ITS News

"Webmail" phishing scam targeting NYU community

2009-11-18T15:54:54Z

There are new reports about a sophisticated phishing message that purports to come from "New York University District Information technology Service ( ITS )". The message claims that ITS is "undertaking some essential, but extensive, maintenance to improve our webmail this week" and requests your password, name, and other personal information to avoid shutting down your NYU email account. The fraudulent message requests that the recipient reply back to non-NYU email accounts, and in this case, a "@upgrade.com" and "@yahoo.com" email addresses.

]]> NYU community members should NEVER REPLY TO ANY email that requests the recipient's email login name and password. Instead, forward phishing messages as an attachment to our email filtering account phishing@nyu.edu. Doing so trains our email filters to prevent such types of spam from arriving into inboxes.

Please note: It is very important to forward the message as an attachment, otherwise our email filters will not be able to parse through the message correctly.

As a reminder of better security practices, always remember that:

No NYU community member will ever ask for your account password, especially not over email.
Do not reply back to emails from unidentified, untrusted sources.
Forward all phishing messages as an attachment to phishing@nyu.edu. This helps train our email filters to block such messages in the future.
Messages that request personal information over plaintext email should be regarded as being suspicious. If it is spam, forward it to is.spam@nyu.edu. When in doubt, do not reply and contact security@nyu.edu.
If a message informs you of an impending "account closure" unless you comply with its demands, it is often a sign that the message is a phishing scam. Do not comply with its requests.

The following sites also provide several useful tips on defending against these types of phishing attacks:

Example

Attention,

New York University District Information technology Service ( ITS )wishes to inform you that we are undertaking some essential, but extensive, maintenance to improve our webmail this weekend. The maintenance is part of our ongoing efforts to give you the best Mail service we can.The need to be updated as part of our continuing commitment is to protect your account and to reduce the instance of spam mails on our webmail stream.

Beginning the end of Monday 17th November (PDT) you may experience problems accessing your webmail account.To avoid your account been affected,Due to this, to ensure that your service is not interrupted, we request you to confirm and update your webmail details as required below..Username(__________)Password(_________) Date of Birth(_____) to prevent poor performance, it should be available again by midday Wednesday 28th November (PDT).

We sincerely apologize for this inconvenience.

::::New York University::::
Mail Technical Services
https://mail.nyu.edu/

NB: We request your user name and password for Identification purpose only.Thanks for confirming your Webmail details as Upgrade process is been carried out by the ITS web team.....

NYU targeted by "Toner Phoner" scam

2009-10-02T16:56:10Z

There are reports of phone scammers targeting NYU, wherein a bogus "copy toner" supply company claims that they need to send the department an invoice for unpaid charges. The caller may ask the model of the department's copier so that they can 'update their records.' Moreover, their phone numbers come in as private.

This phone scam is particularly disconcerting because the caller often refers to other legitimate employees in the same department, to bolster the validity of the ruse. Oftentimes, the scammer is preying on reaching a temp, or someone new who will give up a name to the scammer so they can send an invoice or, even better, agree to a shipment. After the acceptance of one invoice, the scammer may begin to send more bogus invoices, some stamped "past due". They may even send a fake collection agency after your department, to convince them to pay.

There are few key tips you can follow to defend against these types of phone scams:

]]>

Tell the scammer that you will contact them back at your known supplier's email address or phone number: This is also a strong deterrent for the scammer, since calling the original supplier will quickly expose the scam. Do not provide the phone number, name of the supplier, or the email address over the phone if asked.
Ask questions: Phone scammers will often try to cajole victims into simply accepting an invoice without question. However, research has shown that the more questions you ask, the more likely the scammer is to end the phone call and move on. The best questions are usually the ones only your department and your suppliers would know.
If you're not expecting anything, be cautious: If your department is not expecting a phone call or an email regarding a particular invoice or transaction, proceed cautiously. Contact your known suppliers or trusted parties and verify whether or not they attempted to contact your department.

Due to changes in the nature of the telecommunications industry, anonymous phone scams are easier than every to execute and are not unique to NYU. Be on the alert for suspicious phone calls of all types.

You can find out more about this "Toner Phoner Scam" here:

InfoWorld.com | The toner phoner scam

If you have received or are the victim of one of these types of phone scams, contact the Office of Public Safety immediately at (212) 998-2222.

A Note On Illegal Downloading

2009-09-30T17:08:00Z

Marilyn McMillan, Associate Provost and CITO

A large percentage of people who use the Internet have downloaded music or movies. And most of the individuals who download these files—through paid services, file-sharing applications, or peer-to-peer networks—by now are aware of how prominent the issue of illegal downloading has become.

The University's stance on this issue is simple: downloading copyrighted material without permission is illegal, and you should not do it. You should also not use your computer to distribute copyrighted material without the permission of the copyright holder. Be aware: some applications for downloading music, movies and other files actually turn your computer into a server, allowing it to be used for distributing copyrighted material. If you are doing illegal downloads or distributions now or have done so, you should stop.

The music industry thus far has principally targeted those whose computers distribute illegally downloaded music, rather those who simply download. The Recording Industry Association of America (RIAA) is using the legal tools provided by the U. S. Digital Millennium Copyright Act (DMCA) of 1998. If the RIAA believes you are involved in illegal downloads or distribution of copyrighted materials and submits a valid subpoena to NYU seeking your identity, the University will comply with the subpoena and furnish your name and contact information to the RIAA's lawyers.

We know that illegal downloading of music is a widespread practice. It has become an international phenomenon, one that is hardly confined to college campuses. Its allure is clear: why would you pay for something—a song to load on your MP3 player or a movie to load on your laptop—when you can get it for free with a little exploration and few keystrokes? And why would you not share something for free with friends?

In answering those questions, the University appeals to what Abraham Lincoln once called "the better angels" of your nature and to your commitment to the culture of scholarship.

As communities of scholars and learners, research universities—such as NYU—have two primary missions: to educate students and to create knowledge. This latter mission involves the production of original scholarship and research. Accordingly it is accompanied by an enormous respect for proper recognition being given to the creator of those ideas and knowledge. In higher education, it is considered a grave act to take another's work without permission or attribution. At NYU, which also has large and renowned programs in the arts, this respect extends to the creation of new art.

Few in this community would uphold shoplifting CDs from a record store. And few would be content to see their own work—a paper, for instance, or a journal article, or a term project in a course—taken by someone else and used without permission.

Yet, in reality, that is what you do when you download copyrighted files illegally. However you may feel about the music or film industry or about their responses to piracy, when you download copyrighted files without permission, you are stealing the work of a director or a producer or an artist. It is not only wrong, it puts you at legal risk.

The Internet has brought unimaginable access to information and extraordinary flexibility and opportunities for exploration and communication. NYU wants you to take advantage of all that. But, just as you abide by certain standards of behavior for scholarship and for University life, so, too, should you abide by high standards when it comes to the intellectual property of others on the Internet.

March 2007