Phishing Email – Your New Salary As Adjusted

phishing2015Click image for larger version

The Northeastern Community has received a new phishing email with the subject: “Your New Salary As Adjusted.” The email asks the user to click on a link and enter their myNEU credentials.

This email is a fake. Do NOT click on the link in the email. Delete from your inbox.

If you clicked on this email and entered your credentials you must change your password and password reset challenge question immediately. Please contact the Service Desk for assistance at 617-373-4357.

Northeastern will NEVER ask your to confirm your credentials in an email. This is a sure sign that the email is fraudulent. Please contact the Service Desk if you are unsure if an email from Northeastern is real.

Posted in Malware, Anti-Virus, Phishing, Scams | Comments closed

Changes to Remote Desktop – VPN Access

Starting today, the new standard for remote desktop access goes into effect. Under this standard, all individuals using certain remote desktop applications – such as Microsoft Remote Desktop Protocol (RDP), PC Anywhere, and Apple Remote Desktop – to connect to Northeastern resources must use the VPN in order for those applications to work properly. A full list of applications is provided below.

At this time, other applications and services are not impacted by the new remote desktop access standard; SSH, FTP, HTTP, HTTPS will continue to be accessible without the new VPN. Please note that the VPN requires a myNEU username and password in order to log in, so individuals who do not have a myNEU username and password (including non-Northeastern researchers and/or contractors) will need to obtain one through a Sponsored Account.

Impact
This new standard only impacts individuals trying to access on-campus computers or servers, from an off-campus location, using one of the remote desktop applications listed below. These individuals must connect to the VPN first, then they may start using those specific remote desktop applications.

Getting Started with the VPN
To use the VPN, you will need to install the new VPN client software – Palo Alto GlobalProtect. This software is ready and available to the Northeastern community, as detailed in the How To’s link below. A list of operating systems that support the new GlobalProtect VPN client software is available here.

VPN Installation, Set Up & Connection How To’s

Applications That Require The VPN To Function Properly From Off-Campus
• AirDroid
• Apple Remote Desktop
• Avocent
• BeInSync
• Dell Remote Access Card (DRAC)
• DeskShare
• eklogin
• exhelp
• Glide
• Jump Desktop
• klogin
• Layer 2 Tunneling Protocol (L2TP)
• Mocha RDP
• Mosh (Mobile Shell)
• Microsoft Hyper-V Virtual Machine Connection
• Microsoft Remote Desktop Protocol (RDP)
• PC Anywhere
• PC-over-IP (PCoIP)
• Pocket Controller Pro for Windows
• Point-to-Point Tunneling Protocol (PPTP)
• Rexec
• vR-services
• Radmin
• RDM+ Remote Desktop
• rlogin
• Remote Shell (rsh)
• ScreenConnect
• Synergy
• TeamViewer (direct IP-IP)
• Telnet
• VNC
• Webot
• webRDP
• X Font Server
• X11
• XDMCP
Questions or concerns? Please contact the ITS Service Desk at 617.373.4357 (xHELP) or help@neu.edu.

Posted in NU Policy, Safe Computing | Comments closed

JAN 26, 2015 Blizzard Public Information Statement MEMA

The Massachusetts Emergency Management Agency sent out these steps to help stay safe through what is being called a potentially “Historic Blizzard.”

*You can also view the UniversalHub French Toast Alert for the latest storm updates.

MEMA’S TIPS FOR PREPARING FOR THE STORM

FRAMINGHAM, MA – “Before the arrival of the storm this evening, it is important that you take the proper steps to ensure the safety of your family and home,” said Massachusetts Emergency Management Agency (MEMA) Director Kurt Schwartz.

• Ensure your Emergency Kit is stocked with supplies to enable you to survive on your own for at least three to five days. There should be a first-aid kit, essential prescription medicines, non-perishable foods (those that require no refrigeration such as canned goods, dried fruits and nuts), a manual can opener, water (one gallon per person, per day), flashlights and extra batteries along with a portable radio or NOAA Weather Radio, baby-care or pet supplies items, extra blankets, sleeping bags and a fire extinguisher.

• Ensure that your Winter Emergency Car Kit is well stocked to keep you and your vehicle safe.

• This storm has the potential to bring widespread power outages, so take the opportunity to fully charge your cell phone, laptop, and any other devices in advance of a power outage.

• Those along the coast should be aware of potential flooding. Pay close attention to directives from you local public safety officials.

