NOTE: Even after sending 2 warnings in the last 2 weeks, we have had a large number of people click through the speeding fine email and get infected. All files got encrypted and lost (recovered with backups). Some people who received our email didn’t have an offsite backup strategy either. From $9 a month, protect your personal and business files, at home or at the office.
Again the golden rule is don’t open emails you are not expecting, hover over the link and see if genuine, call the sender and confirm they sent it otherwise contact us and we can assist.
The next wave of fake emails are coming from IT HELP DESK. Ensure your staff do not open any HELP DESK emails unless they come from a known person in your company or through our alert system, like this email.
Phishing attacks posing as emails from your company’s IT helpdesk are becoming increasingly common. These attacks attempt to gather your information for identity theft purposes and can also spread malware.
You should ensure that emails claiming to be from your IT helpdesk are legitimate before responding with information about your identity or your computer.
Indicators of IT helpdesk phishing emails
Signs of potentially fake emails include:
- the sender address of the email should be from an expected or known IT helpdesk address in your company
- emails that do not specify your company’s name, instead use generic terms such as ‘IT helpdesk’
- incorrect company branding, for example, the wrong text, font or colour
- a sense of urgency, using language such as ‘immediate downtime’ or ‘act immediately’
- requests to install software onto your computer
- requests for a password.
Poor use of language, spelling mistakes or incorrect grammar can also indicate the email is phishing. The following is an example of a recent IT helpdesk phishing email:
Good morning,
We will be performing emergency maintenance on our network equipment.
Anticipated downtime will be approximately 60 minutes. This will affect both internet access and phone service.
Click on the below link and follow the instructions
CLICK HERE:
We apologize for the inconvenience.
Thank you,
Help Desk
All Rights Reserved © 2014
This message attempts to send you to a website where identifying information is requested. Such information can be used to steal your identity or target your computer.
Other examples of phishing attacks such as these have attempted to spread malware in two possible ways.
The email could ask you to install software on your computer. Any requests such as this, to install software from the internet, should be considered suspicious. Most IT helpdesks will have systems in place for installing software on users computers.
The email could direct you to a website and attempt to install software without your knowledge. This is known as a drive-by-download and can happen simply by clicking the link in the email and visiting the website.
To stay safe, it is important that you do not click links in phishing emails or reply to the sender if you do not know them.
Information for IT helpdesks
IT helpdesks can also help stop users in their company from being attacked in this way. IT departments should ensure that clear procedures for safe communication with staff are in place and being used. These procedures may include:
- updating email filters to stop phishing emails from being delivered to people’s inboxes
- using a standardised format for sending helpdesk requests
- employing a system to allow people to verify requests from outside their email. A commonly used example is the helpdesk ticketing system
- including basic company information in helpdesk requests, such as the name of the company
- sending all helpdesk requests from a single email address, such as helpdesk@company.com.au
- ensure that staff are aware of IT requirements with plenty of notice. Limit the number of urgent requests made of staff
- do not ask for unnecessary information in emails, and never require the user to provide their password.
It is important to ensure that staff are aware of basic rules for helpdesk requests. This allows staff to spot fake IT Helpdesk emails more easily.
Source : Stay Smart Online , a Government initiative.
————————————————————————————————————–
Advice for prevention
- Do not open attachments if you are unsure of the contents or the email was unexpected.
- Look for clues in the email content, usually most legitimate emails will address you by name and not something generic like ‘customer’ with vague wording.
- Do not click on website links in emails until you have viewed the link location (do this by hovering over the link, this will display the link right at the bottom of Outlook). Instead of clicking the link, you are best to manually browse to the website via your web browser.
- Make sure your anti-virus is updated regularly
- Make sure your backups are current and working and backing up ALL critical data
If you get a virus, malware or Trojan.
- Stop work
- Immediately disconnect any network drives
- Contact us
Please do forward this email on to your staff, friends and associates.
If in doubt or have any questions, please contact Sterling IT.
Regards,
Mark and the team at Sterling IT.
1300 763 699 (or 02 9756 6866)
