On Monday April 11th, Information Technology will be pushing out an update to all Apple Mac computers which will include the following:

2. The installation of a new filevault encryption key to ensure the data on your computer remains protected. This will prompt you to enter the password you use to log into your mac.

• This process will occur on all mac systems and you will see the following 3 prompts to guide you through this process:

Please contact Tech Services at 978 934 3457 should you have further questions or difficulties.

October is Cybersecurity Awareness Month 2021, and this year’s theme is “Do your part. #BeCyberSmart.” Our newsletter tells you what to look out for and how to keep yourself and the university safe.

The Department of Health and Human Services has issued an alert of a fake malicious COVID-19 website pretending to be a live map for the COVID-19 Global Cases by Johns Hopkins University. Visiting the website infects the computer with an information stealing program which can ex-filtrate a variety of sensitive data.

More information, including a screenshot of the fake map, can be found HERE.

UMass Lowell Information Security would like to remind our community to remain vigilant for scams related to coronavirus 2019 (COVID-19). Cyber criminals may send phishing emails with malicious attachments or links to fraudulent websites to trick victims into revealing sensitive information or donating to fraudulent charities or causes. Exercise caution in handling any email with a COVID-19-related subject line, attachment or hyperlink, and be wary of social media pleas, texts or calls related to COVID-19.

We encourage individuals to remain vigilant and take the following precautions:
• Avoid clicking on links in unsolicited emails and be wary of email attachments
• Use trusted sources — such as legitimate, government websites—for up-to-date, fact-based information about COVID-19
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information
• Verify a charity’s authenticity before making donations. Review the Federal Trade Commission’s page on Charity Scams for more information

If you feel you have received a phishing email please report it to infosec@uml.edu.

A SPAM campaign is underway that immediately grabs your attention by letting you know a hacker has your password. The email goes on to reveal supposed details of your browsing habits as well as captured images of you via webcam. The hacker seeks a few thousand dollars as a “privacy fee”.

So how did they get your password? Simple! Poor security on any number of sites you visit. The LinkedIn Data Breach is an example where millions of account credentials were stolen. These usernames and passwords are available to be bought and sold on the dark web. It is likely that a malicious individual obtained a database of compromised accounts, crafted a nefarious message and used a mail merge to send out the emails in bulk.

What should you do? Don’t panic! This is nothing more than a clever SPAM campaign designed to scare you into paying a con artist. You have not been hacked, you don’t have a key logger installed and the hacker isn’t tracking to see if you read the email.

Next, protect yourself and your accounts. Visit https://haveibeenpwned.com to see if your email address and any online accounts were exposed in a data breach. Note that some breaches are part of a “combo list” that do not provide the originating source of stolen information. Change your password on any of the identified sites. Additionally, google your email address and scan the search results for any sites where you may have used the same password.

Moving forward, consider using a password manager and utilize two factor authentication for any site where available.

Washington – The Internal Revenue Service today warned of a new twist tied to an old scam aimed at international taxpayers and non-resident aliens. In this scam, criminals use a fake IRS Form W-8BEN to solicit detailed personal identification and bank account information from victims.

Here’s how the scam works. Criminals mail or fax a letter indicating that although individuals are exempt from withholding and reporting income tax, they need to authenticate their information by filling out a phony version of Form W-8BEN, Certificate of Foreign Status of Beneficial Owner for United States Tax Withholding and Reporting. Recipients are requested to fax the information back

Click here for the complete story.

A serious security vulnerability was discovered with macOS High Sierra that can potentially allow anybody full administrative access without a password. Anyone running macOS High Sierra 10.13, 10.13.1, or 10.13.2 who has not previously enabled the root account or changed a root user account password on his or her Mac before may be affected.

To determine which version of macOS you are using, choose ‘About This Mac’ from the Apple Menu and click on the Overview tab.

It is vital that Mac users take immediate steps to secure their systems and prevent unauthorized access.

Apple has released Security Update 2017-001 to address the issue.  The update should be available through the Updates tab in the Mac App Store.

For detailed installation instructions, visit: https://support.apple.com/en-us/HT201541

How to Prevent Root Login Without a Password in macOS High Sierra

If you cannot immediatly patch your system, there are two other methods available to lock down the Root account. One option is to use the Directory Utility and the other is performed on the command line. Choose whichever you feel more comfortable doing, they both accomplish the same task.

Please contact the IT Service Desk at 978 934 4357 should you need assistance with this.

Using Directory Utility to Lock Down Root:
1. Open Spotlight on the Mac by hitting Command+Spacebar (or clicking the Spotlight icon in the upper right corner of the menubar) and type in “Directory Utility” and hit return to launch the app

2. Click the little lock icon in the corner and authenticate with an admin account login (in most cases this is the same account you log into your mac with).

3. Now pull down the “Edit” menu and choose “Change Root Password…” (see note under step #5 if you don’t see ‘Change Root Password… in the menu’) ***

4. Enter a password for the root user account and confirm, then click “OK”

5. Close out of Directory Utility

*** If the root user account is not yet enabled, choose “Enable Root User” and then set a password instead.

Essentially all you are doing is assigning a password to the root account, meaning that logging in with root will then require a password as it should. Also, if the root account is disabled, it doesn’t mean it is secure. The root account must be enabled and have a set password.

Using the Command Line to Assign a Root Password:
Users who would prefer to use the command line in macOS can also set or assign a root password with sudo and the regular old passwd command.
1. Open the Terminal application, found in /Applications/Utilities/
2. Type the following syntax exactly into the terminal, then hit the return key:
sudo passwd root
3. Enter your admin password to authenticate and hit return
4. At “New password”, enter a password you won’t forget, hit return, and confirm it

Be sure to set the root password to something you will remember, or perhaps even matching your admin password. UMass Lowell Information Security recommends a 16 character password for optimal security.

Source: http://osxdaily.com/2017/11/28/macos-high-sierra-root-login-without-password-bug/

Click here to watch a video about how to create a cyber secure home!

As always, please don’t hesitate to contact the IT Service Desk at 978 934 4357 should you have security related questions or concerns.

Click here to view the latest OUCH! newsletter, focusing on social engineering

As always, please don’t hesitate to contact the IT Service Desk at 978 934 4357 should you have security related questions or concerns!

Click here to watch a video about MALWARE and how to avoid it.

As always, please don’t hesitate to contact the IT Service Desk at 978 934 4357 should you have security related questions or concerns.

Click here to watch a video which outlines how TARGETED ATTACKS occur, and how to stay vigilant against them.

As always, please don’t hesitate to contact the IT Service Desk at 978 934 4357 should you have security related questions or concerns.