RIT Information Security Alert: Phishing Attacks Targeting RIT

RIT Information Security Alert: Phishing Attacks Targeting RIT


1. RIT community members are receiving requests to provide University Identification Numbers (UIDs). The attackers are posing as RIT community members who have forgotten their UIDs. The messages are being sent from external email addresses that mimic the RIT email addresses. (For example, STUDENTADDRESS@gmail.cominstead of STUDENTADDRESS@rit.edu.) Here’s an example of an attack message received:

​2. RIT community members are receiving messages purportedly from RIT that provide a link to Subscribe now to the Tiger's Tale Newsletter. The link provided in the email goes to a website hosted on Yolasite, which has a reputation for hosting scam sites.

Here’s an example of an attack message received. Note that although the From field says Rochester Institute of Technology, the associated email is not an RIT email. If you were to move your cursor over the Subscribe now link, you would see that the link goes to a non-RIT website:

What RIT is doing to protect you:

  • The ITS Service Desk will require proof of identity before resetting passwords over the phone. RIT community members are encouraged to use the automated password reset feature on start.rit.edu when resetting passwords.
  • RIT is working to identify and block the emails from reaching their intended recipients.
  • myMail.rit.edu has not been compromised.
  • Anti virus software with up-to-date virus definitions will protect against viruses and many other threats that may be associated with phishing emails. (McAfee Antivirus software is available free to RIT students, faculty, and staff for home use from http://www.rit.edu/its/services/security/)
  • MySpam MAY block many of these phishing e-mails. However, this is a highly targeted attack and spam filters may be less effective.

What you can do to protect yourself:

  • Protecting yourself from phishing attacks depends on your vigilance.
  • If someone asks you for confidential information such as a University Identification Number (UID), DO NOT provide the information.
  • If you receive an email requesting you to furnish a “forgotten” UID or other confidential information, send a copy of the email to phish@rit.edu.
  • Check the sender's email addresses and hover your cursor over the link in the email to find out where the link really goesFor example, Here's the link to the real Tiger's Tale Newsletter. Hover your cursor over the link to determine where it really goes.
  • NEVER RESPOND TO A REQUEST FOR YOUR PASSWORD sent by e-mail, even if the request appears legitimate. RIT will NEVER ask for your password through e-mail.

For more information:

REMEMBER: RIT will NEVER ask for your password through e-mail.

October is Cyber Security Awareness Month!  

This year is the 11th anniversary of National Cyber Security Awareness Month, a collaborative effort created between government and industry to guarantee everyone has the resources needed to stay safe online.

Multi-Factor Authentication

Enabling multi-factor authentication is one of the best things you can do to make sure your account information is not compromised.  Passwords alone will not always protect you, but using two or more steps to verify you are the account holder will help keep your accounts secure.

Common actions that lead to your password being stolen are:

Protective Mobile Device Software

One in every five people in the world own a smartphone according to a 2013 report in Business Insider and with the significant growth of smartphone usage, the issues surrounding mobile security have also grown. 

Using LinkedIn’s New Two-Factor Authentication

Using LinkedIn’s New Two-Factor Authentication

The growing trend in sites adding two-factor authentication to their log in process has many feeling more secure in their social media and other online interactions.

With passwords being easy to compromise with phishing attacks, many users have been hoping for something more secure.  Two-factor authentication gives a double protection on your account, requiring you to know something (your password), and have something in your possession (a token).  The token can be any number of devices, cards or other physical items, often generating unique codes as proof you have the object.  Think of ATMs.  You need to have the ATM card (the token) and know your PIN in order to access your account and do any transactions at the ATM.  One without the other and you can’t get in.

LinkedIn is using a single-use code sent via SMS to whatever mobile number is listed on the account.  Your mobile device serves as your token.  This code is entered into the site after you enter your password to complete the two-factor authentication.  The idea behind this is if your password happens to be cracked or phished, as long as you don’t lose or compromise your phone, you are still safe from attackers logging into your account (though you should change your passwords and do a virus scan to be safe if your password gets compromised!).  

Want to enable this security feature for your own LinkedIn account? LinkedIn provides some instructions here:  

Many other sites have similar security features so check out your account settings and give yourself an extra layer of protection.


