Mac endpoint protection update

On Monday April 11th, Information Technology will be pushing out an update to all Apple Mac computers which will include the following:

  1. The removal of Sophos endpoint protection software and the installation of Microsoft Defender endpoint protection software.
  • This only applies to systems running macOS 10.15 (Catalina) and higher. Systems running versions less than macOS 10.15 (Catalina) will receive a future communication shortly.  After completion, you will see this notification and your computer will restart in 15 minutes to allow you to save your documents.

2. The installation of a new filevault encryption key to ensure the data on your computer remains protected. This will prompt you to enter the password you use to log into your mac.

  • This process will occur on all mac systems and you will see the following 3 prompts to guide you through this process:

Please contact Tech Services at 978 934 3457 should you have further questions or difficulties.

BEWARE OF FAKE STUDENT JOB POSTINGS

Jobs that sound too good to be true should raise a red flag for any college student. This semester, we have received an increase in fake job postings from malicious actors sending emails sent to your student account. In some cases, these emails originate from compromised UML student accounts.

Fake jobs can be attempts to steal personal information about you or steal money or bank account information from you. You could also get entangled in criminal activity, so be cautious.

Here are some tips to help you identify fake jobs. You should always carefully research the legitimacy of employers before applying. 

Common Job Scams Targeting College Students:

  • Personal Assistant opportunities
  • Mystery shoppers
  • Envelope stuffing from home
  • Repackaging or shipping from home
  • Issuing checks/check processing from home
  • Model/talent agencies
  • Pyramid sales schemes
  • A variety of scams where a student is asked to pay for certification, training materials, or equipment with promise of reimbursement
  • Pet Sitting/Babysitting

Over-payment Scams

Watch out for over-payment scams. These are often posted as a bookkeeper, personal assistant, administrative assistant, etc., to assist in processing checks or mystery/secret shoppers. The “company” sends a check to the “assistant” (student), who is then responsible for taking their “salary” out of the check and wiring the remainder of the money back to the “company.” These checks are fraudulent and can leave you out thousands of dollars and facing criminal charges.

Beware if the Email or Job Posting:

  • Does not indicate the company name
  • Email signatures including names not found in the UML staff directory
  • References “UML Placement & Services”, including differing variations
  • Comes from an email address that doesn’t match the company name
  • Does not give the employer contact information—title of person sending the email, company address, phone number, etc.
  • Offers to pay a large amount for almost no work
  • Offers you a job without ever interacting with you
  • Asks you to pay an application fee
  • Wants you to transfer money from one account to another
  • Offers to send you a check before you do any work
  • Asks you to give your credit card or bank account numbers
  • Asks for copies of personal documents
  • Says you must send payment by wire service or courier
  • Offers you a large payment for allowing the use of your bank account—often for depositing checks or transferring money
  • Sends you an unexpectedly large check

No legitimate employer will send payment in advance and ask the employee to send a portion of it back. DO NOT provide any personal information, especially Social Security numbers or financial information!  

Examples of Suspicious Ads

The following job posting was rejected by the Student Employment Program Job Board:

Agile and Responsible individual is needed to fill the vacant position of a Personal Assistant (Part time) Someone who can offer these services: *Mail services (Receive mails and drop them off at UPS) *Shop for Gifts *Sit for delivery (at your home) or pick items up at nearby post office at your convenience. (You will be notified when delivery would be made).

A student notified the Student Employment Program that she received the following email:

If you are resourceful, organized, good with paperwork and honest, you can make three hundred dollars ($500) a week, as a business assistant. This flexible but formal position would only take at most two hours of your time daily, or even less, depending on your work-speed. You would be needed Mondays through Fridays, but the job’s flexibility lies in the fact that your duties are clear-cut and would take little of your time to be executed daily. Kindly get back to me ASAP if you are interested and wish to know more about this opportunity.

Another student received an email offering them a “New, interesting, and respectable job” as a typist.

Report Suspicious Ads

If you have concerns about the legitimacy of a job or internship posting, please contact the Student Employment Office at 978-934-4228. If you feel that you’ve been the victim of a scam, please contact campus police at 978-934-2398, or police@uml.edu.

Researching Ads and Employers

Why is it Important to Research Every Opportunity?

  • To find out if the job and the company are legitimate
  • To gather information to help you determine whether the company or job is a good fit for you
  • To find data to help you write targeted resumes and cover letters
  • To find facts to help you answer interview questions

Visit the Organization’s Website

If the organization in question doesn’t have a website or the website doesn’t seem to match the advertised job, there may be cause for concern. Note the professionalism of the website. Is there specific contact information? Are jobs and career information actually posted on the site? Lack of pertinent information is a red flag. 