• Keep extra batteries for your phone in a safe place or purchase a solar-powered or hand crank charger. These chargers are good emergency tools to keep your laptop and other small electronics working in the event of a power outage. If you own a car, purchase a car phone charger because you can charge your phone if you lose power at your home.

• Gas up you automobiles because many local filling stations may also lose their ability to pump gas.

• Download the free Massachusetts Alerts app to your smartphone to receive important weather alerts and messages from MEMA. Easy instructions are available at www.mass.gov/mema/mobileapp.

• Trim dead tree branches and limbs close to your home. Ice, snow and wind can combine to snap limbs that can take down power lines or damage your home.

• Clean gutters. Melting snow and ice can build up if gutters are clogged with debris. When thawing begins, the water can back up under your roof and eaves causing damage to walls and ceilings.

• Check your homeowner’s insurance policy to ensure adequate coverage.

• Ensure that your Smoke and Carbon Monoxide (CO) detectors are working correctly and have fresh batteries. Check your outside fuel exhaust vents, making sure that they are not obstructed by snow or ice. Never use cooking equipment intended for outside use indoors as a heat source or cooking device

• Have sufficient heating fuel, as regular sources may be cut off. Have the option of emergency heating equipment and fuel (a gas fireplace, wood burning stove or fireplace) so you can safely keep at least one room livable. Be sure the room is well ventilated.

• To keep pipes from freezing, wrap them in insulation or layers of newspapers, covering the newspapers with plastic to keep out moisture. Let faucets drip a little to avoid freezing.

• Know how to safely shut off gas, electric power and water valves.

• If you use medical equipment in your home that requires electricity, talk to your health care provider about how you can prepare for its use during a power outage. Ensure you have extra batteries for medical equipment and assistive devices.

• If you have life-support devices that depend on electricity, contact your local electric company about your power needs for life-support devices (home dialysis, suction, breathing machines, etc.) in advance of an emergency. Some utility companies will put you on a “priority reconnection service” list. Talk to your equipment suppliers about your power options and also let the fire department know that you are dependent on life-support devices.

• Find out about individual assistance that may be available in your community if you need it. Register in advance with the local emergency management agency, the local fire department, other government agencies or non-profit groups. Tell them of your individual needs or those of a family member and find out what assistance, help or services can be provided.

• If you use in-home support services, Meals-on-Wheels, Life Alert or other support services, work with them to personalize emergency preparedness plans to meet your needs so you can keep in touch with them during and after an emergency. That contact may be your lifeline to other services in a disaster.

• If you have or may have transportation needs, work with local transportation providers and/or disability services (e.g., Paratransit, Independent Living Centers) to plan ahead for accessible transportation.

• Develop back-up plans for personal assistance services, hospice or other forms of in-home assistance.

• Be a good neighbor. Check in on friends, family, and neighbors, particularly those most susceptible to extreme temperatures and power outages such as seniors and those with access and functional needs.

MEMA is the state agency charged with ensuring the state is prepared to withstand, respond to, and recover from all types of emergencies and disasters, including natural hazards, accidents, deliberate attacks, and technological and infrastructure failures. MEMA is committed to an all hazards approach to emergency management. By building and sustaining effective partnerships with federal, state and local government agencies, and with the private sector – – individuals, families, non-profits, and businesses – – MEMA ensures the Commonwealth’s ability to rapidly recover from large and small disasters by assessing and mitigating threats and hazards, enhancing preparedness, coordinating response operations, and strengthening our capacity to rebuild and recover.

For additional information about MEMA, go to www.mass.gov/mema. Also, follow MEMA on Twitter at www.twitter.com/MassEMA; Facebook at www.facebook.com/MassachusettsEMA; and YouTube at www.youtube.com/MassachusettsEMA. Massachusetts Alerts: to receive emergency information on your smartphone, including severe weather alerts from the National Weather Service and emergency information from MEMA, download the Massachusetts Alerts free app. To learn more about Massachusetts Alerts, and for additional information on how to download the free app onto your smartphone, visit: www.mass.gov/mema/mobileapp.

Posted in Uncategorized | Comments closed

Zero-Day Exploit for Latest Version of Flash

UPDATE 1/22/2015: Adobe has released a partial patch for this vulnerability: KrebsonSecurity.com: Flash Patch Targets Zero Day Exploit

Adobe plans to release additional patches next week.

