Maintenance on the E-mail system has been rescheduled for Saturday, July 11, between 8:00 a.m. and 12:00 p.m. During this maintenance window, access to e-mail may be unavailable on your primary server. Access to your e-mail via your alternate server should be available automatically when accessing through VCU Mail Anywhere, or via your alternate server using an IMAP connection or the Notes client.
CAUTION: DO NOT OPEN EMAIL OR ATTACHMENTS CLAIMING TO BE SOPHOS ANTIVIRUS UPDATES.
Sophos Antivirus never distributes updates by email, and all Sophos Antivirus clients provided by VCU are configured to update themselves automatically when connected to the internet.
Email messages claiming to be Sophos Antivirus updates have begun circulating around the internet, according to Sophos. The emails contain an executable attachment that will infect computers with a virus. Current samples of the scam have the subject "Update your SOPHOS IDE scanner" and contain an attachment named "SOPHOS IDE scanner.rar".
The text and filenames could change, however. Do not trust any email claiming to provide updates to a Sophos product.
IT staff have discovered an email phishing scam which asks the recipient to reply with their username, password, data of birth and country/territory. Like many phishing scams, it takes advantage of the recipient's fear and presents a sense of urgency.
The email has a subject of "YOUR EMAIL ACCOUNT MAY BE DELETED IN TWO DAYS (VERY URGENT)". Not only does it ask for your password to be sent (you should never share your password with anyone), it asks for it to be sent to an email address hosted on gmail.com.
Many of the emails were sent from the email account of a VCU staff member. Even if an email requesting your password or confidential information is sent from a VCU email address, do not share it! It's likely that the sender's email address was spoofed or that the sender's email account has been compromised and is under the control of a spammer or phisher. It's as trivial for someone to spoof a sender email address as it is for someone to put a fake return address on an envelope and mail it.
If confidential information is requested and your uncertain whether the request is legitimate or whether you should share the information being requested, ask your supervisor and contact the sender via phone (but do not call a phone number in the email since it could be the phisher's phone number).
The email states that unused email accounts are being deleted and that you need to respond if you are still using your account.
Phishing scams often take advantage of the recipient's fear or greed and this one is no exception.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
To learn more about how phishing works, what phishers might ask for, how they'll try to get you to share info., signs of a potential attack and how to protect yourself, visit our Phishing page.
For additional information security news, tips and more, view our Twitter page via the Web or your handheld device.
Email Services is aware on an issue experienced with users who have Internet Explorer 8 as their default browser and attempt to launch a url link from Lotus Notes 8.5, Outlook, or Firefox. Sophos support is investigating this issue. Temporary workarounds including launching IE 8 and leaving open, clicking the url again, or changing the default browser from IE8. For additional assistance contact the Help Desk at 828-2227.
IT staff have discovered an email phishing scam which ask the recipient to reply with their username, password, data of birth and country/territory. Like many phishing scams, it takes advantage of the recipient's fear and presents a sense of urgency.
The email has a subject of "YOUR EMAIL ACCOUNT MAY BE DELETED IN TWO DAYS (VERY URGENT)". Not only does it ask for your password to be sent (you should never share your password with anyone), it asks for it to be sent to an email address hosted on gmail.com.
The email states that unused email accounts are being deleted and that you need to respond if you are still using your account.
Phishing scams often take advantage of the recipient's fear or greed and this one is no exception.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
To learn more about how phishing works, what phishers might ask for, how they'll try to get you to share info., signs of a potential attack and how to protect yourself, visit our Phishing page.
For additional information security news, tips and more, view our Twitter page via the Web or your handheld device.
IT staff have discovered an email phishing scam which ask the recipient to visit a web page that isn't controlled by VCU, and in turn enter their email address, username and password. Like many phishing scams, it takes advantage of the recipient's fear and present a sense of urgency.
The email has a subject of "Important: Email Account Verification Update!!". The sender may be someone with a VCU email address or it may be someone with a non-VCU email address. Several VCU users have fallen for it and their email accounts have been used to send the phishing scam email to more VCU users.
The email states that you have exceeded your mailbox storage quota and that you need to supply your login credentials to reactivate your account (which doesn't even make sense since you can see that you can still send and receive email).
Please note that if you use the Firefox browser to attempt to visit the web page that the phisher tries to get you to visit, it warns you "Reported Web Forgery!" and asks if you're sure that you want to visit the page. Internet Explorer does not.
Phishing scams often take advantage of the recipient's fear or greed and this one is no exception.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
To learn more about how phishing works, what phishers might ask for, how they'll try to get you to share info., signs of a potential attack and how to protect yourself, visit our Phishing page.
For additional information security news, tips and more, view our Twitter page via the Web or your handheld device.
IT staff have discovered a phishing scam email which ask the recipient to reply with their password. Both take advantage of the recipient's fear and present a sense of urgency.
