News – Information Technology Services https://brocku.ca/information-technology/news/ Fri, 15 Nov 2019 20:01:02 +0000 en-CA hourly 1 Brock ITS cybersecurity improvements coming Nov. 13 https://brocku.ca/information-technology/2019/11/01/brock-its-cybersecurity-improvements-coming-nov-13/ Fri, 01 Nov 2019 19:33:20 +0000 http://brocku.ca/information-technology/?p=6794 Cybersecurity attacks are increasing at an alarming rate at higher education institutions, and Brock University is no exception.

In an effort to mitigate these attacks, Brock Information Technology Services (ITS) is implementing three new security initiatives. Beginning Wednesday, Nov. 13, faculty, staff and students can expect changes to the way they login to the Brock portal (my.brocku.ca), how they change and reset campus ID passwords, and the complexity requirements for passwords.

The most noticeable change will be a new login page for my.brocku.ca. To access the portal, users will be redirected to the familiar-looking Office 365 login page. Hyperlinks that existed on the portal, such as how students, applicants and employees activate accounts or access tutorials and resources, will be transferred to a new page accessible from the new login page.

Also moving to Office 365 will be the locations to change campus passwords and access to the self-service password reset function. Instead of going to my.brocku.ca to change a password, faculty, staff and students will login to Office 365 and then select their photo or initials at the top right of the page. They then select my accountsecurity and privacy and then password. People who have Brock accounts but are not faculty, staff or students — such as Board of Trustees members, vendors and visiting scholars and visiting students — will continue to change their passwords in my.brocku.ca

The self-service password reset process will be moved from my.brocku.ca to passwordreset.microsoftonline.com

In the past, self-service password reset has been mandatory for students, but only voluntary for faculty and staff. Going forward, anyone with a Brock campus login will now be required to set up preferences for self-service password reset. The next time a user logs in to Office 365 after Nov. 13, they will be prompted to supply a phone number, an alternate email address or personal security questions that will be used to prove their identity. When a password is reset, users may experience a 10-minute delay for some services.

The final changes taking place will involve the passwords themselves. Users will not be able to use certain words to create their passwords, and the length of passwords will change from eight to 10 characters.

“The more characters the password contains, the more difficult it is for hackers to guess,” said Andy Morgan, Director, Client Services.

Examples of words on the prohibited passwords list include abcdefg, badger, brock, iloveyou, letmein, password, whatever, qwerty and surgite. Former passwords, as well as iterations of prohibited words, will not be accepted. Examples Br0ck!, What3v3r and p@$$w0rd.

Users are not required to change their passwords on Nov.13; they can wait until their password expires.

For more information about these changes and to consult job aids, visit brocku.ca/its

]]>
Phishing Attempt Subject: Payroll Calender https://brocku.ca/information-technology/2019/10/10/recent-phishing-attempt-payroll-calender/ Thu, 10 Oct 2019 15:55:51 +0000 http://brocku.ca/information-technology/?p=6575 The email below is an example of a Phishing Attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

Please note that Brock will never send emails asking for your personal information.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the service desk at x4357 or email us at itsecurity@brocku.ca

Phishing Email: 

From: Brock University <payroll@brocku.ca>
Sent: Wednesday, October 9, 2019 12:23 PM
Subject: Payroll Calender

 

Dear Member

You new payroll schedule calendar for 2019/20 is now available for your approval.

Payroll-19/20.pdf

Approval will be permanent within the next 48hours.

Best Regards,
Brock University

]]>
Phishing Attempt Subject: Alerte de sécurité! https://brocku.ca/information-technology/2019/02/14/recent-phishing-attempt-subject-alerte-de-securite/ Thu, 14 Feb 2019 15:39:29 +0000 http://brocku.ca/information-technology/?p=4869 The email below is an example of a Phishing Attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

Please note that Brock will never send emails asking for your personal information.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the service desk at x4357 or email us at itsecurity@brocku.ca

Phishing Email: 

Je vous salue!

J’ai de mauvaises nouvelles pour vous.
10/11/2018 – ce jour-là, j’ai piraté votre système d’exploitation et obtenu un accès complet à votre compte à partir: xxxxx@brocku.ca

Pas la peine de changer le mot de passe, mon logiciel malveillant l’intercepte à chaque fois.

