ITS: Google Drive Security Update

ITS would like to make you aware of a new Google Drive security update coming soon. 

Beginning on September 13, 2021 Google will be applying a new security update to some of your shared files. This means that if you have shared a file with someone and they have not yet opened it, after September 13th they will need to request access to it to view it. This may cause an increase in access requests. Those who have already viewed the files will still be able to.

To find out which files will be impacted you can follow these instructions. 

For questions or further assistance please contact ITS at its@manhattan.edu or 718-862-7973

Manhattan College ITS Statement - Unemployment Claim Fraud

Manhattan College has received some inquiries from our community with respect to the ongoing nationwide unemployment benefit fraud scam. Reports of unemployment fraud have been widely identified in neighboring states such as Massachusetts and Pennsylvania, and are now being reported in New York.

At this time, Manhattan College ITS has determined that none of its internal systems have been compromised and no intrusion has occurred. Our analysis has revealed that the data breach(s) resulting in the fraudulent unemployment claims are not associated with Manhattan College.

We are in contact with relevant data processing partners, however, we have not been informed to date of any breaches that would have exposed the personal information of Manhattan College employees as required by law.

If you believe that you are a victim of unemployment fraud, you should alert your state’s Department of Labor by following the U.S. Department of Labor's guidance. Manhattan College ITS also provides a summary of remediation steps.

Manhattan College ITS continues to actively monitor this situation. Protecting our community and their data from malicious activity is a top priority for ITS.

List of responses:

• NY State Department of Labor
• ADP

Extortion emails incoming!

Please be aware that extortion emails that include a hacked password are being reported. These messages will use the subject line to catch your attention by including your username along with a hacked password.
The extortion message follows a template.

I do know blahblahpassword is your password. Lets get directly to the point. You do not know me and you're most likely thinking why you're getting this mail? None has paid me to check about you.
Well, I setup a software on the porn site and do you know what, you visited this site to have fun (you know what I mean). When you were viewing videos, your web browser began functioning as a Remote Desktop that has a keylogger which provided me accessibility to your screen and web cam. Just after that, my software obtained all your contacts from your Messenger, social networks, and email.
You have just two choices. Let us read these types of options in particulars:
Very first solution is to skip this message. In this case, I most certainly will send your very own video clip to almost all of your contacts and thus just think concerning the disgrace you will get. Moreover if you happen to be in a relationship, exactly how it is going to affect?
Second alternative will be to give me $7000. I will think of it as a donation. As a consequence, I most certainly will quickly discard your video footage. You could resume your daily life like this never occurred and you surely will never hear back again from me.
You will make the payment through Bitcoin (if you don't know this, search "how to buy bitcoin" in Google search engine).
Should you are planning on going to the cop, anyway, this email message can not be traced back to me. I have covered my actions. I am just not looking to charge a fee so much, I just want to be compensated. You have one day in order to make the payment. I've a unique pixel within this mail, and now I know that you have read this email message. If I do not receive the BitCoins, I will certainly send your video to all of your contacts including close relatives, colleagues, and so on. Nonetheless, if I receive the payment, I'll destroy the recording right away. If you need evidence, reply Yea and I will certainly send your video to your 7 contacts. It is a non-negotiable offer, therefore please do not waste my personal time & yours by responding to this email.

By including a valid password, the extortionist aims to establish legitimacy. A few of the details are technically possible such as an RDP attack or recording from the webcam.
If the extortionist had done any of this then, they would name the specific porn site or provide images from the webcam.
If you receive this message, please do the following:

• immediately change your password for any site where you used the hacked password;
• send its@manhattan.edu the extortion message including the full headers using these directions;
• and, sign up for data breach notifications at haveibeenpwned.com by clicking the "Notify me" link at the top of the page.

Additionally if you receive this type of message you can report it to the FBI using Internet Crime Complaint Center website.
Thankfully, this is appears to be an automated message using email addresses and hacked passwords. But if the extortionists were assiduous then, they would include pictures from social media accounts or from friends' social media accounts.
Sextortion is a horrible crime. The FBI's sextortion news page shows a sample of how awful it can be. If a loved one is a victim of sextortion please report it to the FBI 1-800-CALL-FBI (1-800-225-5324).

Mac Users Take Note Take Immediate Action to Plug Security Hole

Update 2:52PM Thursday November 29, 2017:
Apple has released an update that fixes this vulnerability.  Please update your Mac ASAP.
Here is the information regarding the update.