As with any security chain, there are ways this could possibly be compromised.  The easy way is if an attacker knows your password and stole your phone.  A more sophisticated way is if you get phished for both your password and the code just sent to you, and the attacker users both before the code expires.  How likely could these happen?  Well that’s up to your security prowess.  Read more on our website about creating secure passwords (https://www.rit.edu/security/content/password), avoiding phishing attempts (https://www.rit.edu/security/content/phishing) and best practices when it comes to mobile device security (https://www.rit.edu/security/content/mobile-devices). 

Data Privacy Month--Private Information Disposal

Data Privacy Month--Private Information Disposal

This article was also published in the Quaestor newsletter of RIT's Institute Audit, Compliance, and Advisement.

Did you know that January is Data Privacy Month? 

For the last two years, we’ve focused on remediation and disposal of Private Information resident on RIT computers and we’ve made great progress. Have you thought about disposing of Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) that’s not on your computer? We encourage you to review paper filed, disks, CD/DVDs, video tapes, and any other type of storage media containing Private Information and dispose of those containing unnecessary Private Information appropriately.  Don’t forget that retention of RIT information is also governed by the Records Management Policy (C22.0).

Paper files containing Private Information pose a risk both to RIT and to the individuals whose information if in the materials. For example, on April 14th, 2011, Central Ohio Technical College found that course information had been left in a filing cabinet at an off campus storage facility, compromising the Social Security Numbers of over 600 registered students. RIT used a similar system with Social Security numbers until June 2006, when University IDs became the main means of registration and identification on campus. DataLoss DB (http://datalossdb.org/statistics) indicates that almost 25% of breaches have been due to the inadvertent loss of private information, in both paper and digital formats. Disposing of unnecessary Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) will help ensure RIT complies with Private information laws, policies, and procedures. 

 New York State defines private information (PI) as:

any personal information concerning a natural person combined with one or more of the following data elements: Social Security number (SSN), driver's license number, account number, or credit or debit card number in combination with any required security code. These combinations of information are often used in identity theft.

The New York State Information Security Breach and Notification Act requires that RIT notify affected consumers if their Private information is compromised.

If you’re not sure of whether or not to dispose of Private Information on your computer,  check with your manager or consult the Private Information Decision Tree here https://www.rit.edu/security/content/private-information-decision-tree

For more information about the Private Information Management Initiative, check out our PIMI FAQ page
https://www.rit.edu/security/content/private-information-management-initiative-pimi-faq and our Document Destruction page https://www.rit.edu/security/content/document-destruction

Data Privacy Month: Are You Smarter Than Your Phone?

Data Privacy Month: Are You Smarter Than Your Phone?


Did you know, “Smartphones can predict a user's gender with 71% accuracy, & can distinguish between ‘tall’ and ‘short’ people and ‘heavy’ and ‘light’ people, with about 80% accuracy?” Take a look at this recorded webinar from the January 9 EDUCAUSE Live! Data Privacy Month kickoff event with special guest, Rebecca Herold (the Privacy Professor) to find out just exactly how smart your Smartphone is.

Nearly everyone on a college campus today has a mobile phone, capable of accomplishing amazing tasks while on the go. But, how SHOULD you make use of your smartphone? You are smarter than your phone if you know that you need to make careful choices about using your geo-location feature. You might post a picture to Facebook while on your European trip if there are other people still living at your address back home. But, if your house is empty while you travel, you would be smarter to wait to post until you get home. Do you really want everyone to know you are out alone at midnight by "checking in" at your local donut shop? You are smarter than your phone if you use sound judgment about revealing your location. You’re smarter than your phone if you know you need to think critically about the sensitivity of the data you put on or access through your phone. Do you use your phone for banking, without password protecting the device? Your phone is happy to do it. But you are smarter than your phone if you protect it with a password. If you’re not thinking critically about what you do with your phone, we’ll help you think again!

The webinar covers fun facts as well as 16 ways to mitigate Smartphone security and privacy risks. Topics include tracking, info access, malware, breaches, loss, theft, ID theft, physical security, social media, and apps.

Webinar recording, slides, and chat transcript are available here