Safety and Security

Here you can find information about protecting your computer and yourself.

Computer Viruses & Fraud

Ensuring the security of your information is a continual process and also your responsibility as a computer user.

How to Protect Your Computer

Computer Security:

Why should I do it?

Ways to be aware:

More information about data protection can be found at:

Computer Viruses

What is a computer virus?

A computer virus or malware is a commonly used term to describe all types of malicious software including Trojans, worms, adware, and spyware. Each have slightly different functions, but usually either try and damage the software on your computer, or send information about your computer usage to an outside source over the internet. The details of each type are explained below:

Types of computer viruses

Trojans: A Trojan, as the name suggests, pretends to be something good, like virus scanning software or other useful applications. In reality they run malicious programs in the background that can perform any number of functions, like allowing an outside user to copy your files, see your browsing history, or even take remote control of your computer.

Worms: A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other computers on the network, and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or devour files on a targeted computer.

Adware: Adware or advertising-supported software is any software package which automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. Adware is usually seen by the developer as a way to recover development costs, and in some cases it may allow the software to be provided to the user free of charge or at a reduced price. As a result, the advertisements may be seen by the user as interruptions, annoyances or as distractions from the task at hand.

Spyware: Spyware is computer software that is unknowingly installed on a personal computer to collect information about a user, their computer or browsing habits without the user's informed consent. Spyware programs can collect various types of personal information, such as Internet surfing habits and sites that have been visited, but can also interfere with user control of the computer in other ways, such as installing additional software and redirecting Web browser activity. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of Internet or functionality of other programs.

How can my computer become infected?

Unfortunately, there are many ways your computer can become infected. Some of the main causes to an infected computer included: illegally downloading music and movies, clicking on ads, browsing to compromised websites, and in general not being cautious when it comes to web browsing. Be sure to follow the safe browsing habits and remember, it's always better to be safe then to be sorry.

What are the symptoms of a virus?

There is a wide variety of virus symptoms that differ based on what type of infection you have and how far the virus has progressed. A list of common symptoms is listed below:

  • Speed decrease
  • Unexplained freezing/crashing
  • Programs that won’t launch
  • New programs won’t install
  • Computer has trouble booting windows
  • Internet access is blocked (completely or certain sites)
  • Desktop/appearance/screen saver and other visual settings are changed unexpectedly
  • Unable to open files or folders
  • Files or folders are deleted unexpectedly
  • False pop-ups that appear warning you about viruses
  • Deteriorating condition over a period of a few days to a few weeks (viruses that download more malicious software as time goes on)
  • Unable to print documents
  • Your hard disk runs out of free space (this comes from an infected file making copies of itself)

How can I protect myself?

  • For a personally owned computer, use the university sponsored anti-virus program, Symantec Endpoint Protection. If your computer is university owned, please talk to your computer support group for assistance.
  • Keep your computer's operating system up to date using Windows Update or Software Update on Mac.
  • Read "How to recognize a Fake Virus Alert Message."
  • NEVER use file sharing programs to download games, music, movies, TV shows, etc. A large majority of the files shared on this network are infected.
  • NEVER click advertisements on the Internet.
  • NEVER give anyone your password.
  • NEVER respond to SPAM.
  • READ all warnings very carefully.
  • EDUCATE yourself, your friends and family about infections.
  • NEVER click OK or cancel to warnings like this:

How can I scan and remove a virus infection?

The first order of business is to get anti-virus software. Students and faculty can download Symantec Endpoint Protection for free at the OSUware website, but the protection shouldn't stop there. We also recommend downloading other virus scanning tools, here at the OSU Computer Helpdesk we often use Malwarebytes and SUPERAntiSpyware both of which are available for free.

Click HERE to watch a tutorial about running a virus scan with Malwarebytes.

After obtaining the software simply run the program and have it scan for viruses. A good habit to exercise before each scan is to double check that the software's definitions are up-to-date. In order to update the definitions there should be either a tab or button that relates to updating the software, e.g. "Check for Updates online."

Fake AntiVirus Warnings

This article pertains to the "Internet Security 2012" alert and other fake antivirus warnings. Please continue reading for information on protecting yourself.

Examples of Fake Warnings

Here are two screenshots of fake warnings. Click an image to view at full size.

If you see a popup like one shown here, your computer may already be infected. Shut it down and take it to the OSU Computer Helpdesk or your IT support staff to resolve the issue.

fake security warning

fake antivirus example

About Fake AntiVirus Warnings

Bad guys prey upon people's fears to steal their money and information. One of their favorite tricks is to tell people that their computer is (or might be) infected, and they are relying on you to respond in a manner that installs a virus on your computer.

In some cases, your computer may already be infected before you see the popup. The safest thing to is shut it down and take it to the OSU Computer Helpdesk or your IT support staff to resolve the issue.

But you can protect yourself before you're affected.

Protect Yourself Before You're Affected

There are three big ways to protect yourself before you're affected.

  1. Download OSU's free antivirus software, Symantec Endpoint Protection, and keep it up to date (free for home use, too).
  2. Enable your web browser's phishing protection settings, usually found under "Tools" or "Preferences" or "Settings." Call the OSU Computer Helpdesk at 541-737-3474 if you're not sure how to do this.
  3. Get to know the look of pop up messages from your current AV software. If you know what you are looking for, you are much harder to fool. Take note of the name and icon of your anti-virus software and click on pop ups that only come from that program.

There are a few additional steps you can take.

What If I Do See A Warning?

A few things to check for if you are unsure about the message are:

  1. Close and quit the web browser (Chrome, Internet Explorer, Firefox, Safari, etc.) immediately. Do NOT click on OK or cancel. Even a button that says "close" can be deceiving.
  2. Does closing your internet browser make the virus alert go away? Often the pop up window is really embedded on an internet page so if you close your browser it will go away. Alerts like this should always be avoided.