A security hole was recently discovered in the latest version of Mac OS X High Sierra which allows for anyone to access your computer without a password.  We have provided a link to a USA Today article below, but there are many articles on the web reporting this issue.  While Apple is working on a fix via update, you should take immediate action to fix the issue by following the instructions here.  Basically, all you need to do is set a Root User password so please navigate to those instructions in the aforementioned link.  If you need further assistance, please contact its@manhattan.edu.

USA Today Article

WARNING: Phishing Attacks Have Started Again

Around 1:16 PM today an email was sent out from 'robert.damato@manhattan.edu' that looked like the image below:

EXAMPLE OF A PHISHING SCAM

The email from 'robert.damato@manhattan.edu' is a phishing scam and you should delete it immediately. Do not click on any links in the email. As with most  messages, the message contained a generic warning about spam and updating a spam filter.  
If you receive a message that asks you to  click on an unknown link or suspicious attachment, DO NOT OPEN the link or attachment. Instead, please verify authenticity with ITS  by forwarding the message to ITS@manhattan.edu. 

If you are worried that your account has been compromised, please go through Google's account Security Checkup:

https://security.google.com/settings/security/secureaccount

As always, be careful what you click!

Attention Malmart Shoppers

Wondering how to protect against malware? Use an adblocker such as uBlock Origin (Firefox or Chrome).

What do ads have to do with malware? Spreading malware through ad networks is called malvertising. No need to pinch your arm. This nightmare is real.

Years ago, NSFW websites would normally infect computers. Eventually, an upwardly mobile malware author noticed that ad networks trusted by MSN, the New York Times, the BBC, Newsweek, etc. would be a more profitable.

Just this year, many trusted news sites[1][2] allowed malvertising to be offered to browsers running on top of the Windows OS. The result could be a ransomware installation, specifically TeslaCrypt, or a trojan horse installation, named Bedep Trojan, that would allow criminals to use all the infected computers as part of a botnet.

The tool that decides which malware to install is called the Angler Exploit Kit. It is the tool behind many computer crimes. Criminal gangs sell it on the Internet, hopefully you (dear reader) do not know where.

Be mindful of where you go and if random ads should execute on your devices.

---

References:

1. "BBC, MSN hit by malicious ad attack". BBC. Retrieved 2016-03-18.
2. "Big-name sites hit by rash of malicious ads spreading crypto ransomware". Ars Technica. Retrieved 2016-03-18.

New VPN Software Being Deployed

In September of 2015 ITS began internally testing our next generation VPN solution to replace the outdated installation we have been using for quite some time.

After lengthy testing we have selected and started deploying the industry standard OpenVpn solution on PFSense hardware to the Manhattan College Community. Several factors led us to this decision:

• OpenVPN is a secure and trusted solution offering reliable service and encryption.
• Ease of configuration. 
• All configuration is contained in one file that can be imported by your client. There is no longer a need to know esoteric jargon to get vpn working. 
• Reliable cross platform clients. 
• We have successfully tested OpenVpn clients on all supported versions of MS Windows, OSX, IOS and Android as well as several versions of Linux. 
• Extremely cost effective redundant hardware option makes the platform more reliable during operation and allows for more efficient upgrading with near zero downtime. 

Some members of the community have already been contacted and upgraded to our new VPN, if you have not please send an email to ITS@manhattan.edu and request an upgrade.

The older VPN will no longer be accessible after May 31 2016.

Dell Certificate Blunder

ITS is aware of the recent Dell certificate blunder.  Dell's official solution is already running as a background process on all impacted Dell computers since November 24th.

Please remember to always practice safe web surfing.  This means avoiding untrustworthy websites, never download & execute random programs, know who uses your computer, etc.

As always contact ITS, its@manhattan.edu, with your IT concerns.

Coming Soon... Updates to JasperNet Signon Page

Changes are coming to the JasperNet Single Signon (SSO) page.  The first thing that users will notice is a more streamlined design that will now include a preview of featured campus events as well as important notifications.  In addition to the new design, a number of underlying security enhancements will be included to help prevent "phishing" attempts and provide a more secure experience.

Updates will be rolled out gradually throughout the week of 10/12.  As a result, you may see both the old and the new login page while we transition JasperNet services from the old page to the new page.

If you've accessed any of our TEST environments since August,  you've already been using the new page!

Be on the lookout for additional announcements in the coming days!!