Comment c’était:
Le logiciel du routeur auquel vous étiez connecté ce jour-là comportait une vulnérabilité.
J’ai d’abord piraté ce routeur et y ai placé mon code malveillant.
Lorsque vous êtes entré sur Internet, mon cheval de Troie était installé sur le système d’exploitation de votre appareil.

Après cela, j’ai effectué une sauvegarde complète de votre disque (j’ai tout votre carnet d’adresses,
l’historique des sites de visionnage, tous les fichiers, les numéros de téléphone et les adresses de tous vos contacts).

Il y a un mois, je voulais verrouiller votre appareil et demander un peu d’argent pour le déverrouiller.
Mais j’ai jeté un œil sur les sites que vous visitez régulièrement, et j’ai eu grand plaisir à voir vos ressources préférées.
Je parle de sites pour adultes.

Je veux dire – tu es un grand pervers. Vous avez une fantaisie débridée!

Après cela, une idée m’est venue à l’esprit.
J’ai fait une capture d’écran du site Web intimeoù vous contentez-vous (Comprends-tu ce que je veux dire?).
Après cela, j’ai fait une vidéo de votre plaisir (en utilisant la caméra de votre appareil). Il s’est avéré magnifique!

Je suis fermement convaincu que vous ne voudriez pas montrer ces photos à vos parents, amis ou collègues.
Je pense que 304€ est une très petite somme pour mon silence.
En plus, j’ai passé beaucoup de temps sur toi!

J’accepte de l’argent uniquement en Bitcoins.
Mon portefeuille BTC: 12EMAbSboa1nvg518vcjvogSL4aDwaUCv9

Vous ne savez pas comment reconstituer un portefeuille Bitcoin?
Dans n’importe quel moteur de recherche, écrivez “comment envoyer de l’argent à un portefeuille de la BTC”.
C’est plus facile que d’envoyer de l’argent à une carte de crédit!

Pour le paiement, vous avez un peu plus de deux jours (exactement 50 heures).
Ne vous inquiétez pas, la minuterie commencera au moment où vous ouvrez cette lettre. Oui, oui .. cela a déjà commencé!

Après paiement, mon virus et vos photos sales avec vous s’autodétruisent automatiquement.
Si je ne reçois pas le montant spécifié de votre part, votre appareil sera bloqué et tous vos contacts recevront une photo avec vos “joies”.

Je veux que tu sois prudent.
– N’essayez pas de trouver et de détruire mon virus! (Toutes vos données sont déjà téléchargées sur un serveur distant)
– N’essayez pas de me contacter (ce n’est pas faisable, je vous ai envoyé un email depuis votre compte)
– Divers services de sécurité ne vous aideront pas. formater un disque ou détruire un périphérique ne vous aidera pas non plus, puisque vos données sont déjà sur un serveur distant.

P.S. Je vous garantis que je ne vous dérangerai plus après le paiement, car vous n’êtes pas ma seule victime.
C’est un code d’honneur des hackers.

À partir de maintenant, je vous conseille d’utiliser de bons antivirus et de les mettre à jour régulièrement (plusieurs fois par jour)!

Ne soyez pas en colère contre moi, tout le monde a son propre travail.
Adieu.

]]>
Cyber Security Awareness Workshop – Mobile Devices – Android https://brocku.ca/information-technology/2019/02/07/cyber-security-awareness-workshop-mobile-devices-android/ Thu, 07 Feb 2019 21:14:07 +0000 http://brocku.ca/information-technology/?p=4855 Mobile devices contain a wealth of information.

They document children’s milestones, store YouTube and Netflix viewing histories, keep track of locations, and remember credit card numbers, banking information and passwords.

If not properly protected, this sensitive information can be stolen and used by cybercriminals for personal gain.

Information Technology Services’ latest cyber security workshop will discuss Android mobile devices and how to safeguard them. Senior System Administrator Brad Saxton will offer easy steps to secure Android devices and their data, review key differences between Androids and iPhones, and discuss how to safely install mobile applications.

When: November 13, 2019 (10:00am – 10:30am)

Where: Computer Commons Training Room

Capacity: 20

To register for this workshop, visit Focus on Learning.

