Received a suspicious message?

Report a phish

Petya: what the U of T community should know about the ongoing malware epidemic

June 27, 2017

A massive malware outbreak known as Petya is currently infecting computer systems in numerous countries across the world.

Petya targets un-patched Microsoft Windows computers and then locks (encrypts) the machine’s contents from the user – pending the payment of a ransom. At present, the e-mail address used to pay the ransom is disabled making it impossible to pay the criminals running this software in exchange for encrypted data. While it is never recommended that users pay a criminal to recover their files, this means that files encrypted by this malware are permanently irretrievable. Recent evidence even suggests that the malware was never designed to allow users to recover their files.

Petya propagates by identifying and infecting other machines on a network, including those which are patched against the SMB vulnerability, making it critical that all systems be patched and up to date.

What U of T is doing:

Defenses are in place at multiple network locations/gateways to block incoming attacks.

The information security team is constantly scanning the university networks to identify unpatched equipment that is using outdated and unsupported operating systems such as Windows XP, and to notify appropriate administrators about the need to patch the devices.

What you should do:

  • Keep your devices up-to-date. Install security updates and patches, particularly those identified as being “critical.” Consider ALL your devices, not just machines used at work.
  • Maintain backups. The existence and integrity of data and system backups is critical to protecting your data and maintaining availability in case of a compromised device. If you are unsure as to whether your devices are backed up, check with your local IT team.

For additional information and support, please contact your local IT team. Additional resources are available from the information security department and at the security awareness site.

Featured image: “Petya Hungers”, is a derivative of “City-eating Kaiju” by Unosombrero, used under CC BY. “City-eating Kaiju” is licensed under CC BY by Alex Dean Cybulski.

Security professional pro-tip: password managers

June 12, 2017

Last week we talked about why using the same password for all of your online accounts, password re-use, was fatal in the era of the daily data breach. This week we’re going to show you some ways to create strong, unique passwords and how to organize them.

Making strong, unique passwords is tough. You’ve probably heard tons of unhelpful or contradictory rules and policies for creating strong passwords, including “change your password every 2 months”, “use sentences, not single words to create passphrases”, “make sure they are totally random with letters, numbers and special characters!” or “use dice to make a random password every time!”

You’ve probably heard tons of unhelpful or contradictory rules or policies for creating strong passwords…

It’s difficult to say what the best method is for making passwords and it’s much harder to say how you’re supposed to remember the dozens of different passwords you need. Especially if you’re using a different password to log into your e-mail address, order pizza online, connect on social media and book your next meet-cute on a dating website. If you can’t write them down it seems like you’re going to forget them. Having to reset your passwords constantly isn’t great for your account security and it gets tedious.

Considering using a password manager instead…

Consider using a password manager instead. A password manager can make your life a lot easier and more secure. Password managers are programs that help you create strong passwords and store them in a secure database. Instead of memorizing dozens of unique passwords you only have to remember the one needed to open your password file.

When it comes to managing your online accounts securely, password managers are a blessing. There are password managers available for Windows, Mac, Linux and mobile devices including both Android and Apple phones. There are even online services that will store your passwords securely in the cloud for a subscription fee (but don’t run out and get one of these just yet, more in a minute).

Password managers come highly recommended by many digital security professionals, they make managing dozens, even hundreds unique passwords easy. With that being said, there are some limitations you need to be aware of before you dive in.

  1. Password managers kept on your computer use encrypted key files. Which means that when you create a password file, you are the only person who knows the password to open that file. If you forget your master password, you’ll have to manually reset all your passwords and start over. Still, not a bad trade-off compared to having your account breached because of password re-use.
  2. Cloud password managers work on almost every platform and synchronize your passwords automatically. The problem? They are also a popular target of online criminals. So before you run out and pay for a subscription, do your research. Has the cloud password manager you’re looking at had a data breach before? That might be a good warning sign to steer clear.
  3. You still need to make sure your computer and browser are free of malware that might steal your passwords. If someone is shoulder surfing, or digitally shoulder surfing your password manager they might know your master key.

Here are a few password managers the Security Matters team uses themselves:

PC/Windows:

Mac:

Cloud/Mobile:

Over the next few weeks the Security Matters team will provide some tutorials for how to use this software.

Feature Image: “frtknx”, is a derivative of “050/365 | Fort Knox” by keepingtime_ca, used under CC BY. “050/365 | Fort Knox” is licensed under CC BY by Alex Dean Cybulski

Having one password makes you easy prey in the era of the data breach

June 5, 2017

On May 5th, 2017 a massive trove of 457,962,538 stolen usernames and passwords from various data breaches known as the “Anti-Public” list was uploaded onto the Internet for any criminal to use.