If you think you may have accidentally clicked on a fake antivirus warning, shut down your computer. Students can bring laptops to the Walkup Helpdesk for malware scans, while faculty and staff should contact their IT support staff.

What Happens If My Computer Gets Infected?

The viruses that get installed can:

  • Trick you into entering your credit card information or passwords or personal information.
  • Steal your bank account information and empty out your account.
  • Send spam messages from your email address.
  • Corrupt or destroy your documents.
  • Allow other, stronger infections into your computer.
  • Crash your computer or slow it to a crawl.
  • Infect other computers both on the Internet and on a local network.
  • Prompt you for payment to remove the "infection." One version of this malware made headlines in a tech magazine, Computerworld.

Who to Contact

OSU work computer - Please contact your IT support staff.

OSU Students - Contact the OSU Computer Helpdesk.

Self help options for personal computers

  • Download Malwarebytes. Disconnect from the Internet to run a full scan of Malwarebytes.
  • Run a full scan with the anti-virus program (Symantec Endpoint protection, McAffee, AVG, Avast) installed on your computer.
    • For your information, the full scan can take several hours to complete properly.
  • Read and follow the directions to remove AntiVirus 2009.
  • Read and follow the guide to remove FileFix Professional 2009.

Click HERE to watch the tutorial about running a virus scan with Malwarebytes.

Malware Detection at OSU

Oregon State University utilizes a device on our network called FireEye. This device monitors the network for patterns of activity a computer displays when it is infected with malware, or has been compromised by hackers.

When the FireEye device detects signs of malicious activity, it sends an alert to the OSU Computer Helpdesk, who, in turn, sends a notification to the registered owner of the computer. The user is then responsible for contacting the Helpdesk to resolve the issue. This document outlines that notification process.

Please Note: While every attempt will be made to resolve the situation through this process, there may be instances where the availability, confidentiality, or integrity of the OSU network or the data residing therein is placed at risk by the activity discovered on the device. In such cases, network access for that system will be blocked prior to notification.

 

Notification Process

OSU notifies users when a malware infection is detected on their computer. Users must come in for help, or inform the Helpdesk that the infection has been removed.

Notifications include technical details on the infection and give users information on how to clean their own computers. Please note that the notifications will be from security@oregonstate.edu and will be followed with an email from osucomputerhelpdesk@oregonstate.edu detailing options you have to clean your computer.

Network access disabled notification:

If the user does not come in for help or notify the OSU Computer Helpdesk and they continue to receive notifications from security@oregonstate.edu then the user’s network access will be disabled and a notification of the access restriction will be sent.

A user is not typically disabled until after three notifications have been sent, but there are circumstances that will extend the amount of notifications before loss of network access, such as a long period of time between malware notifications from FireEye.

 

Example Malware Notifications

Below are examples of the notification e-mails sent to users, which can be used as reference to ensure these are not fake emails or phishing attempts.

Example from Security:

Hello [Customer Name],


OSU's network security group has detected malware activity originating from your machine.
This is most likely due to a malware or virus infection on your machine.  Please check you
machine for viruses and malware and remove any infections.  If infections are not removed
and further malware related activity is found on your machine, you risk your network
access being disabled until the infection is removed.

Details about the potential infection are listed below:


Details
Malware last detected: [Date] [Time]
IP: [Customer’s leased IP at time of detection]
Hostname: [Customer’s hostname on network]
MAC Address?: [Customer’s Hardware address]
ONID Username: [Customer username]
Zone: [Zone customer’s computer was assigned to]
Malware: [Type of infection detected]
Attacker's Info: [IP address? and port infection is communicating through]

For more details on this infection, visit
https://mil.fireeye.com/edp.php?sname=Trojan.Koredos


For help removing this infection on your own, see
http://oregonstate.edu/helpdocs/protect-your-computer

If you would like assistance removing the infection please contact the OSU Computer
Helpdesk -
Phone: 541-737-3474
(Web: http://oregonstate.edu/is/tss/och/)

Note: This report is for your information and a copy is provided to the OSU Computer
Helpdesk. (If you are reasonably sure that this report is a false positive, no action or
response is required).

 

Example from the OSU Computer Helpdesk:

OSU’s Network Security group (security@oregonstate.edu) sent you an e-mail recently informing you about a possible malware infection on your computer. The OSU Computer Helpdesk wanted to check in with you and see if you have been able to remove the infection.

Because network security is a priority for personal and network safety, careful procedures are in place to quarantine potential infections. If no response is received from you after multiple notifications, the Helpdesk will disable your network access. Multiple warnings will be provided before access is disabled and it is easy to restore your network access by contacting the Helpdesk to inform them you have cleaned the infection yourself, or for help removing the infection.

Please be aware that if you clean the infection yourself, you must inform the Helpdesk that the infection is resolved. If  you don't respond to this email and your computer is still reporting as being infected, the Helpdesk will disable your network access after three notifications.

Clean it yourself -

You can also find out more information on how to remove infections here: http://oregonstate.edu/helpdocs/protect-your-computer


If you clean your computer, please respond to this email that you have cleaned your computer. If you receive another notice after reporting that you have cleaned the computer your network access will be disabled and you will be notified.

Students with laptops - 

If you still need assistance, please come to our Walk Up Helpdesk, located on the main floor of the Valley Library. It is open 8AM-9PM Monday through Thursday, 8AM-7PM Friday, and 3PM-7PM Sunday. You can also give us a call at 541-737-3474.


