Phishers Break-in E-mail System of Carolina State University

On July 9, 2009, e-mail users of NCSU (North Carolina State University, USA) faced a new slicker phishing mail attack.

After business hours on July 9, 2009 night, a mail appeared in the inboxes of 800 people at the university. This email was quite different from others that Office of Information Technology (OIT) had been getting. It had the subject line "Mandatory Security Update: July 2009."

The mail, which asserted to be from the university's IT Help Desk (it_dept@ncsu.edu), claimed that all e-mail users need to click on a link to the mail sign-in page of the university and enter their username and password. This step is taken to block unnecessary e-mails or spam.

The mail addresses did not have a respond to address. In its place, the message directs to click on the link in the message to login and make sure that account was updated. The mail was in the HTML format and had a link to a copy of the webmail login screen.

IT security officer of the university, Tim Gurganus, said that phishers or people, who sent the messages in order to steal passwords or other private details, were to blame, as per the reports by CHRONICLE on July 16, 2009.

Gurganus further said - he had earlier come across phishers who try to get victims to reply via mail with their private details, but he had not seen the technique, with a bogus sign-in page. He also stated that it was a well-implemented attack. There were no grammatical errors and the university's address was also correct.

The mail carries hint of being phony such as the URL of the link was supposed to be (http://ncsu.edu.ec-uk.org/) but did not use https and the domain of that URL did not finished with ncsu.edu.

Spammers have been hitting universities with their phishing attacks. In June 2009, phishers sent mails to the students of the University of lowa. The mail told them to click on a link to validate their account and expand its quota, which had allegedly been exceeded.

Related article: Phishers Expand Their Sphere of Attacks

» SPAMfighter News - 8/6/2009