Security information

From around 2020/01/09 15:32 to 15:55, there were reports that phishing emails spoofing the University's WebActive! Mail were being distributed to multiple email addresses of the University.

When you access the link in the body of the e-mail, a site similar to the university's Web mail system will be displayed.

If you enter your username and password on this site, your credentials will be exploited and unauthorized access may be possible.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, change the password and contact the Information System Section.

• Subject

• Example text

• Phishing site screen

At around 14:41 and 17:18 2020/01/06 and around 17:18 and around 06:50 to 07:45 2020/01/07, phishing emails spoofing the University's WebActive! Mail are distributed to multiple email addresses of the University There was a report that he had been.

When you access the link in the body of the e-mail, a site similar to the university's Web mail system will be displayed.

If you enter your username and password on this site, your credentials will be exploited and unauthorized access may be possible.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name or password, change the password and contact the Information System Section.

• Subject

• Example text

• Phishing site screen

There are only a few places left in 2019. Suspicious emails (including SMS) have increased since the second half of 2019.

According to information from the Tokyo Metropolitan Police Department, illegal remittance damage related to Internet banking, which seems to be phishing, has increased rapidly since September 2019.

• Sudden increase in fraudulent remittance damage related to internet banking, which seems to be caused by phishing (attention in cooperation with JBA)
  https://www.npa.go.jp/cyber/policy/caution1910.html

The period of the year-end and New Year holidays is also a period when security response is weak, and attacks targeting that period usually tend to increase. We have compiled a list of matters that you should be aware of regarding security, so students, faculty and staff should read the following materials and be careful not to be damaged.

• セキュリティ警戒情報 - 不審メール編 (PDF 3,164KB)(Accessible only from campus)

In case of damage, please contact the Information System Division by email.

contact information :goiken <at> sic.shibaura-it.ac.jp

From December 18th, 2019, around 09:23 to 9:32, there was a report that phishing emails pretending to be WebActive! Mail were distributed to multiple email addresses of the University.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information Systems Division.

• Subject

• Text example

12/18/2019 At 8:23:00 AM, delivery of three incoming emails to ~ mail address ~ inbox failed.

Restore email

• Phishing site screen

2019/12/04 From around 8:47 to 10:45, there was a report that emails with suspicious Excel attachments were being scattered.

The subject is as follows.

This attachment is malware. Discard it without opening it.

• Subject

• Attached file name

• Text example

Click to enlarge

2019/12/03 From around 18:12 and around 20:56, it was reported that phishing emails for Webmail administrators were scattered.

The subject is as follows.

The URL listed in this email is a phishing site. Never access the link destination. Also, do not enter your email address, username or password carelessly.

• Subject

• Text example

Click to enlarge

2019/12/03 From around 7:38, there was a report that emails with attachments of suspicious Excel were being scattered.

The subject is as follows.

This attachment is malware. Discard it without opening it.

• subject

添付ファイル名

• Text example

Around November 29, 2019 at 10:07, there was a report that phishing emails pretending to be WebActive!

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information System Section as soon as possible.

• Subject

• Text example

Click to enlarge

From November 20, 2019, around 7:30, it was reported that emails with shortened URLs for downloading suspicious xls files were being distributed.

There are three types of subject lines:

This URL is a site for downloading malware. Discard without accessing the View and View File buttons in the email.

• Subject example

• Text example

Click to enlarge

From 19/11/2019 8:06, it was reported that emails with shortened URLs for downloading suspicious xls files were being distributed.

There are three types of subject lines:

This URL is a site for downloading malware. Please discard the URL (Open button) in the email without accessing it.

• subject

• Text example

Click to enlarge

2019/11/18 6:32頃より、自分自身のメールアドレスから迷惑メールが受信されていると報告がありました。

件名は下記の様に様々あります。

これは脅迫詐欺メールです。このようなメールが届いた場合は破棄してください。

• 件名

• 類似メールの件名

• 本文の例

In Lumin PDF app that can edit PDF files on Google Drive, 15.5 million user information leaked in April 2019.

