I think Larry's question suggests that a lot of people in the community
could stand a review of phishing attack indicators. In this case, there
are several. Regrettably, I deleted my own copy of the scam, so I
cannot analyze this particular message exhaustively. However, Wes's
observations alone are enough to expose this as phish.
Any time that you receive a link in an email, verify that the domain
that it points to jibes with the source of the sender and the intent of
the message. In this case, who send the message to you? Microsoft? Or
UVM? Or someone else entirely? If it was UVM, why would we send you to
to "bit.from-fl.com" to "reconfigure your Outlook Client"? If it was
from Microsoft, why would the target URL not be "microsoft.com"? If it
was neither UVM nor Microsoft, why would the sender have any authority
over the configuration of your Outlook client?
There are other give-aways here. The message gives you no indication as
to why you need to "reconfigure Outlook", nor what following the link
will do to your client, nor how you can get help if you have problems
with the link. All of this is information that you should expect from a
valid Microsoft or UVM tech support announcement. If the message does
not explain these points adequately, it is either a scam, or it came
from an IT staff member who needs a stern talking-to.
Finally, I noticed that my copy of the message stated that I needed to
update "Outlook 2012". Since Outlook 2012 does not exist (the current
version is 2010), I deleted the message immediately.
There are lots of online resource available to help you identify a
phish. Google around a bit. A good starting point might be:
http://pages.ebay.com/education/spooftutorial/index.html
On this page, ebay support explains how to spot a fake email message
from ebay. Much of what is covered here also applies to communications
from UVM support staff.
-J. Greg Mackinnon | ETS Systems Architecture and Administration | x68251
On 4/30/2012 1:00 PM, Larry Kost wrote:
> A bunch of folks have received the following.
>
> Notification ID: 32SZA1Q
> ==========================================
> - Please reconfigure your Microsoft Outlook information again .
> - Click on the link below to setup .
>
> http://www.microsoft.com.outlook.setup.bit.from-fl.com/outlook/index.php?id=32SZA1Q
>
> =========================================
>
> Is it real or a hoax? As far as I know, there is only person in my
> department who even used Outlook.
>
> LLK
|