Security News

Valentines Storm Worm Update

David Bullock — Thu, 14 Feb 2008 23:23:58 -0500

The FBI has issued a warning in regards to the recent upsurge in Storm Worm activity. Several emails have been in circulation throughout the URI network that include subject lines like "You stay in my heart." Do not click on any links contained within these emails! If you have clicked on a link, please contact the Helpdesk (874-HELP) immediately! For more information, see the FBI press release.

Valentines Storm Worm

David Bullock — Wed, 13 Feb 2008 12:21:06 -0500

The latest variation of the Storm Worm is making its rounds and this time capitalizing on Valentine's Day. For those who are not familiar with Storm, wikipedia has a good explanation. Do not click on any links found in emails that contain subject lines like "Sweetest Things Aren't Things!, Valentine's Day, The Love Train." For more information, check out the following links:

Email Scam Warning

David Bullock — Fri, 08 Feb 2008 14:25:47 -0500

As of late, a number of individuals from various universities have reported receiving threatening emails from a hired assassin demanding payment from the recipient in order to spare his/her life. The email looks something like this: I am very sorry for you Xxxxxx, is a pity that this is how your life is going to end as soon as you don't comply. As you can see there is no need of introducing myself to you because I don't have any business with you, my duty as I am mailing you now is just to KILL you and I have to do it as I have already been paid for that. Someone you call a friend wants you Dead by all means, and the person have spent a lot of money on this, the person also came to us and told me that he wanted you dead and he provided us with your name ,picture and other necessary information's we needed about you. So I sent my boys to track you down and they have carried out the necessary investigation needed for the operation on you, and they have done that but I told them not to kill you that I will like to contact you and see if your life is Important to you or not since their findings shows that you are innocent. I called my client back and ask him of your email address which I didn't tell him what I wanted to do with it and he gave it to me and I am using it to contact you now. As I am writing to you now my men are monitoring you and they are telling me everything about you. Now do you want to LIVE OR DIE? As someone has paid us to kill you. Get back to me now if you are ready to pay some fees to spare your life, $10,000 is all you need to spend You will first of all pay $5,000 then I will send a tape to you which i recorded every discussion i had with the person who wanted you dead and as soon as you get the tape, you will pay the remaining $5,000. If you are not ready for my help, then I will carry on with my job straight-up. WARNING: DO NOT THINK OF CONTACTING THE POLICE OR EVEN TELLING ANYONE BECAUSE I WILL KNOW.REMEMBER, SOMEONE WHO KNOWS YOU VERY WELL WANT YOU DEAD! I WILL EXTEND IT TO YOUR FAMILY, INCASE I NOTICE SOMETHING FUNNY. DO NOT COME OUT ONCE IT IS 7:PM UNTIL I MAKE OUT TIME TO SEE YOU AND GIVE YOU THE TAPE OF MY DISCUSSION WITH THE PERSON WHO WANT YOU DEAD THEN YOU CAN USE IT TO TAKE ANY LEGAL ACTION. GOOD LUCK AS I AWAIT YOUR REPLY . GET BACK TO ME: xxxxx@xxxx.com For more information, see the FBI has an article HERE

SafeConnect Mailing List

David Bullock — Wed, 30 Jan 2008 12:03:12 -0500

A mailing list has been created for the SafeConnect network access control. For anyone interested, please feel free to join! LINK

Malware for Mac in the wild

David Bullock — Fri, 02 Nov 2007 14:27:05 -0400

The Internet Storm Center is reporting that the Mac DNS changer Trojan is in the wild. For further information see the ISC article. Only run programs from trusted sources.

Critical Vulnerabilities in Adobe Reader and Adobe Acrobat

David Batastini (Davidb -at -uri.edu) — Tue, 23 Oct 2007 13:02:41 -0400

Adobe has released several updates for their Adobe Acrobat and Adobe Reader programs. The flaws in these programs could be exploited to circumvent security measures, read and manipulate data, and compromise computers. Please update accordingly. The reader patch is available here The acrobat patch is available here

ITS Security wiki back up and running

David Batastini (Davidb -at -uri.edu) — Thu, 23 Aug 2007 17:22:49 -0400

The ITS Security page is back up and running. http://www.uri.edu/security/wiki/ITS_Security We will continue to make additions as time continues, please feel free to contact us with suggestions.

Storm Worm E-mail

David Batastini (Davidb -at -uri.edu) — Tue, 21 Aug 2007 13:53:31 -0400

As of this morning, the Storm Worm has migrated to a new variant, attempting to lure victims into uncharted waters. The E-mails with the subject: Login Info contain links to various malware and viruses. Please do not click on these links. The e-mails look like the following: Subject: Login Information Dear Member, Are you ready to have fun at [insert group here]. Account Number: 73422529174753 Your Temp. Login ID: user3559 Temorary Password: jz438 Please Change your login and change your Login Information. This link will allow you to securely change your login info: http://[insert malicious link here] Thank You, New Member Technical Support [insert group here] As always, do no click on links or open any attachments from people you do not know. David Batastini URI Info Security

SafeConnect Dorm Deployment

David Batastini (Davidb -at -uri.edu) — Tue, 21 Aug 2007 11:00:01 -0400

SafeConnect will go live today and 12:00 EDT, in the URI Residence Halls. Students will have to complete the registration process prior to accessing the internet. For more information, please see the SafeConnect website, (www.uri.edu/security/safeconnect) or contact the University Helpdesk (874-HELP)

ITS Security wiki page currently down for maintenance

David Bullock — Tue, 21 Aug 2007 10:54:37 -0400

The ITS Security wiki page is currently down for maintenance. Estimated downtime is unknown at this time. Navigating to Security pages could result in a "page not found" error. We are aware of the problem, and working towards a solution. For more information please contact the Information Security office at 874-4787.