Security information

2019/11/18 6:32頃より、自分自身のメールアドレスから迷惑メールが受信されていると報告がありました。

件名は下記の様に様々あります。

これは脅迫詐欺メールです。このようなメールが届いた場合は破棄してください。

• 件名

• 類似メールの件名

• 本文の例

In Lumin PDF app that can edit PDF files on Google Drive, 15.5 million user information leaked in April 2019.

The leaked data includes API access token (* 1), email address, name, password, etc. to Google Drive.

We have received information that the University account is included in the leaked data.

You can check whether your user information is included in the leaked data on the Have I Been Pwnded site.

(* 1) If you authenticate with API access token, you can access the file without password or 2-step verification.

• What to do if your email address is included in the leaked data

1. The API access token is forcibly disabled on Google on September 18, 2019, but it will be in a state where unauthorized access to files on Google Drive will be possible between 2019/4 and 2019/9/18 I guess it was. If an event such as information leakage is confirmed, please contact the Information Networks Systems Section.
2. If you are using only in conjunction with (G suite for Education) used at the University, there is no need to change the password.
3. Since LuminPDF can be linked to Dropbox, if it was used in conjunction with Dropbox, it may have been possible to illegally access files on Dropbox.
4. If you have signed up and used personally, please change your Lumin PDF password just in case.
5. In addition, if you signed up for Lumin PDF personally and you used your password for internal services or other services outside the university, you will need to change the password for each service.

2019/10/31 around 11:22

There were reports that phishing emails pretending to be University WebActive! Mail were distributed to multiple university email addresses.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information Systems Division.

• subject

• Text example

• Phishing site image

2019/10/28

From around 5:45, there was a report that spam was being received from my own email address.

There are various subject lines as follows.

This is a threatening scam email. If you receive such an email, please discard it.

• Title

• Similar email
  AV alert
  Please read immediately
  The problem of peace of mind
  
  
• Text example

2019/10/22At around 08:30, there was a report that phishing emails pretending to be University WebActive! Mail were distributed to multiple university email addresses.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information System Division.

• Title

• Text example

• Phishing site screen

On September 29, 2018, there was a report that spam was being received from your own email address.

The subject is “~ (email address) hacked! Please change your password immediately!”, But there may be other cases.

This is a threatening scam email. If you receive such an email, please discard it.

subject

~ Email address ~ It is hacked! Change your password immediately!

Subject of similar email

• Emergency response!
• AV alert
• Please read immediately
• Your secret life
• Security warning
• That is your safety issue.
• The problem of your peace of mind.

Text example

About 2019/9/25 11:22 There was a report that phishing emails fake the University's WebActive! Mail were distributed to multiple email addresses of the University.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information Systems Division.

• subject：Recover rejected messages
• Text：

As of 9/25/2019 08:22:00 AM, Shibaura Institute of Technology Email System was unable to deliver 4 new messages to your ～@～.shibaura-it.ac.jp inbox

To recover rejected emails, please visit the link below and log in

Recover_mails <- Link to phishing site

Shibaura Institute of Technology Medi= a Center,
2019 Information Media Center, Shibaura Institute of Technology.

• Phishing site screen

Please be careful about dissemination of ransomware by e-mail disguised as DHL.

Subject example

• Problems with package delivery

Text example

Attached file example

• 税関書類.zip

The content of the attached file is Malware (Sodinokibi ransomware).

Please note that if you accidentally open it, the hard disk files will be encrypted and you will be asked for a ransom.

Currently, when spam emails are detected and quarantined in the email security system, quarantine notification emails are sent once a week (Monday at 0 o'clock). Because it has occurred, the notification interval will be changed every day (15:00).

The spam quarantine enable / disable setting can be changed from AMI Settings Change-> Spam Protection.

• Target audience: faculty and staff
• Change date: 2019/1/1

Around May 18th, 2019, suspicious emails containing the president's name in the body of the text are distributed to multiple users.

If you receive such an email, please delete it without opening it.