Students with desktop computers living in the dorms -

Call the OSU Computer Helpdesk at 541-737-3474 for guidance and further assistance.


If you do not have an anti-virus program on your computer -

You can get Symantec Endpoint Protection for free with your ONID account. If you already have an antivirus program, please use Malwarebytes to double check that you do not have viruses on your system.

How to use Malwarebytes - Malwarebytes download page

How to install/obtain Symantec endpoint protection - video tutorial of how to install Symantec Endpoint Protection

You can go to http://oregonstate.edu/helpdocs/security/viruses for more information on viruses.


Please let us know if you have any questions or concerns.

If you are forwarding your email to another account, please make sure to check your spam folder for the messages we are contacting you about.

Virus Threats for Macintosh Computers

New Mac Flashback Virus

There is a virus for Mac that has recently started to pick up steam (infected over 600,000 Mac computers worldwide). It is called the Flashback trojan, and relies on a vulnerability in your computer's Java installation. This virus operates in the background, so many users don't know they are infected. Click Here for more details, and steps you can take to see if your computer is infected.

 

Other Mac Viruses

Currently there are multiple malware programs circulating designed to infiltrate Mac OS. These programs are similarly designed to look like legitimate antivirus programs and tell users that their Mac is heavily infected with viruses. The program then harasses people into providing credit card information to purchase fake anti-virus program to remove the infection. This is a ploy to get your personal information. 

Often times these programs are automatically downloaded but cannot be installed without the permission of the user, by way of an administrator password. People who are not aware of these malware threats can unknowingly install these programs on to their machines. ONLY install programs on your machine that are from trusted publishers and that you have knowingly downloaded. Also, make sure that you have an updated antivirus program on your Mac. Students and Staff of OSU have access to free antivirus programs. 

Here is some info from the Apple Support community about removing Mac Defender. 

 

 

 

Macintosh Flashback Virus

PLEASE NOTE:

Apple has released a security patch for this virus. If you are using OS X 10.6 or 10.7, make sure and install all available updates for your mac. The patch was released as an Apple update, so installing the update will take care of the virus.

  1. What is the Flashback Virus?
  2. What about the new Flashback variant?
  3. How do I remove the virus if it is on my Mac?
  4. How can I protect my Mac from this and other possible infections?
  5. I'm not sure what my OS is, will this fix work for me? (10.5 users click here)

 

What is the Flashback Virus?

The Flashback virus targets a security hole in the Java software installed on your computer. Java is included with OSX, the operating system on your Mac. The virus is designed to steal personal information in the background without the user noticing, so once your computer is infected, you may not see any difference in the way it runs. To find out if your computer is infected, read the section below.

 

What about the new Flashback variant?

A new variant of the flashback virus has become available. In order to check if your device has this new variant you will need to open a terminal window by either searching for it using the Finder, or by opening Applications->Utilities->Terminal, then typing the following commands:

  • cd /Users/Shared
  • ls -al

You will be looking for any files ending in the extension ".so". There is a pending list of possible files that may be listed in that directory, so far they are:

  • .PCImageEditor.so
  • .AllXilisoftVideo.so
  • .memalloc.so
  • .DocumentConverterdocPrint.so
  • .InternetHistoryKiller.so

There are several other files that may be there, their names and locations are as follows:

  • /Users/Shared/.svcdmp
  • ~/.MACOSX/environment.plist
  • ~/Library/Logs/vmLog

For removal instructions, read the information below:

 

How do I remove the virus if it is on my Mac?

Apple has released a software update that should fix the most common variants of the infection: directions on downloading that update are provided below:

  • Click on the Apple drop down menu in the upper left corner of the screen, and select "Software Update..."
  • Allow the machine to check for updates. There will be an update named Java Update for OS X 2012-003". Install the update!
  • Keep in mind this only covers the most common variants: there are some instances of this virus that won't be fixed by this update. Install SEP if you haven't already, or some type of antivirus protection!

Removal instructions using Symantec Endpoint Protection can be found on the Symantec Website here. If you do not have symantec installed, you can download and install it from the OSUWare Website (Free for Students and Faculty/Staff).

PLEASE NOTE: The removal process involves running scans and possibly installing programs on your Mac. If you are not comfortable doing this on your own, you can get help on campus:

  • Students:
    If you have a Macbook laptop, bring it to the Walk-Up Computer Helpdesk     in the Valley Library. If you have a desktop, or you are unable to get to campus, you can call the OSU Computer Helpdesk for help over the phone.


  • Faculty with personally owned computers:
    If you have a Macbook laptop, bring it to the OSU Computer Helpdesk     on the 4th floor of the Valley Library (in the administration office). If you have a desktop, or you are unable to get to campus, you can call the OSU Computer Helpdesk for help over the phone.


  • Faculty with department issued computers:
    Contact your department support group for help

 

How can I protect my Mac from this and other possible infections?

There are several steps you can take to keep your Mac safe from infection.

Keep your Mac (and other programs) up-to-date

All viruses are designed to exploit security holes in different programs, and most updates work on patching these holes as they are discovered. Using out-of-date software makes it easier for infections to target your system.

To check your Mac for Apple updates:

  1. Click the Apple symbol in the upper-left hand corner of your screen
  2. Click the "Software Update" option. This will check for any Apple related updates. It will allow you to install if any updates are found.

To check your Mac for other program updates:

This varies based on what program you are using, but it can generally be found by opening the program, then looking for an "Updates" option in one of the top menus.

Updating your Operating System:

Older Mac Operating Systems (OSX) have additional vulnerabilities that newer versions don't have. The latest versions of Mac OSX are 10.7 and 10.6. You can check which version of OSX you are using by clicking the Apple symbol in the upper-left hand corner of your screen, and clicking on "About this Mac". If you have a version that is below 10.6, you may want to consider purchasing an upgrade for your computer if possible. Contact the OSU Computer Helpdesk for more details.