It is recommended that you install both the available update today, and future patches as they are released in the next week.

Adobe Flash Player Website

——–

Security researchers have discovered an new unpatched vulnerability in Adobe Flash Player that allows attackers to install malware onto a user’s computer. The malware is currently being used as part of the Angler exploit kit. When a user visits a malicious website the Angler exploit kit uses the vulnerability in Flash to install the Bedep malware. But criminals could use the exploit to install any type of malware.

To protect yourself:

Install and keep up to date your antivirus software. The NU community can get antivirus software for free.
Consider using Google Chrome to browse website that contain Flash and Flash advertisements
Disable Flash in Internet Explorer until a patch has been issued by Adobe
Install the vulnerability patch from Adobe when it becomes available.

Who is vulnerable?

Windows 8.1, IE 11 with Flash version 16.0.0.257
Windows 8, IE10 with Flash version 16.0.0.257
Windows 7, IE6-9, with Flash version 16.0.0.257
Windows XP, IE6 to 8 with Flash 16.0.0.257
Firefox version 35 with Flash version 16.0.0.257

Note: Flash Player versions up to 15.0.0.223 are also vulnerable.

Who is safe?

Google Chrome browser users.

More Information:

EXPLOIT FOR FLASH ZERO DAY APPEARS IN ANGLER EXPLOIT KIT

Unpatched Vulnerability (0day) in Flash Player is being exploited by Angler EK

Posted in Malware, Anti-Virus, Phishing, Scams | Comments closed

Start off 2015 Secure with Free Anti-Virus

computervirus
Welcome New and Returning Students!

The New Year promises an even higher number of virus and malware threats to your Mac and Windows computers. The ResNet Resource Center has a stack of Apples and PCs that are infected with viruses. Long gone are the days when Apple users are immune from viruses and malware. The viruses today attack both Macs and Windows with equal success and damage.

The only way to help protect your computer is to install anti-virus software. Fortunately Northeastern offers Symantec Endpoint Protection (anti-virus) for both Mac and Windows for FREE!

Download Symantec Endpoint Protection FREE today!

Why should you install anti-virus software?

The viruses today are much more dangerous than in the past; and may cause much irreversible damage such as:

  • Stealing your email password and hijacking your account
  • Stealing your social media passwords and hijacking your accounts
  • Stealing your personal information and photos
  • Encrypting and holding all your data hostage
  • Corrupting your operating system, making your computer unusable
  • Hijacking your computer to make it part of an international crime bot-net (not as cool as it sounds)

Wiping the computer and reinstalling the operating system from scratch is often the only way to remove the viruses. Do not be left without a computer or your data. Get FREE anti-virus software to help keep your computer safe and secure.

Contact the Service Desk at x4357 or the ResNet Resource Center for assistance.

Image credit: IntelFreePress, on Flickr

Posted in Malware, Anti-Virus, Phishing, Scams, Safe Computing | Comments closed

‘Tis the Season to be…WARY

SecureNU-logo-vsm-xmas

The holiday season is upon us, and you are probably shopping the never-ending sales that have been available since Halloween, especially online. More and more holiday money is being spent online, and this presents hackers and cyber-thieves a unique opportunity to rake in the cash – almost $800 million last year, according to the FBI.

To help protect your money and information, the FBI and other cyber-security watchdogs are highlighting the risks to those who will shop online, and we are taking this opportunity to share our Twelve Tips of Holiday Season Safety.

12. Hark the Herald Angels Sing: “Advertising wondrous things!”
While bargain hunting is great, there are many bogus websites created at this time of year in order to offer amazing bargains on brand-name things. If you see a discount from an unfamiliar online retailer that sounds too good to be true, it probably is. Don’t be tempted.

11. Randolph the Red-Nosed Reindeer
Another favorite trick of cyber-thieves is to use closely matching URLs to catch people who may mistype the address in their web browser. You were aiming for LLBean.com, but somehow you ended up at LBean.com, and instead of getting your flannel PJs, you now have malware on your computer. So type carefully, and pay attention to the addresses of the sites you’re visiting.

10. We Three Kings … All Use the Same Password
If you create an account at a merchant site, avoid using a username and password combination that you have used elsewhere, even if it is one deemed strong by a site you trust. While your banking site may be secure, small vendor sites are often not, and so are often targeted by criminals. If you have used the same username and password combination for your banking site, you just made someone’s Christmas.