The leaked data includes API access token (* 1), email address, name, password, etc. to Google Drive.

We have received information that the University account is included in the leaked data.

You can check whether your user information is included in the leaked data on the Have I Been Pwnded site.

(* 1) If you authenticate with API access token, you can access the file without password or 2-step verification.

• What to do if your email address is included in the leaked data

1. The API access token is forcibly disabled on Google on September 18, 2019, but it will be in a state where unauthorized access to files on Google Drive will be possible between 2019/4 and 2019/9/18 I guess it was. If an event such as information leakage is confirmed, please contact the Information Networks Systems Section.
2. If you are using only in conjunction with (G suite for Education) used at the University, there is no need to change the password.
3. Since LuminPDF can be linked to Dropbox, if it was used in conjunction with Dropbox, it may have been possible to illegally access files on Dropbox.
4. If you have signed up and used personally, please change your Lumin PDF password just in case.
5. In addition, if you signed up for Lumin PDF personally and you used your password for internal services or other services outside the university, you will need to change the password for each service.

2019/10/31 around 11:22

There were reports that phishing emails pretending to be University WebActive! Mail were distributed to multiple university email addresses.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information Systems Division.

• subject

• Text example

• Phishing site image

2019/10/28

From around 5:45, there was a report that spam was being received from my own email address.

There are various subject lines as follows.

This is a threatening scam email. If you receive such an email, please discard it.

• Title

• Similar email
  AV alert
  Please read immediately
  The problem of peace of mind
  
  
• Text example

2019/10/22At around 08:30, there was a report that phishing emails pretending to be University WebActive! Mail were distributed to multiple university email addresses.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information System Division.

• Title

• Text example

• Phishing site screen

On September 29, 2018, there was a report that spam was being received from your own email address.

The subject is “~ (email address) hacked! Please change your password immediately!”, But there may be other cases.

This is a threatening scam email. If you receive such an email, please discard it.

subject

~ Email address ~ It is hacked! Change your password immediately!

Subject of similar email

• Emergency response!
• AV alert
• Please read immediately
• Your secret life
• Security warning
• That is your safety issue.
• The problem of your peace of mind.

Text example

About 2019/9/25 11:22 There was a report that phishing emails fake the University's WebActive! Mail were distributed to multiple email addresses of the University.

When you access the link in the email text, you will see a site that looks just like the University's Web mail system.

If you enter your username and password on this site, your authentication information will be exploited and unauthorized access may occur.

If you receive this email, please delete it without accessing the link.

If you have accidentally entered your user name or password, please change your password and contact the Information Systems Division.

• subject：Recover rejected messages
• Text：

As of 9/25/2019 08:22:00 AM, Shibaura Institute of Technology Email System was unable to deliver 4 new messages to your ～@～.shibaura-it.ac.jp inbox

To recover rejected emails, please visit the link below and log in

Recover_mails <- Link to phishing site

Shibaura Institute of Technology Medi= a Center,
2019 Information Media Center, Shibaura Institute of Technology.

• Phishing site screen

Please be careful about dissemination of ransomware by e-mail disguised as DHL.

Subject example

• Problems with package delivery

Text example

Attached file example

• 税関書類.zip

The content of the attached file is Malware (Sodinokibi ransomware).

Please note that if you accidentally open it, the hard disk files will be encrypted and you will be asked for a ransom.

Currently, when spam emails are detected and quarantined in the email security system, quarantine notification emails are sent once a week (Monday at 0 o'clock). Because it has occurred, the notification interval will be changed every day (15:00).

The spam quarantine enable / disable setting can be changed from AMI Settings Change-> Spam Protection.

• Target audience: faculty and staff
• Change date: 2019/1/1

Around May 18th, 2019, suspicious emails containing the president's name in the body of the text are distributed to multiple users.

If you receive such an email, please delete it without opening it.