 

Install an Anti-Virus Program

OSU offers Symantec Endpoint Protection for free to all students and faculty using personally owned laptops. There is a Mac version available which you can download and install from the OSUWare Website. If you need help installing an Anti-Virus program, you can bring your Mac (If it is a laptop) to the Walk-Up Computer Helpdesk in the Valley Library. Note if you are faculty with a department owned Mac, you will need to contact your department support group for help.

 

Practice safe browsing habits when using the internet

Browsing to the wrong website is one of the most common forms of infection. Follow the suggestions on the safe browsing page for safe browsing tips.

 

I'm not sure what OS I use, what fix should I try?


Currently, 10.5 users and earlier are going to have to disable their Java until they can remove the infection, as the new update from Apple doesn't cover their OS. If you're not sure on how to find your OS version, follow the directions below:

  1. From the Apple menu (apple symbol in upper left-hand corner), select "About This Mac".
  2. The resulting window shows your operating system version.
  3. IF you have OSX 10.5 or lower, please use the following directions:
    • Click the Search button in the upper right hand corner, and type in “Java”
    • Java Preferences should be the first item that comes up, click on it.
    • On the menu that comes up, uncheck all the boxes. This will disable Java for you.

PLEASE NOTE: If you are using OSX 10.5 or earlier, we highly recommend (for security reasons) that you look into purchasing an update if your computer supports it. If you have questions about updating, contact the OSU Computer Helpdesk.

If you are faculty and using a department issued laptop, you should be eligible for an upgrade through your department. Contact your department support group for help.

Password Security

password securityIn order to keep your information secure you must keep your password secure. The following are not the only ways to keep your password secure, but they are a good start:

  • Use passphrases (see below).
  • Do not keep your password in open and public spaces (no sticky notes on your monitors!).
  • Change your password periodically.
  • Do not use the same password for everything.
  • If you think your password may have been compromised, change it immediately.
  • Never tell anyone your password.

Use a Passphrase Rather Than a Password

Passphrases are more secure than passwords because they are generally longer, making them less vulnerable to attack. They also allow you to remember your credentials, even when they expire frequently. The idea of a passphrase is to use a statement, or motto, rather than a word peppered with odd characters and symbols, as the latter can be difficult to dedicate to memory.

For instance, try:

  • A meaningful statement: "Carp3 Diem!"
  • Directions to a location: "Down Oak, 2nd on the Right"
  • A reference to what you're accessing: "Check1ng my Onid-Mail!" (NOTE: This is an awesome kind of passphrase, as you can customize it for any service you use, protecting your accounts from each other).
  • A catchy jingle: "I don't always use passwords, but when I do"

It is a good idea to add numbers/symbols in place of some letters for common passphrases. That way, it is harder for an outside user to guess your passphrase.

Now you have a password that's already in your memory, and you can recall this new passphrase with greater ease. Of course, you should avoid using passphrase without adding some special characters, as hackers can attack your account with commonly used statements or quotes.

Please Note: Some systems won't accept spaces in a passphrase, while others won't accept a large number of characters. You can contact the OSU Computer Helpdesk with any questions regarding passwords.

Blocking E-mail Spam

Network Engineering uses several tools to help keep spam from reaching your mailbox. Read on for more information about what we are doing to prevent spam, what you can do, and how to keep your address off of spammers' lists.

What is Spam?

Spam is defined as unsolicited, bulk e-mail.  Typically spam comes from strangers - people who have obtained your e-mail address without your permission.  If you signed up for the mailing (intentionally or accidentally), it may be undesirable e-mail, but it is not technically spam.  Likewise, if you have some sort of business relationship with the sender, it is not spam.  So, an e-mail sent to you from your bank, an online service you signed up for, or your department at OSU would not be considered spam. 

Note: Using OSU's e-mail system to send unauthorized bulk mailings is against the Acceptable Use Policy.  For information about how to do a bulk mailing at OSU correctly, please see the Guidelines for Release of E-mail Addresses.

Blocking Spam

Step 1 - Using Filtering On Your Account

Step 2 - Reporting Spam

If Step 1 doesn't stop the spam from coming through, you can report the spam to OSU Network Engineering:

Greylisting

Greylisting works by sending a temporary failure message on the first attempt of a unique combination of sender IP, sender and recipient. Legitimate, properly-configured mail servers deal with a temporary failure by queuing the message and resending later (typically within 15 to 30 minutes). On subsequent attempts to send a message, the greylisting server allows the message to be delivered.

Greylisting works as an effective method to prevent spam because spammers typically do not bother to queue mail. Rather they blast the spam out once and ignore delivery failures.

The downside of greylisting is that it may cause a legitimate message to be delayed. Messages may also appear to arrive out of order, as subsequent messages from the same sender are not delayed. Also some sites do not queue and redeliver messages properly.

OSU addresses these issues by building up a comprehensive whitelist of allowed senders. If there are sites that you are concerned about, please send us a list at net (at) oregonstate.edu, and we will add them to the whitelist.

NOTE: Greylisting does not apply to e-mail sent within OSU.

Real-Time Black Hole Lists (RBLs)

A RBL is a list of hosts that are known untrustworthy e-mail senders. When we receive email from one of these sites, we bounce the message back to the site with an explanation that they are in an RBL and a link with directions on how to get unlisted from it. In addition to RBLs, we have an access list of domain names and email addresses of known spammers that we reject mail from. We also block mail from dynamic IP ranges, because mail servers should never have a dynamic IP. Finally, we block mail from dialup users and cable modem users - these users must relay through their ISP's mail server (or they can relay through OSU with ONID authentication).