It might surprise you to find out that online crooks freely share and trade these password caches, or that data breaches are practically a daily occurrence.

What is troubling about the Anti-Public list specifically, is that it combines password information from multiple data breaches. Combo lists give any criminal with access to these lists the ability to see which users have the same password for all of their accounts. Even if you use a two or three different passwords, it makes breaching your accounts mere guesswork. Armed with this knowledge, any jerk can compromise the account of someone who re-uses passwords, they don’t even have to be a talented hacker.

Combo lists are compelling evidence that you should never re-use the same password for different websites.

Combo lists are compelling evidence that you should never re-use the same password for different websites. Should your password get stolen by a phishing attack, or should one website you use get breached, that password will be known to just about anyone, forever! Even if you change passwords after a data breach you might forget about another, leaving yourself open to further compromise. That’s assuming you ever find out that your password has been compromised in the first place!

Instead, try to use a unique password for every site you access. Unique passwords make it impossible for criminals to simply guess their way into your online accounts. Online crime is all about opportunity, so if your accounts present a challenge they’ll move on to the next person who re-uses their passwords.

Using one password paints a huge target on your back, the digital equivalent of advertising that you keep your house keys under the doormat.

Using one password paints a huge target on your back, the digital equivalent of advertising that you keep your house keys under the doormat.

So, if there’s one thing you need to take away from reading it’s this: Always make a unique password for every online account. Never re-use the same password.

In our next post, we talk about the advantages of using a password manager to help you create strong, unique passwords and keep track of them.

Featured image: “badpassword”, is a derivative of “Key 66/365” by massmatt, used under CC BY. “Key 66/36” is licensed under CC BY by Alex Dean Cybulski.

WannaCry: what U of T community should know about the malware attack

May 16, 2017

Originally published via U of T News

Currently, no incidents of malware infection have been reported to U of T’s information security team since the WannaCry attack began on Friday.

WannaCry targets unpatched Microsoft Windows computers and then locks the machine’s contents from the user – pending the payment of a ransom amount. WannaCry propagates by identifying and infecting other unpatched machines on a network.

What U of T is doing:

Defences are in place at multiple network locations/gateways to block incoming attacks.

The information security team is constantly scanning the university networks to identify unpatched equipment that is using outdated and unsupported operating systems such as Windows XP, and to notifying appropriate administrators about the need to patch the devices.

What you should do:

  • Be careful with e-mail messages. Do not open any messages with offers that are too good to be true. For example, beware of messages from the CRA about your income tax refund, banks asking for your credentials, or emails prompting you to open an attachment.
  • Keep your devices up-to-date. Install security updates and patches, particularly those identified as being “critical.” Consider ALL your devices, not just machines used at work, as being at risk.
  • Maintain backups. The existence and integrity of data and system backups is critical to protecting your data and maintaining availability in case of a compromised device. If you are unsure as to whether your devices are backed up, check with your local IT team.

For additional information and support, please contact your local IT team. Additional resources are available from the information security department and at the security awareness site.

Send.utoronto.ca: helping you ‘detach from e-mail attachments’

May 15, 2017

Ever get a computer virus from an e-mail? Know someone who has? The answer to both of these questions is usually a resounding “yes.”

Despite the fact that e-mail has been around for a few decades there are a ton of glaring security flaws in one of the web’s most common mediums for communication. E-mail users are susceptible to malicious e-mails known as phishing, fraudulent e-mails from individuals posing as others using a technique known as ‘spoofing’ and infections from malicious computer programs, known as viruses or malware.

Despite the fact that e-mail has been around for a few decades there are a ton of glaring security flaws in one of the web’s most common mediums for communication.

Last Friday at least 45,000 computers in more that 74 countries, including hospitals and other medical care providers were hit with malware, a malicious computer program known as WannaCry/Wcry. True to it’s name the WannaCry malware forces infected users to pay its creators $600 dollars in bitcoin after three days of becoming infected or their files are destroyed permanently.

Malware infections like WannaCry can spread in a number of ways, often by attacking computers with vulnerable connections to the Internet, or though e-mail attachments.

The timely demands of our academic and/or professional lives, not to mention the limited security of e-mail contribute heavily to the possibility of becoming infected with ransomware through malicious e-mail attachments.

Like last week, we always recommend that you treat all file attachments like strangers at your door. Ask yourself: “Was I expecting a file from the person?” Instead of blindly opening the attachment call or text the sender to confirm that they sent you a file. Remember: taking 30 seconds could save you hours trying to fix your PC, or in this case $600 dollars.