Use Personal Contacts, LinkedIn, or Other Networking Sites

Do you have any connections to help you find inside information? If you belong to a professional association, they may be able to put you in touch with people who can advise you. Search LinkedIn by “People” and the advanced search fields for “Company Name.” Click the “Current Companies Only” checkbox to receive information on people currently listed as employed by this company. 

Use Google

Search by the name of the organization to gather information and recent news. You can also search by “scam” to look for signs the company has been reported in any type of fraudulent activity.

Check with Consumer Services

Two organizations to utilize are the Better Business Bureau or the Federal Trade Commission to see if any complaints have been lodged against the company. 

Investigate the Company’s References

If you aren’t sure a company is legitimate, request a list of employees or contractors. Then contact the references to see how satisfied they are. If a company isn’t willing to share references (names, email addresses, and phone numbers), this is a red flag. You may want to research the references a bit as well, to be sure they are legitimate.

Be Suspicious of Poor Communication Skills

Be careful when an employer cannot communicate accurately or effectively on the website, by email, over the telephone, etc. If communications are sloppy, how professional is the organization? 

Exercise Caution When Asked to Pay Any Fees

Most legitimate employers will not charge to hire you! Don’t send money for work-at-home directories, advice on getting hired, company information or for anything else related to the job. There are some well-known internship programs that do require payment to place you in internships, but check with your department’s internship coordinator to determine if the program is legitimate. 

Review Payment Information

When information about salary isn’t listed on a job posting, try to find out if you will receive a salary or be paid on commission. Find out how much you’re paid, how often you are paid and how you are paid. If the company doesn’t pay an hourly rate or a salary, be cautious and investigate further. 

Beware: Scam Ads Can be Found in Legitimate Publications

Read all information carefully. If the opportunity sounds too good to be true, it probably is! Just because a job lead appears in a legitimate publication, it doesn’t mean that the job or company is, necessarily, legitimate. Forget about getting rich quick.

Additional Information about Job Scams

Fake COVID-19 Website

The Department of Health and Human Services has issued an alert of a fake malicious COVID-19 website pretending to be a live map for the COVID-19 Global Cases by Johns Hopkins University. Visiting the website infects the computer with an information stealing program which can ex-filtrate a variety of sensitive data.

More information, including a screenshot of the fake map, can be found HERE.

UMass Lowell Information Security would like to remind our community to remain vigilant for scams related to coronavirus 2019 (COVID-19). Cyber criminals may send phishing emails with malicious attachments or links to fraudulent websites to trick victims into revealing sensitive information or donating to fraudulent charities or causes. Exercise caution in handling any email with a COVID-19-related subject line, attachment or hyperlink, and be wary of social media pleas, texts or calls related to COVID-19.

We encourage individuals to remain vigilant and take the following precautions:
• Avoid clicking on links in unsolicited emails and be wary of email attachments
• Use trusted sources — such as legitimate, government websites—for up-to-date, fact-based information about COVID-19
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information
• Verify a charity’s authenticity before making donations. Review the Federal Trade Commission’s page on Charity Scams for more information

If you feel you have received a phishing email please report it to infosec@uml.edu.

Oh no! Have I been hacked?

A SPAM campaign is underway that immediately grabs your attention by letting you know a hacker has your password. The email goes on to reveal supposed details of your browsing habits as well as captured images of you via webcam. The hacker seeks a few thousand dollars as a “privacy fee”.

So how did they get your password? Simple! Poor security on any number of sites you visit. The LinkedIn Data Breach is an example where millions of account credentials were stolen. These usernames and passwords are available to be bought and sold on the dark web. It is likely that a malicious individual obtained a database of compromised accounts, crafted a nefarious message and used a mail merge to send out the emails in bulk.

What should you do? Don’t panic! This is nothing more than a clever SPAM campaign designed to scare you into paying a con artist. You have not been hacked, you don’t have a key logger installed and the hacker isn’t tracking to see if you read the email.

Next, protect yourself and your accounts. Visit https://haveibeenpwned.com to see if your email address and any online accounts were exposed in a data breach. Note that some breaches are part of a “combo list” that do not provide the originating source of stolen information. Change your password on any of the identified sites. Additionally, google your email address and scan the search results for any sites where you may have used the same password.

Moving forward, consider using a password manager and utilize two factor authentication for any site where available.

IRS Warns of Variation to Form W-8BEN Scam

Washington – The Internal Revenue Service today warned of a new twist tied to an old scam aimed at international taxpayers and non-resident aliens. In this scam, criminals use a fake IRS Form W-8BEN to solicit detailed personal identification and bank account information from victims.