We use the following RBLs at OSU

If you are having trouble receiving mail from another site because they are listed in one of our RBLs, please tell the person at the remote location to contact their e-mail administrator or ISP and give them the information in the bounce message that they received from OSU. Contact us at net(at)oregonstate.edu if the sending site is unable or unwilling to get unlisted - we may be able to help them get unlisted, or whitelist the site here.

Phish Detection

For more information about phishing, please see the Phishing helpdoc page.

OSU blocks e-mail messages that contain a reply-to address that goes to a known phisher.  If practical, we will also "poison DNS" for links included in phishing e-mails, so that clicking the link will redirect you to a safe page instead. 

If you respond in any way to a phishing e-mail that asks for your username and password, we will disable your account and ask you to reset your password.  OSU has had several accounts become hacked in the past and these hacked accounts have been used to send hundreds of thousands of spam e-mails to OSU and to the world, causing serious e-mail disruption.

NEVER respond to phishing e-mails!

Content-Based Filtering & SpamAssassin

Content-based filtering refers to sorting or deleting mail based on the content of the message itself. We do content-based tagging at the mail relays using SpamAssassin, and these tags can be used to filter spam in your e-mail client.

Many e-mail clients now come with "Junk Mail" filters built-in, which you can turn on to help sort out the messages you don't want to see. When you use a junk mail filter, make sure that you set it to sort the unwanted mail into a junk folder, rather than your deleted items. That way, you can check the junk folder once in a while to make sure that no innocent e-mails have ended up there.

SpamAssassin headers that you can filter on:

X-Spam-Flag: YES  (indicates that this message has a score of 5 or more)

X-Spam-Level: ******** (the number of stars indicates the spam score)

For example, to filter all messages with a score of 3 or higher, you could create a rule in your email client to match on "X-Spam-Level: ***". 

How to Keep Your E-mail Address Off Spam Lists

The best way to avoid being spammed is to be careful how you share your e-mail address.  Every time that you sign up for something online and provide your e-mail address to do so, you are potentially sharing your contact information with not only that site, but with third parties as well.

The following are things you can do to keep your address off spammers' lists:

  • Don't sign up for work-at-home or other too-good-to-be-true offers; they are typically scams and your contact information will definitely go to spammers.
  • NEVER reply to spam or phishing emails.  If you do, it verifies to the spammer that your address is a real working address and that makes it even more valuable to them (and makes it more likely that you will get more spam).
  • If you post your e-mail address on a publicly accesible website, try to obscure it in some way (e.g. bob(at)oregonstate.edu).
  • When signing up for various accounts online, uncheck the boxes that ask about putting you on their mailing list.  Typically these will be checked by default.

OSU Email Statistics

Where does spam come from?

In the past, most spam came from misconfigured mail servers or proxy servers. But today most spam comes from virus-infected personal computers, hacked e-mail accounts and free e-mail providers.  See the Wikipedia article on Spam for more information about how spammers operate.

One very important thing that you can do in the fight against spam is to keep your computer up-to-date on software patches and anti-virus software. It's also a good idea to run a personal firewall. Use caution when opening e-mails from addresses you don't recognize, and always scan email attachments for viruses. If your computer has become noticeably slower, it's a good idea to run virus-detection software.

Finally: NEVER share your password!

Email Filtering

ONID

Email filtering will not work with ONID if you have your ONID account set to forward to another email account. For more information about forwarding, click here.

Following are directions for setting up Spam Assassin and Mail Filters on ONID:

Spam Assassin

  1. Browse to http://onid.oregonstate.edu/
  2. Click Login To ONID in the left hand column
  3. After logging in, click Manage Mail in the left hand column
  4. If mail forward IS NOT set, you will see a Spam Assassin section on this page
  5. Check the box that says Use Spam Assassin
  6. You may check either or both of the other two boxes at your preference
  7. Click Modify Spam Assassin Settings

Personal Mail Filters

  1. Browse to http://onid.oregonstate.edu/
  2. Click Login To ONID in the left hand column
  3. After logging in, click Manage Mail in the left hand column
  4. If mail forward IS NOT set, you will see a Personal Mail Filters section on this page
  5. You can create a custom mail filter under this section to automatically move emails coming from a certain email address or email domain to a spam folder in your ONID account.
    Caution: If you block a domain, all emails from that domain will be blocked. For example if you block @gmail.com, all emails coming from an @gmail.com email account will be blocked.

 

Outlook 2007

  1. From the main Outlook window, select the Actions menu
  2. Navigate to Junk Email and select Junk Email Options... from the sub menu
  3. From the Blocked Senders tab, click Add
  4. Enter the sender's email address or email domain to block the sender
    Caution: If you block a domain, all emails from that domain will be blocked. For example if you block @gmail.com, all emails coming from an @gmail.com email account will be blocked.
  5. Click OK
  6. Click OK

 

Outlook 2010

  1. From the main Outlook window, click Junk
  2. Select Junk Email Options... from the drop-down
    Junk Email Options
  3. From the Blocked Senders tab, click Add
  4. Enter the sender's email address or email domain to block the sender
    Caution: If you block a domain, all emails from that domain will be blocked. For example if you block @gmail.com, all emails coming from an @gmail.com email account will be blocked.
  5. Click OK
  6. Click OK

 

Outlook 2011 (Mac)

  1. Click the Junk menu, then click Junk E-mail Protection

  2. Select the level ou prefer to use for junk protection (the Low setting is fine for most users)

  3. Click OK

Entourage

  1. From the Tools menu, select Junk Mail Filter
  2. Check the Enable Junk Mail Filter box
  3. You can adjust the sensitivity of the filter with the slider bar