Phishing attacks on the Rise

Manhattan College ITS has seen a rising trend in the number and complexity of phishing attacks reported.  To raise awareness of this alarming trend, the following information is being reposted from the Google Online Security Blog.

A recent poll in the U.S. showed that more people are concerned about being hacked than having their house robbed. That’s why we continue to work hard to keep Google accounts secure. Our defenses keep most bad actors out, and we’ve reduced hijackings by more than 99% over the last few years.

We monitor many potential threats, from mass hijackings (typically used to send lots of spam) to state-sponsored attacks (highly targeted, often with political motivations).

This week, we’re releasing a study of another kind of threat we’ve dubbed “manual hijacking,” in which professional attackers spend considerable time exploiting a single victim’s account, often causing financial losses. Even though they’re rare—9 incidents per million users per day—they’re often severe, and studying this type of hijacker has helped us improve our defenses against all types of hijacking.

Manual hijackers often get into accounts through phishing: sending deceptive messages meant to trick you into handing over your username, password, and other personal info. For this study, we analyzed several sources of phishing messages and websites, observing both how hijackers operate and what sensitive information they seek out once they gain control of an account. Here are some of our findings:

• Simple but dangerous: Most of us think we’re too smart to fall for phishing, but our research found some fake websites worked a whopping 45% of the time. On average, people visiting the fake pages submitted their info 14% of the time, and even the most obviously fake sites still managed to deceive 3% of people. Considering that an attacker can send out millions of messages, these success rates are nothing to sneeze at.

• Quick and thorough: Around 20% of hijacked accounts are accessed within 30 minutes of a hacker obtaining the login info. Once they’ve broken into an account they want to exploit, hijackers spend more than 20 minutes inside, often changing the password to lock out the true owner, searching for other account details (like your bank, or social media accounts), and scamming new victims.

• Personalized and targeted: Hijackers then send phishing emails from the victim’s account to everyone in his or her address book. Since your friends and family think the email comes from you, these emails can be very effective. People in the contact list of hijacked accounts are 36 times more likely to be hijacked themselves. 

• Learning fast: Hijackers quickly change their tactics to adapt to new security measures. For example, after we started asking people to answer questions (like “which city do you login from most often?”) when logging in from a suspicious location or device, hijackers almost immediately started phishing for the answers.

We’ve used the findings from this study, along with our ongoing research efforts, to improve the many account security systems we have in place. But we can use your help too.

• Stay vigilant: Gmail blocks the vast majority of spam and phishing emails, but be wary of messages asking for login information or other personal data. Never reply to these messages; instead, report them to us. When in doubt, visit websites directly (not through a link in an email) to review or update account information.

• Get your account back fast: If your account is ever at risk, it’s important that we have a way to get in touch with you and confirm your ownership. That’s why we strongly recommend you provide a backup phone number or a secondary email address (but make sure that email account uses a strong password and is kept up to date so it’s not released due to inactivity).

• 2-step verification: Our free 2-step verification service provides an extra layer of security against all types of account hijacking. In addition to your password, you’ll use your phone to prove you’re really you. We also recently added an option to log in with a physical USB device.

Take a few minutes and visit the Secure Your Account page, where you can make sure we’ve got backup contact info for you and confirm that your other security settings are up to date.

Posted by Elie Bursztein, Anti-Abuse Research Lead

Reposted from the Google Online Security Blog:  http://googleonlinesecurity.blogspot.com/2014/11/behind-enemy-lines-in-our-war-against.html

SSLv3 POODLE Vulnerability

 

October 14th, 2014, Google security researchers have disclosed a new vulnerability regarding the SSL protocol. Fortunately, this vulnerability only impacts the 1996 version of SSL, SSLv3.

What's SSL?

It is the standard security technology for an encrypted link between a web server and a web browser.

Browsers display a lock icon if communication is encrypted.

What's the POODLE vulnerability?

An attacker could exploit a seemingly encrypted link between a web server and a web browser such that the attacker could read private data.  For example, when passing username and password credentials to a web server.

More information:

http://googleonlinesecurity.blogspot.fr/2014/10/this-poodle-bites-exploiting-ssl-30.html

How can we fix this?

ITS will be disabling SSLv3. Be aware that web servers that the College does not own (e.g., example.com, yahoo.com, etc.), might be vulnerable.

What uses SSLv3?

Microsoft Internet Explorer 6.0, which is an unsupported version of Internet Explorer.