Go to the U of M home page

Friday, October 20, 2017

Example 208: [ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications

Forged mail "from" President Kaler, with a PDF that leads to a fake login page aimed at stealing passwords.

Message Text:


Date:Fri, 20 Oct 2017 15:45:47 +0000
From:"Theresa" <txxxxx@xxxxxx>
To:
Subject:FW:[ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications
FROM THE OFFICE OF THE PRESIDENT
Dear Colleagues,
Integrity has long been a hallmark of our success. It characterizes everything we do. In fact, when we talk about the core values of our company, we start with integrity. Integrity means being straight forward, honest, and transparent in our professional and business relationships. This means doing what we say and saying
what we do.
Each of us makes a wide range of business and ethical decisions every day in the execution of our responsibilities on behalf of University of Minnesota. We are fully committed to ensuring that such decisions comply with the letter and spirit of the law and are ethically above reproach.
This Code of Ethics and Business Conduct is a guide to making the best possible decision in situations affecting your fellow employees or our shareholders, customers, and partners, as well as the communities in which we live and work. In simple terms,  our Code contains the guidelines we must all follow to do business
the only way we should: the right way.

NOTE: It is fundamentally Urgent that all staffs read attached.



ERIC W. KALER
PRESIDENT
University of Minnesota
202 Morrill Hall l 100 Church Street S.E. l Minneapolis l MN l 55455 l USA
Email: upres@umn.edu l Website: www.umn.edu
Phone: 612-626-1616 l Fax: 612-625-3875

PDF content:

PDF with link to fake document
PDF with link to fake document

Web Form

Web form to get document - with login to steal credentials
Web form to get document - with login to steal credentials
Things to Note:


  • Letter forged as "from the President."
  • Email delivers a very simple PDF which has one purpose - a link to a login page.
  • Login page WILL deliver an innocuous PDF of  a "code of ethics."
  • Anyone who filled in the form should immediately change their password.

Monday, October 2, 2017

Example 207: You have an Important message to review

Fake health message email directs to a forged UMN login site in Russia

Message Text:

 From: UMN - Health Care <xxxx @ Some-other-school.edu>
 Subject: You have an Important message to review
 Date: October 2, 2017 at 1:58:48 PM CDT
 To:
 You have an important Health message from University of Minnesota Health Center. Click  Here
      hxxp:// news-xxxxx.ru/login.umn.edu/
  authentication is required to read this message
  We apologize for any inconvenience.
 Thank You.. 
 Allen Brianna
 Health Care Center
 University of Minnesota
Login Form:

Russian hosted forged umn login site
Russian hosted forged umn login site

Things to Note:

Thursday, September 21, 2017

Advisory: FTC Releases Alerts on Protecting Against Identity Theft

U.S. Department of Homeland Security US-CERT
National Cyber Awareness System:

09/20/2017 04:58 PM EDT

The Federal Trade Commission (FTC) has released two alerts to educate consumers on recommended protections against identity theft after the recent data breach at Equifax. Users should consider placing security freezes with the three major credit reporting agencies: Equifax, Transunion, and Experian. Alternative security recommendations include using fraud alerts and free credit monitoring from Equifax. 
US-CERT encourages users to refer to the FTC alerts on Equifax credit freezes and fraud alerts vs. credit freezes. See the US-CERT Tip on Preventing and Responding to Identity Theft for more information.

Thursday, September 7, 2017

Advisory: Potential Hurricane Harvey Phishing Scams

Reminder from US-CERT that recent disasters will lead to scam "fund-raising" emails.

U.S. Department of Homeland Security US-CERT
National Cyber Awareness System:

09/08/2017 01:56 PM EDT

Original release date: September 08, 2017
As the peak of the 2017 hurricane season approaches, US-CERT warns users to be watchful for various malicious cyber activity targeting both disaster victims and potential donors. Users should exercise caution when handling emails that relate to recent hurricanes, even if those emails appear to originate from trusted sources. Disaster-related phishing emails may trick users into sharing sensitive information. Such emails could also contain links or attachments directing users to malware-infected websites. In addition, users should be wary of social media pleas, calls, texts, or door-to-door solicitations relating to the recent hurricanes.
To avoid becoming a victim of fraudulent activity, users and administrators should consider taking the following preventive measures:

Tuesday, September 5, 2017

Example 206: Urgent Notice

Fake "warning" leads to forged UMN login page aimed at stealing passwords.

Message text:

From: UMN Admin <noreply@xxx.edu>
Date: Tue, Sep 5, 2017 at 4:52 PM
Subject: Urgent Notice
 
To:
 
To all staffs/employees and UMN users, we have observed that there are some
non-active email address in our database recently serving as a loop to
hackers trying to hijack our server. User are advised to CLICK
<hxxp://umn-edu.xxxx.biz/index.html> here to login and validate their email
address and continue with their normal activity as their login information
will not be altered or shared.
If you receive this message as spam, kindly move message to your inbox
before you click. Failure to comply with this demand will be regarded
as non active user and will lead to deletion after 48 hours of
reception of this email.
Sorry for the inconveniences.
Admin.
Web Form

Fake UMN login hosted at .biz address
Fake UMN login hosted at .biz address

Things to Note:

  • Email forged as coming from a .edu address - but NOT umn.edu
  • Web form hosted at a ".biz" address - NOT umn.edu
  • Filling in the form redirect to the login.umn.edu web page

Monday, August 14, 2017

Example 205: ITS Support/Help desk

Fake support message leading to deceptive login page to steal name and password.

Message text:

From: Help Desk Support [mailto: non-UMN.EDU address]
Sent: Monday, August 14, 2017 10:09 AM
To: undisclosed-recipients:
Subject: ITS Support/Help desk

Dear Faculty and Staff,

Important information from Web Access Security Service.

An upgrade was made to the university’s authentication structure. The upgrade was required to prepare systems for compliance with State Security Standards, and the implementation of multi-factor authentication. Now, when you lo-gin. You will be required to enter your Network Username and password into the link that will be provided below.

Due to the upgrade that was made. Your lo-gin page will be changing. However, to avoid loss of your email address and password LOGIN your account now.

Thank you for your cooperation and patience as we take steps to further protect university data.

Thank you,
Division of Information Technology.
Login form:

fake login page aimed at stealing account credentials
fake login page aimed at stealing account credentials
 Things to note:

  • No UMN branding in message or webform
  • Email not from umn.edu address
  • Web form not hosted at a umn.edu site

Wednesday, August 2, 2017

Example 204: Notice ! Notice !!

Fake warning "from" google leads to a well crafted fake google login page

Message Text:

Spam Warning email - attached to PDF containing link to Fake Google login
Spam Warning email - attached to PDF containing link to Fake Google login


Web Form

Fake Google Login page
Fake Google Login page

Filling it out redirects to a REAL Google account login:
Real Google Login - with CORRECT "Google" text font
Real Google Login - with CORRECT "Google" text font

Things to Note:

  • Link not in email text - you have to open a PDF to find link
  • Link is hosted at an advertising website, NOT Google.com
  • Forged login uses an older font for "Google" - real google.com uses a san serif font
  • Filling in the form redirect to a REAL Google login page, with CORRECT font