 

Mac Mail

  1. Select the spam email from the mail list
  2. Click Junk from the toolbar near the top of the window

 

Thunderbird

To customize junk email controls:

  1. From the Tools menu, select Junk Mail Controls

To train Thunderbird:

  1. Select the spam email from the mail list
  2. Click Junk from the toolbar near the top of the window

Reporting Spam & Phishing

If you would like to report spam emails to Network Engineering, please follow the process below for your particular mail client:

ONID

  1. Login to ONID Webmail at http://webmail.oregonstate.edu/
  2. Open the spam email (DO NOT open any attachments that may be contained within the email as they could contain viruses)
  3. Under the Forward menu, select Entire Message
    Forward Entire Message
  4. This will open a new email with the spam email included as an attachment.
  5. Send the email to abuse (@) oregonstate.edu

 

Outlook 2007

  1. Open the spam email in a new window (DO NOT open any attachments that may be contained within the email as they could contain viruses)
  2. Click Other Actions near the top of the window and select Forward as Attachment
    Forward as Attachment
  3. Send the attached email to abuse (@) oregonstate.edu

 

Outlook 2010

  1. Open the spam email in a new window (DO NOT open any attachments that may be contained within the email as they could contain viruses)
  2. Click More near the top of the window and select Forward as Attachment
    Forward as Attachment
  3. Send the attached email to abuse (@) oregonstate.edu

 

Outlook 2011 (Mac)

  1. Select the message in the message pane
  2. Click the Attachment button
  3. Send the email to abuse (@) oregonstate.edu

Entourage

  1. Select the message in the mail pane
  2. Click the Message menu from the top of the screen and select Forward as Attachment
    Forward as Attachment
  3. Send the attached email to abuse (@) oregonstate.edu

 

Mac Mail

  1. Open the spam email (DO NOT open any attachments that may be contained within the email as they could contain viruses)
  2. Under the View menu, select Message and then Long Headers from the sub menu
  3. Click Forward
  4. Forward the email to abuse (@) oregonstate.edu

 

Thunderbird

  1. Select the spam message
  2. Under the Message menu, select Forward As and then select Attachment from the sub menu
  3. Send the attached email to abuse (@) oregonstate.edu

E-mail Fraud

Avoiding e-mail fraud

Due to the widespread use of web bugs in email, simply opening an email can potentially alert the sender that the address to which the email is sent is a valid address. This can also happen when the mail is 'reported' as spam, in some cases: if the email is forwarded for inspection, and opened, the sender will be notified in the same way as if the addressee opened it.

E-mail fraud may be avoided by:

  • Keeping one's personal e-mail address as secret as possible. Use a throw-away email when signing up websites online.
  • Using a spam filter. If you do not forward your ONID email, ONID will protect you from as much spam as possible with SpamAssassin. For help on setting this up, go here
  • Ignoring unsolicited e-mails of all types, simply deleting them.
  • Not giving in to greed, since greed is often the element that allows one to be "hooked".

Many frauds go unreported to authorities, due to shame, guilty feelings or embarrassment, but if you ever fall victim to an e-mail fraud that involves theft, either monetary or of your identity, contact the authorities immediately. You could help save many people from the same problem.

 

Types of Fraudulent E-mail

Bogus Offers

One of the most prevalent types of email fraud comes of the form of offers that are too good to be true. The fraudulent offer typically features a popular item or service, at a drastically reduced price. Most of these are just an attempt to get your credit card information and if something seems too good to be true, it probably is.

Another type of bogus offer affects people who use Ebay, Craigslist, or any other online retailer for selling their belongings. The typical scam is that a person will contact you offering to pay the full amount, or even more for a rush delivery, but they refuse to pay you until they receive the item for inspection or some other reason.

 

Here are some examples:

Click here to view larger image.

Phishing

What is phishing?

Phishing is an attempt by a person or organization to gain information such as usernames, passwords or credit card information. Once the unauthorized person gathers this information, they can use it to fraudulently purchase items on YOUR credit card, send real or spam e-mail from YOUR e-mail address, or sign up for services in YOUR name. Examples of phishing messages have been compiled to help you identify fake messages. The Phishing page on Wikipedia has more information if you are interested.

Why is phishing dangerous?

Aside from financial loss, phishing can also cost you time, as well as your identity. As said above, once you send your information to a phishing email, someone can start making charges to your name. Not only will you now owe for someone's else's expenditures, you also get to spend hours trying to cancel cards, reverse orders, and try to get your financial life back. This can be very taxing financially, and take a lot of your spare time.

You will also now have a flood of messages from services you've never used before. Accounts for forums, online retailers, lists, just about anything, can start being funneled to your email address. What's worse, the phisher can also spoof your account, and potentially get your account disabled for spamming.

What can I do to protect my personal identity and information?

  • NEVER give your password to ANYONE, including technical support personnel.
  • NEVER respond to spam messages (this validates your address to the spammer and your e-mail address will be FLOODED with SPAM).
  • Read the email critically and ask yourself some questions.
    • Does it make sense?
    • Is the capitalization, grammar, punctuation and sentence structure, correct?
    • Is the email too generic?
    • Why are they asking for my personally identifiable information over an unsecure method of communication, such as e-mail?
    • Why would the administrators of that system need my username, which they already know?
  • Never respond to an email requesting this information.
  • Forward suspicious emails to your support group or call the agency requesting the information; E.g. Bank of America, OSU Federal Credit Union, Computer Helpdesk, etc.
  • Never click on links or images in suspicious emails.
  • Abide by the OSU Acceptable Use Policy you signed, especially the section: "Accounts and passwords may not, under any circumstances, be shared with or used by persons other than the individual(s) to whom they have been assigned by the University."
  • Don't chat up scammers. Read a transcript from a real scam artist to gain further insight.
  • If you are still unsure what to do, contact your computer support group on campus.

