The Boston University community was hit by a “phishing” scam — an attempt to gather personal information from Internet users through fraudulent websites — when an email, with the subject line “Verify your BU account now” sent from [email protected], was sent to staff and students Jan. 31.
Scammers disguised as the non-existent “BU Messaging Center” claiming they were going to delete all current accounts and upgrade their database, urged message recipients to reveal their usernames, Kerberos passwords, birth dates and country or territory to avoid losing accounts permanently.
BU Office of Information Technology staff were baffled by motives behind targeting the BU community.
“Phishing schemes are predominantly done with banking institutions,” IT Consulting Services Director James Stone said. “The person who gets your password is looking to get money from you. No one is going to get any money from a BU Kerberos password because it doesn’t protect funds.”
Concerned students and staff emailed IT after receiving the email. Immediately, the security team did a risk assessment and performed countermeasures on the BU network to prevent future attacks.
Stone did not reveal IT’s countermeasures because he said doing so would compromise security effectiveness.
IT sent an email about the phising scam to the entire BU community Jan. 31. The email included a link for those who gave out their information so they could change their Kerberos passwords.
Stone said very few people responded to the scam, but did not provide an exact number. Despite reluctance to take the bait, phishing requires only a few responses to be successful.
“It doesn’t have to work often to be profitable,” College of Arts and Sciences junior Derek Locke, a computer science major, said. “Most people realize stupid Internet ads are stupid Internet ads, but a few people will click on them and that’s enough to make it profitable.”
On the national scale, more adults are being snagged by online scammers. In 2007, 3.6 million U.S. computer users lost their money or identity to phishermen; a substantial increase from 2006’s 2.3 million, according to the information technology research and advisory company Gartner, Inc.’s website.
Besides using emails or instant messages, phishers also use link manipulation in order to gain access to sensitive information. Link manipulation changes one character of a legitimate website address to create a false one on which sensitive information can be procured, Locke explained.
“Generally it’s clear by the URL if the phishing site is hosted by the real thing or not,” he said.
Another phisher technique is filter evasion, by which scammers use images of words rather than the text itself so internet filters cannot distinguish between them, according to the Next Generation Software Company Ltd.’s Phishing Guide. Website forgery is also a common trap that places a picture of a legitimate website address over the illegitimate one.
Although IT is looking into the origin of the phishing attempt, Stone said he is neither hopeful nor confident they will uncover the identity of the original sender, since the reply address was in the United Kingdom.
Stone said the best way to fight against phishing is education. In addition to sending the email, the Personal Computing Support Center website provides information on computer safety.
“We want people to be safe on the Internet,” he said.