One email has a subject of "Vcu Upgrade Notification" and the other has a subject of "IMPORTANT VCU.edu® Account NOTICE". It claims to be from "Susan Niles, vcu.edu Customer Relations Manager" and states that due to a system failure information related to your account is missing and your account will be terminated if you don't respond with your username, name, password and next of kin within 48 hours.
Phishing scams often take advantage of the recipient's fear or greed and this one is no exception.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
To learn more about how phishing works, what phishers might ask for, how they'll try to get you to share info., signs of a potential attack and how to protect yourself, visit our Phishing page.
For additional information security news, tips and more, view our Twitter page via the Web or your handheld device.
IT staff have discovered a phishing scam email which asks the recipient to reply with their password. It takes advantage of the recipient's fear and presents a sense of urgency.
The email has a subject of "YOUR ACCOUNT MAY BE DELETED IN TWO DAYS TIME". It claims to be from "VCU (Virginia Commonwealth University)
web-mail Customer Care" and asks the sender to reply to to an email address that was not a vcu.edu email address. Some of the emails were sent from a VCU user's email account which had been compromised.
The email tells the recipient that "web_mail" accounts are being shut down due to a problem that was discovered and asks the recipient to send their username, password, date of birth and country or territory to avoid having their account suspended.
VCU prohibits sharing your password
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
How does phishing affect me and VCU?
A number of users responded to the email, in some cases sending their VCU eID password to the phisher, in some cases to the VCU student's email account which had been compromised and in some cases to the VCU Information Security Officer.
When VCU IT staff become aware of a VCU user who shared their password, their password is expired for their own safety so that an unauthorized person can't use it.
Once an unauthorized person has your username and password, they can use it to access systems you have access to, which may give them access to your confidential data and university confidential data. Phishers will often use this access to send thousands of emails to others from your email account.
What if I receive a phishing email?
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.
Want to learn more about phishing?
To learn more about phishing, including how phishing works, what phishers might ask for, how they'll encourage you to share information, signs of a phishing attack, how to protect yourself and what to do if you receive a phishing communication, visit Information Security's phishing page. And remember, VCU and other reputable organizations will never use email to request that you reply with your password, Social Security number or confidential personal information.
The university's Sametime Instant Messaging server - Spruce - will undergo a hardware and software upgrade on February 28, 2009 from 8:00 am until 12:00 pm. During this time, instant messaging services will not be available. After the upgrade, if you are prompted for a password -- please use your eID password. Note this is a change from the previous version of Sametime. If you have any questions regarding the upgrade, please contact Doctor Notes at dnotes@vcu.edu
VCU is moving to a cloud computing student email solution. Cloud computing email means outsourcing an application such as email and making it available over the internet. This allows students to sign-up for and use without any concern about where, how, or by whom the compute cycles and storage are provided. The university is looking at two vendors: Google and Microsoft.
UPDATE - This maintenance is complete and all pending mail has been delivered to Blackberries.
The Enterprise Blackberry Server, Walnut, will be unavailable from 7:00 a.m. until 8:00 a.m. February 21, 2009, for hardware maintenance. A system battery will be replaced in the Blackberry Server at this time. Mail being sent to the Blackberry server will be queued for delivery. You may access your e-mail via VCU Mail Anywhere, the Lotus Notes client software or IMAP while the Blackberry server is undergoing maintenance.
Scheduled maintenance will be performed on the E-mail system Saturday, February 7, between 8:00 a.m. and 1:00 p.m. During this maintenance window, access to e-mail may be unavailable on your primary server. Access to your e-mail via your alternate server should be available automatically when accessing through VCU Mail Anywhere, or via your alternate server using an IMAP connection or the Notes client.
Email Services is aware of intermittent issues with authentication to VCU Mail Anywhere to the eDirectory. Users should wait 15 minutes and try again. This issue continues to be investigated.
IT staff have discovered two phishing scam emails which ask the recipient to reply with their password. Both take advantage of the recipient's fear and present a sense of urgency.
One email has a subject of "Vcu Upgrade Notification" and the other has a subject of "Dear Vcu Mail User". Both claim to be from "Vcu Help Desk", have a sender name of Help Desk Services" and a spoofed email address of "info@vcu.edu". The reply-to email address is "h.desks7@ymail.com".
The first email tells the recipient that maintenance is being done on VCU email accounts and the user's password is needed, otherwise the user's account may be suspended.
The second email tells the recipient that their mailbox has reached 18 MB in size and that if it reaches 25 MB, incoming email will be blocked. Not surprisingly, the user's password is needed to address the issue.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
A user responded to both emails with her password and other details that were requested. As a result, the user's email account was compromised and used to send out thousands of spam emails.
The resulting flood of spam from VCU's servers sometimes results in the recipients' ISPs blocking email from all VCU users. Though these phishers aren't generally interested in your personal information, with your password they could read your email and access other resources with your account, such as Blackboard, the portal, and Banner Self Service.
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.