What can I do to report a phishing attempt?

If you receive a phishing attempt and would like to report it, please select your email client from the following list for instructions on reporting a phishing attempt.

Phishing examples

Phishing e-mails can arrive in various forms. This page is designed to help you recognize some common features of these attacks.

 

Example 1:

Phishing example 1

1. Reply address is misspelled and to the wrong email domain

The reply email address will almost always be different from the person that appears to be sending the fraudulent e-mail. This is because the person trying to get your account information is hoping you will hit reply and not notice who the email is actually being sent to. If you did respond to one of these emails and realize it later you should change your password immediately.

2. ONID doesn't have anonymous registration

This is specific to just ONID accounts, but any e-mail address that required prior registration information from that organization is NOT "anonymous registration." No email service will ever send you an e-mail stating your account will be deleted unless you respond with account information! If you are unsure about the e-mail server you are using and think they may do something like this, either call or send a email directly to the support team e-mail that is on the website to ensure that it doesn't get sent to a fraudulent individual.

3. We will never ask you for your password, birthday, country, or GAP?.

No technical support or e-mail provider should ever ask for any personal information, especially passwords. If you have NOT contacted your e-mail or internet provider for help, be very suspicious of any email you receive claiming to be technical support, because tech support should not contact you unless you have asked for help.

4. Conflicting Information

Many times automated messages are created by pulling different sections of text out of a database and often times the information that gets pulled for the email has conflicting information. Of course both propositions of having your account disabled or deleted in 48 or 24 hours is scary and causes many people to act too quickly. ONID will notify you of account deletion or deactivation at least a couple weeks before anything is done. If an email gives you a deadline within hours or days the chances of it being a scam is greatly increased.

Example 2

Phishing Example 2

1. The from address is something other than the domain of your email address.

If you receive a legitimate email message from an administrator of your email the from address should always have the same domain as your email. For example if you receive something from ONID you know your ONID address is of the form "username@onid.orst.edu" so the message should be from "somebody@onid.orst.edu". This is a good first check to see if a message is real.

2. There is information in the email that is just wrong.

This is harder to recognize since you may not always know this information but if it looks wrong to you check it out. Usually information like this will be clearly listed on your email providers page and can easily be verified.

3. The message requests information such as username and password

No technical support group will EVER ask for this kind of information by email. If for some reason we need to have you update information we will send a message that simply asks you to go to ONID and sign in yourself to update it. Also be careful of messages that send you a link to update your information since the link doesn't always go where it says. It is always better to type in the address yourself rather than clicking a link!

Requests for Help

The "request for help" type of e-mail fraud takes this form. An e-mail is sent requesting help in some way, but including a reward for this help as a "hook," such as a large amount of money, a treasure, or some artifact of supposedly great value

The modern e-mail version of this scam, known variously as the "Nigerian scam", "Nigerian All-Stars," etc., because it is typically based in Nigeria, is an advance fee fraud. The lottery scam is a contemporary twist on this scam.

Responding to these emails cost someone money and loss of their identity, You can see stories of victims at http://www.google.com/news/search?aq=f&pz=1&cf=all&ned=us&hl=en&q=nigerian+scam.

Examples can be found at fraudgallery.com or you can view the thumbnails below for some basic examples.

Spoofing

E-mail sent from someone pretending to be someone else is known as spoofing. Spoofing may take place in a number of ways. Common to all of them is that the actual sender's name and the origin of the message are concealed or masked from the recipient. For more information, visit http://en.wikipedia.org/wiki/E-mail_spoofing

One very common example of spoofing is when people receive e-mails in their inbox saying that a message could not be delivered to a recipient, even though they do not remember sending that message. In this case, someone has learned what your email is and sent spam e-mails pretending to be from your address and the e-mail address was incorrect and sent a bounce message back to your e-mail address.

The thumbnails below show some examples of spoofed e-mail messages:

Click on image to view full size.

Click on image to view full size.

 

 

 


Safe Browsing Habits

The internet is full of viruses, trojans, malware, and spyware. Keeping your computer safe from these is very important.

Update Operating System

Whether you are using a Mac or PC, updating your operating system is very important. Updates are released on a regular basis to help protect your computer and to keep it running smoothly.

PC - How to install updates for...

Mac - How to update your Macintosh OS X

Update Web Browser

Your web browser is your gateway to the internet and is often times the entry point for computer viruses. It is therefore important that you frequently check for updates to your browser.

Internet Explorer - Updates are includes as part of your Windows updates

Mozilla Firefox -

Safari - Safari updates are included with Mac OS X updates. To update you Mac, go here.

Some Safe Browsing practices

  1. Update anti-virus and anti-malware programs
  2. Use a firewall program
  3. Never click on pop-ups
  4. Never respond to Spam e-mails
  5. Never open e-mail attachments that you were not expecting. If you are ever in doubt, e-mail the sender to make sure they sent it to you or google the e-mail to see if the attachment is bad.
  6. Never click on links in your e-mail. Instead, copy/paste the URL into your web browser to ensure that the link is not redirecting you unexpectedly. For an example of URL mis-direction, view this image.
  7. Avoid using peer-to-peer (P2P) network programs.
  8. Avoid using your personal e-mail address for random registrations. If you are browsing the web and come accross a form that you want to fill out, but you are not sure what it will do, you may want to use a throw away email address to fill it out with. View these Google search results for some Disposable Email services (Note: some sites disallow use of these accounts)
  9. Use programs such as WebOfTrust or McAfee Site Advisor to help avoid sites that are known for infecting computers.

