightly wrong.  That’s another warning sign.

The link, which you should not click on, takes you to a page that appears to request access to your Google account.  Real Google docs do not need this access.  Once you grant access they will try to send more messages using your account to your contact list.

What can I do?

First, if you clicked the link you should change your password on Inside Augsburg.  This is true for any phishing email that has fooled you into clicking on a link.

Second, and more importantly this time, is you need to review all connected Applications and Websites connected to your Google account.  The phish has tricked you into giving their application access to your Google account.  You do not want that.

This is done in three quick steps.

1. Visit https://accounts.google.com
2. Under Sign-in & Security pick Connected apps & sites
   
3. Click MANAGE APPS and review and remove any sites or apps that you do not recognize.  This phish shows up as “Google Docs” which is very tricky.  If you see that listed, remove it.
   

How can I learn more about information security?

We have a broad information security self-paced course in moodle that anyone at Augsburg can complete to improve their information security awareness skills.  The course has about 35 minutes of short videos (closed captioned, no sound required).  You can find it in moodle community at the following address https://moodle.augsburg.edu/moodlecommunity/course/view.php?id=946.

You may recently have heard about Heartbleed, one of the biggest internet security flaws known and that essentially is a security flaw that makes many site passwords vulnerable.

While accounts at Augsburg have not been directly affected by HeartBleed, it is worth taking the precautionary measure of resetting passwords you use for social media sites such as Facebook, Instagram, Pinterest, and email accounts through services such as Yahoo and more.

It is especially important that departments and individuals who manage official social media accounts for the College (such as athletic and academic departments) change the passwords used for these sites.

IT staff further recommend that that Augsburg accounts each have unique passwords. A best practice is to avoid using the same password for multiple sites. This situation clearly illustrates the risk.

A full list of all the sites known to have password systems that are vulnerable are listed at http://www.cnet.com/how-to/which-sites-have-patched-the-heartbleed-bug/

Please contact your LFC if you have questions about resetting your password.