Warning! Global WannaCry Ransomeware Attack – What You Can Do To Prevent Infection

As has been reported in the media, there currently is a global ransomware attack (called WannaCry or WannaCryptor) that has affected computers worldwide. UT Arlington is currently not affected and both IT and Security teams are actively working this weekend to minimize the impact of an attack.

What you should know:

  • This malware affects all unpatched Microsoft Windows versions (from Windows 98 through Windows 10. Microsoft released patches for this in March through normal windows update.
  • Macintosh and Linux operating systems are not affected at this time.
  • The malware is initially delivered as an attachment or a link to a compressed .zip file. Unsuspecting victims who open the file on an unpatched computer are infected and the malware begins to encrypt files on the computer.
  • In addition to encrypting files, the malware looks for other computers on the network to infect, spreading itself within a vulnerable organization.

What has UTA IT Security has done so far:

  • An initial patch for the vulnerability was released in March and was installed on OIT managed Windows computers in the ARDC and on campus. Additional patches were released over the weekend.
  • Our Intrusion Prevention System has been updated to prevent direct attacks from the internet.
  • Our email system has been configured to quarantine compressed .zip files (that are manually inspected and released by OIT).
  • OIT has implemented protections on the file server to protect against encrypted files being placed on it.
  • OIT has verified that backups are running on the file servers (K: and J: drives) in the event of infection.
  • OIT has made available CrashPlan to back up data on computers.

What you should do:

  • Do not click on suspicious links or attachments received in your personal or UTA email. To learn about Ransomware: http://www.uta.edu/security/ransomware/
  • If your UTA computer managed by OIT, and it has not been turned on in a while, turn it on and reboot it when prompted.
  • If you are running an old version of Windows that is no longer supported (such as Windows 98 through Windows 8, Windows Server 20018, 2013, etc), Microsoft has released a patch that is available: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
  • Make sure that your home computers operating system and antivirus is up-to-date.
  • Do not open shared documents (e.g. Box, Dropbox, google drive, etc.) that you are not expecting.

If your UTA computer becomes infected, disconnect it from the network immediately. Please send email to helpdesk@uta.edu to report the infection.

New Phone Scam

The Information Security Office wants to alert students, faculty, and staff of a type of phone scam called Vishing (voice phishing) which uses fake caller-ID data to give the appearance that calls come from a trusted organization (such as UT Arlington). The caller tells people they owe money to the University and a warrant has been issued for their arrest. Next, the caller solicits immediate payment for the alleged debts.

University officials will not contact you in this manner or threaten arrest for non-payment of debts. Verifying UT Arlington debts, including citations, can be done by checking MyMav or visiting the Bursar directly.  Be aware that this is a type of social engineering wherein someone uses influence, deception, and persuasion to get information that would otherwise be unavailable to them (which is also known as fraud).

Caller ID is far from proof positive of a caller’s identity or authentication. Don’t trust incoming calls based on Caller ID. Make 100% sure you know to whom you are speaking. If any incoming calls from supposedly legitimate companies ask for any personal information of any kind… it is a scam. It is fraud. Period.

If you receive an unexpected call like this from someone claiming to be from UTA DO NOT provide your credit card information.  If you fall victim to the call, contact UT Arlington’s Police Department at 817-272-3381.  For information on preventing social engineering and theft, please contact the ISO at security@uta.edu or call us at 817-272-5487.

For more information about Identity Theft, go to:

http://www.uta.edu/security/identity_theft/

For more information about Social Engineering, go to:

http://www.uta.edu/security/socialengineering/

Holiday Season Cyber Scams and Malware Campaigns

As we approach the holidays, the Information Security Office (ISO) would like to remind the UT Arlington community to be aware of seasonal scams, phishing and malicious software (malware) distribution campaigns.

Every year, cyber criminals take advantage of the increase in online purchases and electronic seasonal greeting cards to trick victims into believing they’ve received packages or personal messages. They often use multiple methods to attract victims, such as posing as legitimate websites and/or using fraudulent emails that are crafted to look legitimate; they steal the logos, email or web templates of legitimate businesses *e.g. FedEx, DHL UPS, Amazon.com, etc.) in an effort to entice victims into clicking links or opening attachments.

These phishing and malware campaigns may come in the form of :

  • Fake shipping/courier notifications.
  • Electronic greeting cards or links to holiday screensavers or other forms of media.
  • Request for charitable contributions that may appear to be for legitimate causes but originate from illegitimated sources claiming to be charities.
  • Credit card or gift card applications or enticing discounts in online shopping advertisements that lead to websites you’re unfamiliar with.

In addition, be aware of social engineers who may call you on your personal or work phone using a themed pretext (holiday offers, package pickup, etc.).

Don’t be a victim!  The ISO advises caution when you encounter these types of email messages or websites by:

  • Looking for tell-tale signs that a website or email is not legitimate:

………….– The senders address or website address does not match the organization listed in the content of the message.
………… – The grammar in the message or website is poor.
………… – Format of the email or website is poor or inconsistent with what you’re used to seeing from the organization.
………… – Hovering over the links with your mouse reveals web address inconsistent with the content of the message.

  • Never clicking on links in emails that you’re not expecting.
  • Never opening attachments in emails that you’re not expecting.
  • Never providing your personal information in an email or on a website unless you are completely sure.

The United States Computer Emergency Readiness Team encourages users and administrators to use caution when encountering these types of email messages and take the following preventative measures to protect themselves from phishing scams and malware campaigns:

Phishing Attempt – 2014/01/23

The Information Security Office has been made aware of a phishing attempt that has been sent to some UTA employees.  Please delete this email if you receive it:

“””

Hi Web-mail User’s ,
Please take a moment to verify your email for this 2014 account’s verification. It’s really important because if you neglect this our server admin provider will delete your account because our server quota is congested. Just click the link and you’ll be all set up.

[REMOVED IMAGE]

With web-mail  you get all kinds of free stuff this year 2014:

  • Unlimited storage limit
  • High speed mails
  • Custom voicemail

Thanks and we hope you have a blast!
– team update ( c ) 2014

P.S. If you’re not a web-mail account user and have never heard of web app outlook, we’re really sorry! Someone must’ve typed your email address in by mistake. Just forward this email to us at support@microsoft.com and we’ll take care of it.
Virtua Health, Inc. maintains systems for protection of electronic information, which are the property of Virtua Health, Inc. and are to be used for legitimate business purposes. You shall at all times protect and maintain the confidentiality of your user name and password and shall not disclose them to any third party. You are responsible to comply with the regulations and security rules set forth by HIPAA and Virtua Policies regarding the protection of data & confidentiality. Excessive use of systems for any reason other than legitimate business purposes is prohibited. Virtua Health, Inc. monitors all system transactions. No right to privacy exists when using Virtua Health, Inc. systems at work or when accessing Virtua systems from a personal computer or other device. Virtua Health, Inc. has the right to monitor, access, review, audit and disclose information obtained through Virtua Health. Inc. systems, including email, without advance notice to and/or without consent. All users of Virtua Health, Inc. systems are required to notify the IS Help Desk if they become aware of any misuse. I confirm that I have read this acknowledgment and understand

“””