Mac OSX Updates

Update MacOS X

Apple periodically releases updates and patches that will protect Mac OS X from being attacked by viruses and other malicious programs. Configuring OS X to automatically install these patches will ensure your computer is always protected.

Schedule updates

1. Click on the Apple menu, and choose System Preferences.

Mac Menu

2. In the window that appears, select Software Updates from the System section.

Software Update Icon

3. Check the box by Check for Updates and select Weekly from the pull–down menu.

4. Check the box by Download important updates in the background.

Windows Vista/7 Updates

Microsoft periodically releases security patches for Windows operating systems. Downloading and installing these updates will help protect your computer from viruses and threats. All you need to install updates on your computer is an active internet connection, and the instructions below:

All of the images below can be clicked on if you need a larger view.

Step 1Start Menu

Click the Start circle at the bottom left of your desktop.

Click the All Programs option at the bottom of the menu.

Step 2Windows Update Link

Click the Windows Update option in this list.

Note: If a link for Windows Updates does not appear in this list, you can always access it by opening up the Control Panel.

Step 3Check for Updates

A separate window should open. When it does, select the Check for Updates option on the left-hand menu. Windows will then go online and check for available updates.

Step 4Updates Results

When the check for updates is finished, Windows will display a screen similar to this one, letting you know how many updates were found.

Note: if no updates are found at this point, you already have all the latest updates installed.

If you notice that the number of updates available and the number of updates selected is different (as it is on the screenshot to the right), or there are optional updates available, you should click on the link to view the list of updates and select any that are missing.

Note: Sometimes Windows will leave certain updates un-selected if they are large and will take longer to install. These are still important updates, and should be installed if you have the time to let your computer sit and install them.

If it already says you have all the updates selected, you can skip to step 6.

Step 5Update List

This screen should display a list of available updates. Check the box at the very top (the one above the list). This will select all the updates in the list for installation.

If you have optional updates available, you can click the Optional tab on the left to view them. If you see things like language packs or toolbars (like the Bing desktop toolbar), you can leave them un-checked because they are optional software. If you see any general updates in this list, it is a good idea to check the box next to them for installation.

Click the OK button when you are finished selecting updates

Step 6Install Updates

You should now be looking at the same screen as Step 4. Click the Install Updates button, and Windows will begin downloading and installing your updates.

Step 7Updates Progress Bar

You will see a progress bar similar to the one on the screenshot to the right. This will show you the current progress. Once the progress bar is full, Windows will be finished installing your updates!

Note: Windows may ask you to restart your computer when updates are done. If it does, it is a good itea to restart right away. Also, if you had a lot of updates to install, you should run through the steps on this page again after your computer restarts, as additinal updates may become available after installation.

Windows XP Updates

Update for Windows XP

Microsoft periodically releases security patches for Windows operating systems. Downloading and installing these updates will help protect your computer from viruses and threats.

Installing Critical Updates

1. Open Internet Explorer » Go to windowsupdate.microsoft.com.

If a "Security Warning" or a prompt to install software appears, confirm it is from Microsoft, and then click "Yes."

2. Click the button titled Express.

Windows Update Express Install

3. Wait briefly while the site scans your computer to see what updates are needed.

4. At the next screen, click the Install Updates button.

5. Any needed high-priority updates will be downloaded and installed. If you are prompted to restart after the updates have been installed, do so.

 

OSU Alert

What is OSU Alert?

It is an alert system that allows public safety officials to create emergency alerts that contain a recorded voice message, an email message, and a text message and send them to the current database of contact information for all employees and students. In crisis situations, the system will try all means of contacting each person in the database, and uses sophisticated means to verify contact so that we know we have reached everyone we could.

Who can use OSU Alert?

Only OSU students and employees are entered into the system (no affiliates).

How do I access or sign-up for OSU Alert?

Log in using your ONID e-mail address and OSU ID? number.

 

For more information visit http://alert.oregonstate.edu


Change Contact Information

To update your contact information for OSU Alert

  1. Go to alert.oregonstate.edu and click on "Enter your emergency contact information"
  2. Log in with your ONID email and OSU ID? number
  3. Edit your information, agree to the terms of use, and click "Update My Information"
  4. Review your information and, if correct, click "Yes, This is Correct"
  5. Enter the characters in the image, which are case sensitive, and click "Next"
  6. If your address is not recognized, you will see different options for possible addresses. Click the radio button next to the correct address and click "Use Selected Address"
  7. When you are done, you can close the browser window/tab

Opting out of OSU Alert

Contact the OSU Computer Helpdesk through the methods listed on the right "Supported by" block to opt out of OSU Alert.  However, please understand that this system will be the primary means of communication in an emergency and your life may depend on getting information in a timely way.

Securing Your Computer

The IT staff at OSU strive to keep computers that are infected with malware off of the network, but despite our best efforts, there are infected machines that connect to the network. As part of our ongoing efforts to increase security for the entire OSU community, we have developed the following guidelines.

Before you connect your computer to the OSU network, we recommend that you follow a standard set of procedures for securing your system to ensure that the confidentiality, integrity, and availability of university systems are maintained.

Instructions for Apple Computers

If you have any questions regarding the updating and patching of your computer, please contact the OSU Computer Helpdesk.

Instructions for Windows Computers

Note: Microsoft provides an application that you can use offline to determine which patches are needed for your system. These patches can then be downloaded on a separate computer with internet access. You can download the Microsoft Baseline Security Analyzer from Microsoft.

If you have any questions regarding the updating and patching of your computer, please contact the OSU Computer Helpdesk.