]]>
Phishing Attempt Subject: Account Problem https://brocku.ca/information-technology/2019/02/04/recent-phishing-attempt-subject-account-problem/ Mon, 04 Feb 2019 14:29:54 +0000 http://brocku.ca/information-technology/?p=4842 The email below is an example of a phishing attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the Help Desk at x4357 or email us at itsecurity@brocku.ca.

 

Phishing Email:

Yоu mау nоt know me and уоu аrе prоbablу wоndering why you arе gеtting this е mаil, right?
I’m а haсkеr whо cracked your dеvices a fеw mоnths аgо.
I sеnt you аn emаil frоm YOUR haсkеd аcсount.
I setup a mаlwаre оn the аdult vids (pornо) web-sitе and guess whаt, you visited this site to hаve fun (yоu know what I mean).
While уоu were wаtching vidеоs, уоur internet brоwser stаrtеd оut functioning аs а RDP (Rеmote Control) having a kеуloggеr which gаve me аccеssibility to yоur scrееn аnd web cam.
aftеr thаt, mу softwаre prоgrаm оbtainеd аll оf your соntасts and files.

Yоu еntеred а passwоrds on thе wеbsites yоu visited, and I intеrсеpted it.

Of cоurse уou сan will change it, оr alrеadу сhаnged it.
But it doesn’t matter, mу malwarе updatеd it everу timе.

What did I do?
I crеаtеd а double-sсrееn video. 1st part shоws the vidеo уou werе watching (yоu’vе got a gооd taste hahа . . .), аnd 2nd part shоws the recоrding оf yоur wеb саm.
Dо nоt try to find аnd dеstroу my virus! (All yоur dаta is аlready uploаdеd tо a rеmоtе sеrvеr)
– Do not try tо сontаct with me
– Vаrious sесurity sеrviсеs will not help уоu; formаtting а disk or dеstrоуing а dеvicе will nоt hеlp еithеr, sinсе yоur dаta is аlreadу on а remоte server.

I guаrаnteе yоu that I will not disturb you аgаin after paуment, as you аre nоt mу single viсtim. This is a hасkеr codе of honor.

Don’t be mad at mе, evеrуone has their оwn work.
eхaсtly whаt shоuld уou do?

Well, in my opinion, $695 (USD) is a fаir price for our littlе secrеt. Yоu’ll mаke the payment bу Bitсоin (if уоu do not know this, sеаrсh “hоw to buу bitcoin” in Gоoglе).

Mу Bitсоin wallеt Addrеss:

1FVz43GH5s4Ja7SNHxRbCXz6KLXG1ggFh3

(It is сAsE sеnsitivе, sо copy аnd pаstе it)

Impоrtаnt:
You hаvе 48 hour in order to makе thе pауmеnt. (I’ve а fасebook pixel in this mail, аnd at this moment I knоw thаt уоu hаve reаd through this еmаil messаgе).
Tо traсk the reading оf а messаge аnd the аctiоns in it, I use the fаcebook pixеl.
Thanks to thеm. (Everything that is used for thе аuthorities сan hеlp us.)
If I dо nоt gеt the BitCoins, I will сertаinlу sеnd out yоur vidео recording to all of уоur cоntaсts including relаtives, cоworkers, and sо on. Hаving sаid thаt, if I receive thе pауment, I’ll dеstroу thе vidеo immidiаtеlу.
If you nееd еvidеnce, rеplу with “Yеs!” and I will сertаinly sеnd оut your vidеo reсоrding tо your 6 сontаcts. It is а non-negotiablе offеr, that bеing sаid dоn’t waste my personаl time and уours bу responding tо this mеssage.

]]>
Phishing Attempt Subject: Expense https://brocku.ca/information-technology/2018/11/19/recent-phishing-attempt-subject-expense/ Mon, 19 Nov 2018 17:32:55 +0000 http://brocku.ca/information-technology/?p=4660 The email below is an example of a Phishing Attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

Please note that Brock will never send emails asking for your personal information.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the service desk at x4357 or email us at itsecurity@brocku.ca

Phishing Email: 

From: T*****n <executive.mails@earthlink.net>
Sent: November-19-18 10:39 AM
Subject: Expense

Hi,

Are you available? I need you to get something done for me ASAP.