The other approach you might want to consider is ‘detaching from attachments’, the slogan of the Tibetan Action Institute, which encourages individuals to avoid sharing files over e-mail and instead use a storage service.

Detach From Attachments! English subtitles from Tibet Action Institute on Vimeo.

If you are a student, staff or faculty member at the University of Toronto you have access to https://send.utoronto.ca, a utility that allows you to share files with others at the University.

If you are a student, staff or faculty member at the University of Toronto you have access to send.utoronto.ca, a utility that allows you to share files with others at the University. “Send” is incredibly useful because it allows you to share files with other U of T users over the University’s network, making it ideal for transmitting academic or professional data, even sensitive information including intellectual property and research data can be shared using this service, provided you use an additional layer of encryption to protect it.

Drop-off allows you to upload a file that you want to share with another user.

Pick-up allows you to retrieve a file someone has sent you using send.utoronto.ca.

Request a Drop-off allows you to send a notice to another person that you’d like them to send you a specific file.

send.utoronto.ca is useful for numerous reasons:

  1. It provides you with an additional layer of security by keeping potentially malicious e-mail attachments out of your inbox.
  2. It can be used to store files up to 500 megabytes, helpful for sending large files that won’t fit in an e-mail attachment.
  3. It stores the files on the University of Toronto’s network.
  4. It allows you to share the files with anyone once they have the ‘Claim ID’ and ‘Claim Passcode’.
  5. It allows you to exchange sensitive, personal or private information involving University research or business provided it is encrypted.

Keep in mind:

“Send” only hosts files for 14 days before they are deleted, so it is not suitable for long-term storage. Additionally, send cannot be used to exchange copyrighted material that you do not have permission to exchange including books, music or any other kind of copyrighted media.

Tales from the phish bowl: how a million gmail users got hacked on Thursday

May 5, 2017

It’s four o’clock in the afternoon on a Thursday. You’re over the work week hump, vacation day tomorrow, maybe. The phone buzzes. It’s Gmail, letting you know that your friend Joe has invited you to edit a Google Doc. You open the invite and click on the big blue “Open in Docs” button like you’ve done a thousand times before. A window pops up telling you that ‘Google Docs’ would like permission to “read, send, delete and manage your e-mail” and “manage your contacts.” Annoying. Did you clear your cache recently or something? You click “allow” because it’s already 4:30 and you just want to see what’s going on in this doc before you go home; tomorrow you’ll attack whatever this document is. Weird. Instead of taking you to a doc the last box you clicked on took you back to your Gmail inbox. Now twenty of your friends are texting you wondering why you’re inviting them to edit a Google Doc. This is bad.

This scenario might be familiar to one million Gmail users who had their accounts hacked on Thursday by a sophisticated phishing scam, a malicious e-mail designed to trick them into giving a hacker access to their inbox. The worst part? Despite Google’s massive security budget, it came down to those users making a decision to click on a few links, links that under normal circumstances should have been trustworthy.

Phishing is tricky like that. The software industry spends billions of dollars on their security budgets, we can all use two factor authentication, complex passwords and encrypted traffic over SSL – all great defenses against online criminals. However, when it comes your inbox the best line of defense against a phish is a critical eye for e-mail.

Many criminals know this, which is why they send e-mails at 10am on a Tuesday morning or at 3pm on a Thursday afternoon. They want to catch you when you’re working hard and aren’t always thinking clearly as you trudge through the work week.

“The best line of defense against a phish is a critical eye for e-mail.”

The first question you should ask yourself whenever you get an e-mail with a link or file attachment is “Was I expecting this?” chances are if you work with someone they are going to tell if that they are sending you a file or a link before they send it to you. If you get an e-mail with a link or attachment you weren’t expecting, send a text message or call that person to confirm to origin of the message.

Treat e-mail with links or files attachments like strangers at your door. You wouldn’t open your door to strangers, so don’t click on any links or open any files without figuring out first if they are who they say they are. Use your best judgment and it shouldn’t be too much work. Remember if your e-mail does get hacked it is going to take way longer to wrestle back control of your account. Taking 30 seconds before opening something untrustworthy might save you a few hours and some heartache later.

“The first question you should ask yourself whenever you get an e-mail with a link or file attachment is “Was I expecting this?“”

Many phishing attacks are given away by who they are sent from: always check the ‘from’ and ‘to’ address on e-mails with files and links. You’ll notice that the google doc was addressed to “hhhhhhhhhhhhh@gmail.com”, weird right? Odd traits, unofficial addresses and bizarre typos are usually the a good sign that someone is trying to trick you with an e-mail. This isn’t a ‘silver bullet’ though. Online criminals might imitate a friendly e-mail address using a technique called “spoofing” where they imitate an e-mail address you trust. If a hacker is hoping you’ll click on a malicious link or open an infected file, then they can send you an e-mail from justin.trudeau@canada.ca, because they don’t need you to reply!