Here’s how the scam works. Criminals mail or fax a letter indicating that although individuals are exempt from withholding and reporting income tax, they need to authenticate their information by filling out a phony version of Form W-8BEN, Certificate of Foreign Status of Beneficial Owner for United States Tax Withholding and Reporting. Recipients are requested to fax the information back

Click here for the complete story.

 

Phishing Scam – 2/13/18 – Email Membership Update

URL is blocked at the border. Web host has been notified.

Email Membership Update

Due to recent IP routine check; we have reasons to believe that your account has been signed in to from a new Windows device and access by a third party.  Click on SUPPORT and verify your STUDENT.UML.EDU Mailbox to avoid deactivation.

Warm Regards,

2018 University of Massachusetts Lowell -Help-Desk-Administrator.

Email Scammers Targeting UML Students

UMass Lowell Information Security is aware of the sudden increase of Phishing-type emails and scams from various sources that have been delivered to Student Inboxes.   Although Microsoft O365 platform routinely block several thousand phishing attempts per day, there is a chance that slight variations of the same theme will be delivered until a reputation can be established.  As of today, we have disabled over one-hundred student accounts, which have been sending thousands of spam messages to the internet.  This essentially means these students have given up their UML email account credentials to the scammers.

As always, continue to be vigilant with scrutinizing emails you receive not only from financial institutions, but also from what appears to be reputable retailers, government organizations, UMass Lowell IT, and even people you may know.  Email scammers are constantly changing their social engineering techniques to gain access to your personal information or to send spam from your account.  The latest phishing attempt used a picture of Tsongas Arena in the background, and threatened to disable your email account at UML.

If you are ever in doubt about the authenticity of an email you receive, we strongly encourage you to not reveal your university email credentials, personal, financial, and/or account information.  Resist the urge to click on any of the links or download attachments.

We anticipate a continued surge in targeted phishing attacks on our university.  If you have any questions regarding suspicious emails you receive, please contact the IT Service Desk (help@uml.edu) or Information Security (infosec@uml.edu)

macOS High Sierra Security Bug

A serious security vulnerability was discovered with macOS High Sierra that can potentially allow anybody full administrative access without a password. Anyone running macOS High Sierra 10.13, 10.13.1, or 10.13.2 who has not previously enabled the root account or changed a root user account password on his or her Mac before may be affected.

To determine which version of macOS you are using, choose ‘About This Mac’ from the Apple Menu and click on the Overview tab.

It is vital that Mac users take immediate steps to secure their systems and prevent unauthorized access.

Apple has released Security Update 2017-001 to address the issue.  The update should be available through the Updates tab in the Mac App Store.

For detailed installation instructions, visit: https://support.apple.com/en-us/HT201541

How to Prevent Root Login Without a Password in macOS High Sierra

If you cannot immediatly patch your system, there are two other methods available to lock down the Root account. One option is to use the Directory Utility and the other is performed on the command line. Choose whichever you feel more comfortable doing, they both accomplish the same task.

Please contact the IT Service Desk at 978 934 4357 should you need assistance with this.

Using Directory Utility to Lock Down Root:
1. Open Spotlight on the Mac by hitting Command+Spacebar (or clicking the Spotlight icon in the upper right corner of the menubar) and type in “Directory Utility” and hit return to launch the appprevent root password less login bug

2. Click the little lock icon in the corner and authenticate with an admin account login (in most cases this is the same account you log into your mac with).

prevent root password less login bug

3. Now pull down the “Edit” menu and choose “Change Root Password…” (see note under step #5 if you don’t see ‘Change Root Password… in the menu’) ***

prevent root password less login bug

4. Enter a password for the root user account and confirm, then click “OK”

prevent root password less login bug

5. Close out of Directory Utility

*** If the root user account is not yet enabled, choose “Enable Root User” and then set a password instead.

Essentially all you are doing is assigning a password to the root account, meaning that logging in with root will then require a password as it should. Also, if the root account is disabled, it doesn’t mean it is secure. The root account must be enabled and have a set password.

Using the Command Line to Assign a Root Password:
Users who would prefer to use the command line in macOS can also set or assign a root password with sudo and the regular old passwd command.
1. Open the Terminal application, found in /Applications/Utilities/
2. Type the following syntax exactly into the terminal, then hit the return key:
sudo passwd root
3. Enter your admin password to authenticate and hit return
4. At “New password”, enter a password you won’t forget, hit return, and confirm it

Stop no password root login but in macOS High Sierra from command line

Be sure to set the root password to something you will remember, or perhaps even matching your admin password. UMass Lowell Information Security recommends a 16 character password for optimal security.

Source: http://osxdaily.com/2017/11/28/macos-high-sierra-root-login-without-password-bug/