Regards,

This email appears to be sent from a person known to the department. After replying to the above email this arrives:

Hi,

I am looking forward to surprise some of the staffs with Apple iTunes Gift Card. I want you to keep it between us pending when they get it. So therefore, I need Apple iTunes Gift Card of $100 face value each. I need 25 pieces of it amounting to $2500. I need you to get the physical card, then you scratch the back out and take a picture of them, attach the pictures showing the pin and email it to me. How soon can you get this done?

Regards,

 

 

 

]]>
https://brocku.ca/information-technology/wp-content/uploads/sites/56/CyberSecurity-ThinkLogo-400x300.png Beware of Phishing! https://brocku.ca/information-technology/2018/10/18/beware-of-phishing/ Thu, 18 Oct 2018 13:17:11 +0000 http://brocku.ca/information-technology/?p=4549 Think

During national cyber security awareness month, we would like to remind Brock to be vigilant when responding to emails or clicking on links contained within.

It has recently been brought to our attention that a seemingly innocent email has been received by faculty and staff simply asking, “Are you available?” from a sender name known to the department. However, this is a phishing email and if you respond you will soon receive a follow up asking for iTunes gift card codes to be sent.

Don’t take the bait. To identify suspected phishing emails:

  • Check that both the sender name and reply to email address are what you expected to see before responding. From addresses/sender names are easily forged and can look like the message came from someone you know.
  • Click only on links that you are expecting.
  • Hover your mouse over a suspicious link to see the true destination without having to click on it.
  • Grammar and spelling errors can indicate a phishing email.

Learn more about Phishing and Social Engineering on the ITS Cyber Security website. You can also view recent examples of phishing emails received at Brock here.

If you are concerned that you may have fallen victim to a phishing email contact the Help Desk at x4357 or email us at itsecurity@brocku.ca

]]>
Phishing Attempt Subject: Hello https://brocku.ca/information-technology/2018/10/17/recent-phishing-attempt-subject-hello/ Wed, 17 Oct 2018 20:05:56 +0000 http://brocku.ca/information-technology/?p=4547 The email below is an example of a Phishing Attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

Please note that Brock will never send emails asking for your personal information.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the service desk at x4357 or email us at itsecurity@brocku.ca

Phishing Email: 

From: P*****s <p***********@gmail.com>
Sent: Tuesday, October 16, 2018 6:36 PM
Subject: Hello

 

Are you available?

If you respond to this message, you will receive a followup email requesting iTune gift cards.
]]>
Phishing Attempt Subject: Attached CV https://brocku.ca/information-technology/2018/10/10/recent-phishing-attempt-subject-attached-cv/ Wed, 10 Oct 2018 17:03:57 +0000 http://brocku.ca/information-technology/?p=4507 The email below is an example of a Phishing Attempt that was received by users on campus. If you’ve received this email, do not click on any of the contained links and delete it from your inbox.

Please note that Brock will never send emails asking for your personal information.

If you identify an email you think is a phishing attack, or you are concerned you may have fallen victim, contact the service desk at x4357 or email us at itsecurity@brocku.ca

Phishing Email: 

From: Jani E****
Subject: Attached CV
Date: October 10, 2018 at 8:14:48 AM MST

 

How are you doing?

I’m interested in applying.

I have attached my Resume for your viewing.

The password for the file is 1234

Please see the attached file.

Thanks.

]]>
Brock Campus ID and password not to be shared https://brocku.ca/information-technology/2018/10/09/brock-campus-id-and-password-not-to-be-shared/ Tue, 09 Oct 2018 17:46:37 +0000 http://brocku.ca/information-technology/?p=4489 A Brock University Campus ID and password is for the exclusive use of the account owner and must not be shared under any circumstances.

The following is an excerpt from the End User Logical Access Standards found at “https://brocku.ca/policies/wp-content/uploads/sites/94/End-User-Logical-Access-Standards.pdf

“A user account, which allows a user to access Brock IT systems and data, is provided to an individual for their exclusive use. A user is prohibited from sharing their account(s) and / or password(s) with others. An authorized user is at all times responsible and accountable for the use of their account.”

]]>