Happy National Cyber Security Awareness Month!

October is always a special time around our offices, not because of Fall weather or Halloween, but because we once again get to revel in National Cyber Security Awareness Month!

In the past year, the threats to your personal cyber security have increased, becoming more sophisticated. Recently, 10,000 Hotmail account names and passwords were posted on a public website after having been obtained through phishing attempts or via data received from keylogging programs (software surreptitiously installed on computers that records and reports your keystrokes).

Thousands of other account names and passwords from AOL, Yahoo! and Gmail accounts were posted on other websites as well, the data again captured under false pretenses.

Each year, a handful of Boise State email account owners still respond to phishing attempts by unwittingly divulging their personal information as a result of responding to junk email messages or being lured to malicious websites by malware (malicious software) embedded in web pages stumbled across while surfing the internet.

Just in the past couple of days the Help Desk has received numerous queries from employees concerned about the following phishing email that has circulated to many University email addresses:

Dear Email user,

This message is from Administration centre Maintenance Policy verified that your mailbox exceeds its limit, you will be unable to receive new email, To re-set your  SPACE on our database prior to maintain your INBOX, you must click the link below.

Click Here: https://secure.bluoctane.cyk//S8KBDHHDS4

(If the link above does not appear clickable or does not open a browser window when you click it, copy it and paste it into your web browser’s Location bar.)Thank you for your cooperation.
Admin Help Desk

Your first clue this type of email is not from the OIT Help Desk should be that we don’t employ ten-year olds from England to write our communications. The second clue is the email is from a non-University address. Your third clue should be being asked to click to a website not affiliated with the University.

We did appreciate the number of people who forwarded this email to us out of concern for other people who may not have realized it was fake, along with those individuals who solicited our advice because they were unsure if the email was legitimate. Gmail will often place a banner at the top of emails it believes are phishing emails:

Along with phishing emails, one of the most successful recent purveyors of cyber insecurity has been the fake “your computer has been infected by a virus – click here for free antivirus tools!” type of pop-up message that appears while you’re on the web:

The infamous AV2009 scam from 2008

I came across a particularly interesting example of this type of malware propagation last month while visiting the New York Times website on a quiet Sunday afternoon. I noticed a blurb on the site referencing a malware pop-up notice originating from an advertiser the Times had contracted with:

It initially seemed odd to me that the Times hadn’t been able to block this advertisement by the time they reported on it.  A few minutes later the pop-up appeared on my screen, which directed my computer to a fake page showing a depiction of a Microsoft Windows “My Computer” screen purportedly proving my computer was infected with a virus (all the more ironic as I was using a Mac):

It turned out the Times (one of the most popular websites on the planet) had been duped by an advertiser and was being used as a conduit to spread malware for an extended period of time before the Times website staff was able to put a halt to the offending ad. The company posted a full explanation the following day. However, an unknown but likely substantial number of web browsers had already been “taken over” by the malware ad, proving even websites with good security reputations can’t always be relied upon for safe browsing.

What can you do to protect yourself? We’ve detailed safe computing tips and behaviors many times before, but what it really comes down to is using common sense:

• Don’t trust a website to tell you your computer is infected with a virus.
• Always run current, valid antivirus software on your computer (University faculty and staff are eligible for free antivirus software).
• Never respond to requests via email for personal data.
• If a pop-up window or other browser window appears asking you to click on something unrelated to the site you’re viewing, do not click on it just to make it “go away.” Instead, close your browser if necessary. If the problem continues, consult your desktop support staff.

For more safe computing cyber security tips, visit staysafeonline.org