Author: Chris Bayliss

IT Security Manager.

Meltdown and Spectre – time to panic?

We have had a number of queries about the well-publicised processor vulnerabilities, Meltdown and Spectre.  There are no reports of actual exploits being used at this stage and certainly with meltdown an attacker would need access to the systems concerned in order to exploit the vulnerabilities.  Suppliers of operating systems, anti-virus and other relevant software … Continue reading “Meltdown and Spectre – time to panic?”

Student Password Change Notices

We have had a lot of queries recently about password change reminders and whether or not they are a phishing attack.  We have previously published an example password change notice highlighting its characteristics and how it differs from an attack. Some students have been asking why there has been a change in policy.  The policy … Continue reading “Student Password Change Notices”

Fake Fax Notifications

There are a number of emails circulating claiming to have fax messages attached.  These contain word attachments which are infected with a macro virus.   The messages are all from genuine senders who have been infected with the virus. If you receive any messages with attachments which are unexpected, please delete them and do not attempt … Continue reading “Fake Fax Notifications”

Important Message From Staff Portal

We have a huge number of reports of a phishing campaign which many people have recognised as such.  Some, however, appear to have been taken in by this.  Initial versions came from outside the University which were easy to spot as bogus. However,  once some people had given their passwords away their accounts were then … Continue reading “Important Message From Staff Portal”

Fake Email Administrator Message

Quite a few people have received a message asking you to login to “reset” their email.  This is something that IT services would never ask you to do.  It is similar to others that have asked you “verify” your email.  As it generated a few queries, I am posting an example with an explanation of … Continue reading “Fake Email Administrator Message”

Filtering Email Display Names

Introduction In order to help people avoid being tricked about the sender of an email, from 2nd May 2017 we started filtering out the display name from email From: fields in email originating from outside the University. This measure is not being applied to email from UK academic sites and other trusted, well regulated email domains that … Continue reading “Filtering Email Display Names”

Bogus invoices from the University

We have had a lot of reports about fake invoices apparently sent from other members or departments in the University.  A new trick being deployed is to add an extra address in the from: field after the name but before the actual address in the from: field. This tries to trick people into downloading and … Continue reading “Bogus invoices from the University”

Majordomo Mailing Lists and Malicious Email – Advice for List Owners

We have had a lot of calls and emails from people concerned about a recent malicious email (fake DHL parcel notification – see https://blog.bham.ac.uk/itsecurity/2017/04/04/malware-in-fake-dhl-parcel-notification/). The messages were sent mainly to Majordomo mailing lists, so many people received multiple copies.  It has become apparent that many list owners are not taking advantage of security features of … Continue reading “Majordomo Mailing Lists and Malicious Email – Advice for List Owners”

Malware in Fake DHL Parcel Notification

We have received numerous messages containing email claiming to be from DHL about a parcel. The messages ask you to download a “javascript report”.  Javascript is a language for writing programs and not the type of file that would contain a report.  This is in fact a javascript program that when run downloads other malicious … Continue reading “Malware in Fake DHL Parcel Notification”