9. It’s Beginning to Look a Lot Like….
“Your UPS delivery is on its way. Click here to see shipping details.” Actually, if you click here, you might see your computer infected with malware. Emails you receive detailing shipments you don’t recognize are often attempt to infect your computer with malicious code. Don’t trust shipping details links. The legitimate vendor will always email you a tracking number with your shipment notice – copy and paste the number into the shipping company’s webtracking page.

8. It’s the Gift that Keeps on Taking
Gift cards are a great stocking stuffer, because what’s better than being able to choose what you want to buy for the Holidays? But if you want to give that gift, make sure that you only purchase cards directly from the company or from a well-known retailer. Offers and deals online that claim to give you extra value above what is legitimately on the card are often scams, or possible stolen cards with no value.

7. All I Want … is for My Package to be Received
When you order from a legitimate retailer, try to ensure that your delivery will be at a date and time when someone will be home to receive it. You may also be able to submit a direct request to the shipping company to pick it up at one of their facilities (USPS, UPS, FedEx, and DHL all have the ability to do this online). Incidents of mail theft have quadrupled over the last two years, because knowing the number of deliveries at this time of year, thieves will tour neighborhoods looking for Amazon boxes and other packages left on your doorstep. While you do your shopping online, thieves are doing it at your front door.

6. On the Sixth Day … My True Love Gave to Me…An eCard with a Virus
“Oh look someone sent you an eCard, and it needs to install a new version of FlashViewer.” Most of the time when your computer is compromised, it is because of something that you clicked. Social engineering plays on human desires and social bonds to exploit trust, and ecards are a favorite scam. If you receive holiday ecards or messages from people you do not know, or receive any unexpectedly from people you do know, treat them with suspicion.

5. Dreidel, Dreidel, Dreidel…Public Wifi Just Won’t Play
While a lot of online shopping happens from home, more people than ever will use their mobile devices to price check or even purchase items while out and about. Make sure that your device is not using public wifi when you do anything involving passwords or payment cards unless you are using extra security, such as the Virtual Private Network client for both iOS and Android that is available to all Northeastern faculty and staff. Also don’t let your device automatically connect to unknown wifi, because rogue wifi with familiar names are an easy way for hackers to obtain your information. In the end, to be extra secure if you do want to make a purchase on your mobile device, double check that you are on a known and trusted network, or use your data access.

4. Oh There’s Nobody Home for the Holidays.
Posting on social media that you are at grandma’s house for the holidays, or skiing in Aspen, can be fun to share. However, it also lets people know that your home is empty, and someone might decide to do a little late season shopping while you are gone. Be careful about how many people are aware of your travel plans. Do you really know and trust all the friends or followers that you have on social media?

3. Making a List and Checking it Twice is Sound Advice
Know what you buy and where – make a list of your purchases and check it against your credit card statements when they come, or online when the transactions post. Take the time to ensure that your card isn’t being misused and that you have been charged what you expected to be charged by merchants. The sooner you can detect malicious activity, the easier it is to remedy. It’s also good to make sure you have contact information on file with your credit card companies, so they can contact you if they detect anomalous activity.

2. Blessings Might Come Back to Bite Good King Wenceslas
The holidays are a time for giving, and also, unfortunately, for taking. The number of charity scams increases exponentially during this time of year. If and when you decide to make a charitable donation, check that your donation will be going to the cause you wish it to, and that the highest ratio of your dollar goes to the charity instead of expenses. Use www.charitynavigator.org as a
reputable resource to ensure that your donation finds a good home. And never respond to unsolicited phone calls or door-to-door charity requests from unknown people.

1. It’s a Marshmallow World…Don’t Get Toasted
Many credit card companies offer the ability to create a one-time-use card number through their websites. Use these numbers to protect yourself should your retailer experience a data breach where customer names and card numbers are stolen. Most credit companies do not hold card holders accountable for theft, but doing this reduces the headache you can face in cleaning up the mess. Also, despite what many say about incurring debt at the holidays, avoid using your debit cards – they have less loss protection than credit cards.

Have a Safe and Happy Holiday!

Mark Nardone
CISO

Posted in Malware, Anti-Virus, Phishing, Scams, Safe Computing | Comments closed

Email Etiquette: Lessons from the Sony hack

sonyhack

This past month Sony Entertainment was hit with a massive hack from a group called the “Guardians of Peace” or #GOP. The #GOP recently released the first of a large number of internal documents and emails from Sony employees and executives.

