Security Bulletin of April 29, 2008

Overview
Full Text of Scam
Tips for Safer Computing
Further Assistance

Other Bulletins
Recent CERT Alerts

Computing Alert: "Update Your Email-Adress" (sic) Email Scam

I. OVERVIEW

Last night, many Haverford email users received a spam message asking for their username and password. This message also went to some alumni with username@alum.haverford.edu email aliases. We are unsure whether other Haverford related accounts may have received this message. 

If you get this spam email titled "Update Your Email-Adress" (sic),  ignore it. This type of spam, known as "phishing," is a common type of malicious email. By pretending to be a trustworthy source, the spammer tries to trick you into revealing sensitive information like email passwords or bank account information. If you already responded to the bogus message, reset your password immediately. Go to https://accounts.haverford.edu/user/changePassword.

GENERAL TIPS:
A few general guidelines for identifying suspicious messages:

-- Don't trust messages that ask for sensitive information like account numbers and email passwords. Email is not secure. Reputable sources, including ACC, should never ask you to send sensitive information by email.

-- Don't trust email attachments you aren't expecting. Such attachments may be a virus or other malicious file.  ACC will never email an executable file. Instead, if we ask you to take action, we will always refer you to our web site. 

-- Be wary of get-rich-quick and other fraudulent emails.  If it looks too good to be true, it probably is.

-- Use common sense.  In addition to the issues mentioned above, there are many other potential email hazards. If you have any doubt about a message, check with the sender or with ACC.

For more tips, the United States Computer Emergency Response Team published an excellent document, Recognizing and Avoiding Email Scams, on their web site (http://www.us-cert.gov/reading_room/).

II. FULL TEXT OF BOGUS EMAIL

The full text of the bogus email message is below.

III. FOR FURTHER ASSISTANCE

Students, faculty and academic staff please contact Academic Computing:
Telephone: 610-896-1480
Email: helpdesk@haverford.edu
Web: http://www.haverford.edu/acc/helpdesk/
Location: Stokes 204

Administrative staff please contact Administrative Computing:
Telephone: 610-896-1355
Email: admincc@haverford.edu

IV. MORE INFORMATION

Additional information about computer security and current threats can be found at the following sites:

United States Computer Emergency Readiness Team (US-CERT )

<http://www.us-cert.gov/nav/nt01/>

McAfee Avert Threat Center

<http://www.mcafee.com/us/threat_center/default.asp>

Microsoft Security

<http://www.microsoft.com/security/>

Apple Product Security

<http://www.apple.com/support/security/>