A targeted phishing message was received on campus appearing as an expiration notice for access to bCourses. The message attempted to trick recipients to login with CalNet credentials to prevent access expiration
January 25, 2017
January 24, 2017
As tax season begins, W-2 wage statements have already begun to be made available online this week. Last year, several convincing phishing messages were crafted by tax scammers and sent to Campus to trick victims into divulging personal information for criminal purposes.
These fraudsters use your stolen credentials and tax documents to commit identity theft, and file a fraudulent tax return with the IRS in order to collect a refund using your identity.
This was the first tax season related phishing message reported on campus this year. Beware of phishing messages containing fake instructions for downloading your W2 form.
January 20, 2017
Campus printers have received unwanted printouts in recent weeks. Report any unwanted printouts to CSS-IT and Information Security and Policy.
January 3, 2017
This very simple phishing message that appeared to be sent from FedEx was effective in convincing several campus recipients to download the PDF attachment. The file contained a link that required password authentication, allowing the attacker to capture these credentials for future use.
December 14, 2016
On Dec. 14th, the campus was the target of a phishing email purporting to be from Chancellor Dirks and containing a PDF file attachment with a link to a site intended to steal credentials. Beware of emails with the subject line "Important Announcement from Chancellor B. Dirks".
October 28, 2016
A pretty convincing phishing message that appears to come from CSS-IT issuing a warning that the user's ID may have been compromised.
October 24, 2016
A local privilege escalation vulnerability has been found in the Linux kernel. Nearly all versions of Linux are affected, and when exploited, attackers can escalate local privileges to root. Linux users are advised to patch or implement temporary mitigation immediately.
October 20, 2016
This phishing message, purportedly from Bank of America, contained multiple threats - two file attachments that likely contain malware and a separate ploy to obtain user credentials.
August 24, 2016
There has been a recent spate of email messages to campus containing the Locky ransomware virus in file attachments. The format of the message content is very similar.
July 13, 2016
Highly critical remote code execution vulnerabilities have been announced by the Drupal security team for the third-party modules RESTWS, Coder, and Webform Multiple File Upload. Open Berkeley Drupal sites are NOT affected.
June 29, 2016
Multiple, critical vulnerabilities have been discovered in Symantec products including Symantec Endpoint Protection (SEP), an anti-virus product previously licensed and distributed on campus. Users are advised to remove or upgrade affected Symantec products.
June 13, 2016
Apple has announced that it will no longer support Quicktime on Windows. All users are advised to remove Quicktime on Windows machines as there are multiple zero-day, remote code execution vulnerabilities that Apple has announced they will not be patching.
May 24, 2016
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild. Please refer to APSA16-02 for additional details.
May 23, 2016
Another targeted phishing message, this one has been spoofed to appear to come from the Office of the Registrar.
May 20, 2016
Several people on campus reported this targeted phishing message concerning access to bCourses. The message was signed by a fictitious member of the Security department.
May 17, 2016
The US-CERT (US Computer Emergency Readiness Team) has issued a recent alert concerning ransomware. Ransomware is a type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it. The alert warns that in early 2016, destructive ransomware variants such as
May 10, 2016
ISP has enabled Google Analytics so that we can better learn how people use our website. As a result, our privacy policy has been updated.
May 5, 2016
Multiple Vulnerabilities have been discovered in ImageMagick, an open-source software library for displaying, converting, and editing a wide range of image types. Attackers may be able to execute arbitrary code remotely by exploiting this vulnerability.
April 28, 2016
Information Security and Policy has received confirmed reports of recent attempts to deliver the "Locky" family of Ransomware via malicious email attachments. Campus users are advised to be vigilant as Ransomware like Locky can be extremely destructive. Please review the full security alert for guidance.