Unfortunately for Sony, the leaked emails do not paint a flattering picture. The emails shine a light onto the sometimes-shady inner workings of a large entertainment company and removes the veneer of glitz and glamour that Hollywood public relations departments work so hard to maintain. The leaked emails show that Sony executives wrote emails to one another disparaging famous actors and writers, emails that contained racist comments about President Obama, and emails that referenced plans to pay off state attorney generals to encourage them to bring lawsuits against Google.

Embarrassing emails from highly paid executives may cause damage to the Sony brand and is fodder for Internet gossip. Unfortunately for the regular Sony employee, the email leaks reveal sensitive and personal information that can cause a great amount of individual suffering and embarrassment.

From gizmodo.com:

“The most painful stuff in the Sony cache is a doctor shopping for Ritalin. It’s an email about trying to get pregnant. It’s s***-talking coworkers behind their backs, and people’s credit card log-ins. It’s literally thousands of Social Security numbers laid bare. It’s even the harmless, mundane, trivial stuff that makes up any day’s email load that suddenly feels ugly and raw out in the open, a digital Babadook brought to life by a scorched earth cyberattack.”

These employees are at great risk for identity theft, medical and financial fraud, damage to their reputation, and the possible loss of future employment opportunities.

Lesson 1: Emails are never private

Once you send an email you no longer have control over its contents. There is nothing stopping the recipient from forwarding your email to others. ISPs and companies like Google, Microsoft, and Yahoo routinely scan and read customers’ emails for marketing and advertising purposes. Criminals using malware and phishing schemes could intercept your email and use it to commit fraud or other crimes. There are many ways your email could become exposed.

Always assume that what you write in email may become public.

Lesson 2: Don’t badmouth your coworkers

See Lesson 1. There is no guarantee that the contents of your email will stay private. Maintaining healthy business relationships is a key component for success in any profession. If word gets out that you talk about people behind their backs it will hinder your ability to collaborate successfully with your coworkers and future business interactions may be in jeopardy.

Even if the emails are not malicious in nature they could be taken out of context leading to misunderstandings. You cannot control how others will react to your leaked emails. “Information doesn’t have to be incriminating to be embarrassing; it doesn’t need intent to be cruel.”

Lesson 3: Keep work and personal emails separate

See Lesson 1 and 2. Many Sony employees used their corporate email for personal interactions. It is likely they did not think that the contents of their email would end up on the Internet. In many industries, such as finance, companies routinely search through employees’ email for signs of fraud and other criminal or insider activity, but they can read or use anything sent over company email servers. Organizations may have to turn over email as part of a civil or criminal subpoena or in response to open access laws. In these instances even if you have nothing criminal to hide, your personal communication could be read by others and possibly read aloud into the public court records.

Always use a non-work-related account for personal emails.

Lesson 4: Speak in person or use the phone

If this leak produces a teachable moment it is to take a moment to decide whether it’s better to talk in person or over the phone rather than to use email. Email does not communicate nuance, tone, or body language like a face to face conversation. This is especially true if the topic is sensitive or is related to personal matters such as health or personal finance. An in-person conversation offers a better opportunity for clear and meaningful communications and, unless you have eavesdroppers nearby, you can better control who hears your message.

Related Links:

Posted in Safe Computing | Comments closed

JPMorgan Chase and 9 Other Financial Institutions Hacked

JPMorgan Chase and nine other yet to be named financial institutions suffered a massive data breach targeting both individuals and businesses.   The attackers were able to steal client names, addresses, email, and phone numbers.  JPMorgan states that no financial and login information was compromised.

Clients are advised to watch out for phishing scams within the next couple of months.  It has been reported by the security company SANS that some customers are already receiving phishing SMS / text messages.

JPMorgan Chase suggest:

  • Users watch their accounts for suspicious activity
  • Change their account password
  • Do not reuse the same password for multiple accounts
  • Watch out for phishing emails

If you receive an email that asks for your login or other personal information call the company directly to verify the email.  Do not respond or click on any links in the email. Do not log into your bank account from a link in the email; type in the bank url directly into the web browser.

Do not respond or click on any links in unsolicited text messages from your financial institution.  Call the company directly to verify the contents of the text message.

Other Links:

NYTimes: Hackers’ Attack Cracked 10 Financial Firms in Major Assault.

Computerworld: JPMorgan Chase attackers hit other banks

 

Posted in Safe Computing | Comments closed