Finally, you should check out https://securitymatters.utoronto.ca/phish-bowl/ if you get a suspicious e-mail and want to see if the UofT Information Security Team has already caught similar offenders. We keep our phishbowl regularly updated with recent phishing attacks.

-Alex Dean Cybulski

Phish bowl – a new resource

May 1, 2017

We are pleased to announce a new resource available to our community, the Phish Bowl. It is as simple as it sounds! As we spot phishing emails circulating U of T inboxes, we will post the message contents and a screenshot of the message to our collection of phishing emails in the Phish Bowl. 

By providing a collection of verified phishing messages, the community can use this resource to cross check messages they receive when they are not sure if the email message is a phishing attempt or not. In addition, by accessing this resource on regular basis, we hope that faculty, staff and students can become skilled at instantly spotting phishing messages by recognizing common indicators.

If you would like to contribute a screenshot of a phishing message, please email us with your submission.

Security in the news

April 19, 2017

Spotlight on Travel Security

While you may think you don’t have anything to hide, your personal privacy and protecting institutional data are important considerations when planning to travel for leisure or work. In this climate of heightened border security, where device searches at the border are prominent in the news, we thought this would be a good opportunity to visit some of the ways in which you can travel more securely.

Our smartphones and other electronic devices store detailed accounts of our conversations, professional lives, whereabouts, and web-browsing habits. They paint a far more detailed picture of our private lives than, say, a piece of luggage.

Tips for maintaining privacy and securing your devices at border crossings and while you are away

Do border agents have the right to search or seize your device? Can they require you to provide passwords to your various social media accounts or apps? You betcha! The laws are fairly grey and yes, you can say “no” to any request to search your devices at the border, but of course, border security can always turn you away for non-compliance.

  • Bring a clean device.
  • Is it possible to take a loaner device? If so, this is an opportunity to bring only data that you require for work while travelling and the device can be wiped upon return.
  • Travel with reduced information.
  • Keep phone numbers, email addresses, and contacts to a minimum. An example of contacts you may not want to be easily searched: Research study participants…
  • Enable security features on your device. Two factor authentication. Strong passwords. Encrypted storage. Save your data, reset to factory defaults, and restore your backup when you return.
  • Review your email or network connected file storage.
  • When you login to your mobile device, your email is generally viewable to a border agent. Consider what information is available in your inbox, sent mail, or other folders. If you have files available (via Sharepoint for example), review access to that content.
  • Use a VPN to access sensitive information.
  • Web-based VPN services can be used to access sensitive information while travelling (assuming the country doesn’t block such service). Using a web-based VPN rather than a standard client-based VPN may reduce the risk of a border agent asking you to activate it.

There is no dearth of information on how to protect your privacy and data while travelling and the points above are not exhaustive. But,they do offer a few handy suggestions to consider while preparing to travel. For more in depth articles and advice view the articles listed below:

Travel to High risk countries

https://uit.stanford.edu/security/travel/high-risk-countries-recommendations

Travel to China or Russia

http://security.uri.edu/travel/travel-to-china-or-russia/

This tax season: protect yourself against fraud

February 21, 2017

A message from U of T’s Central Payroll Services

It is tax time again and with that we see an increase in the number of fraudulent communications claiming to be from the Canada Revenue Agency (CRA). These include phishing emails, calls, texts or mail.

Please be aware that the Canada Revenue Agency (CRA) does not:

  • Send emails with links or ask you to divulge personal or financial information
  • Ask for personal information of any kind by email or text message
  • Request payments by prepaid credit cards
  • Give taxpayer information to another person, unless formal authorization is provided by the taxpayer
  • Leave personal information on voicemail services

When in doubt, ask yourself the following:

  • Did I sign up to receive online mail through My Account, My Business Account, or Represent a Client?
  • Did I provide my email address on my income tax and benefit return to receive mail online?
  • Am I expecting more money from the CRA?
  • Does this sound too good to be true?
  • Is the requester asking for information I would not provide in my tax return?
  • Is the requester asking for information I know the CRA already has on file for me?

You should never respond to these fraudulent communications, including emails or telephone messages, or click on any of the links provided.

Learn more about how to recognize a scam.

Watch this video: Beware of scammers posting as CRA employees.