Reeling 'em In
-- Spear Phishing by Jill Reese |
||||||||||||||
“I’m an important official. Give me your password and
name as soon as possible to prove your usage, or your account will
be deactivated to reclaim the space on the server.” “Your recent bank statement is now available. Please log in
here to check it.” “Thank you for your interest in our Mystery Shopping program.
Simply fill out this form and we will pay you for your purchases!” “Thank you for your recent purchase. If you did not order this
merchandise, please click here to log in and dispute the charges.”
These are all examples of “spear phishing” con messages
sent in e-mail. Spear phishing customizes requests for personal information
in many ways, ranging from clumsy misspelled text messages to very
sophisticated messages using actual graphics from targeted sites,
names of officials, and wording combed from Web pages. If you respond
to any of these tactics, even just replying with a “remove me
from your list” or an insult to the spammer, potential consequences
vary from having your e-mail address sold on marketing lists to having
your account hijacked and used to send spam and spear phishing messages.
You might also become a victim of identity theft. |
When you get a phishing message, just delete it. If you respond
with your user name or password or if you click links or open attachments
in a spear phishing e-mail, pop-up window, or Web site, you could
also cause service disruptions on the university e-mail servers. Since
April 2008, more than 100 compromised accounts caused 90 days of service
disruption when other Internet Service Providers blocked university
e-mail servers because the servers were sending out mass mailings
of spam. When debating whether or not to respond to a message, remember this:
e-mail is not a secure form of transport. Think of an e-mail message
as a postcard with your message written on the back and shipped openly
through many sets of hands before reaching its destination. Would
you want your password, Social Security Number, or any other important
personal information passed along in that manner? No! Then don’t
send it. Period.
|
|||||||||||||
|
There will soon be a new online resource you can use to receive assistance
from the OIT Help Desk. Scheduled for release this spring, the IT
Service Center will give you a way to request help or service online
24 hours a day. The new system will let you track your help request
status online and will keep a history of your requests. The KnowledgeBase,
a database of information about common IT tasks, will also be available
for you to search for self-help instructions. You will be able to contact the OIT Help Desk in the usual ways,
as well: walk in to room 1400 Computer and Space Sciences or call
301.405.1400 (x51400 on campus). The new online service will be an
additional option for getting your help request started, even outside
of the Help Desk’s normal operating hours. Watch the OIT Web page (www.oit.umd.edu) and the Help Desk site (http://helpdesk.umd.edu)
for details and release dates. |
|||||||||||||
Once
the spammer has your password, there are numerous scams that can be
implemented against your good name and credit. It is practically guaranteed
that the name and password combination will be tried at many popular
online shopping and banking sites.
 
TechKnow
is the Information Technology Newsletter for University of Maryland
students, published by the Office of
Information Technology. Letters to the editor and story suggestions
are welcome. Please send correspondence to TechKnow@umd.edu.
© 2009 University of Maryland. |