It happens every so often. A student sees an email claiming their UGA account has been locked because of improper access and needs to be verified, their storage capacity has exceeded its limit or their account needs to be upgraded.
These are called phish, and every once in a while, a student takes the bait.
“All spam is technically phishing, but phishing is targeted towards trying to fool you into doing something or giving away personal information. So it is a scam that wants you to give up information,” said Laura Heilman, the security awareness training and education manager at EITS at the University of Georgia
Heilman said these spam emails are inevitable.
“Fifty percent of all email in the entire world that gets sent is spam, and a certain amount of that is phishing, approximately 10 percent,” she said.
While research shows roughly a 20 percent decrease in spam in the last three years due in part to better filtering, Heilman said that UGA students and faculty still face a high volume of spam, despite several filters and programs set in place by EITS to combat this spam.
“Microsoft manages our email, and so Microsoft has given us a bunch of different filters that we can apply to the email system,” she said. “We have those applied, and we have software to stop it on our firewall. But we still get around 19 million spam emails every year.”
Heilman said these emails pose a significant threat to security at the university.
“One we’ve seen recently is where it says it’s from the administrator of the email, someone tried to access your account and we blocked it, click here to unblock your account,” she said. “It has a signature that looks a little dodgy, but possibly legitimate. It’s not, but some students are clicking that link which takes you to a webpage where you can fill in name, username and password.”
When students fill out this information, Heilman said, they are giving away enormous access and personal information for spammers to use.
“A lot of students assume that we need that information in order to manage your account, but EITS does not,” she said.
But while EITS never requires a student’s MyID, many students still give it away to phishing emails.
“A lot of people don’t understand how important your MyID is,” she said. “If you give it away, a lot of people think it’s just their email account. But that account is on the UGA network. So you’ve given away everything about you in your email account, as well as possible access into the network itself.”
And while with a close eye it is easy to see through a spam email, several students still click links provided and give away access to their accounts.
“When a student does make the mistake of falling for a phish, we often have to shut down their account,” Heilman said.
A student account that is shut down is given a temporary password until the student calls the help desk and reclaims access by setting a new password.
“We’ve had to shut down about 1,000 accounts so far this year,” she said.
Heilman said students giving away their account information makes it more difficult to block spam, because the spammers then use the hacked email account to send out spam.
“The spam filters then see that the email is coming from a trusted UGA email account, and it’s harder to spot without blocking all trusted UGA email accounts,” she said.
Spam emails is an industry, Heilman said, where the sole purpose is to send out these emails in hopes that someone will fall for the trap.
“It’s people’s day job to make them look as legitimate as possible, and to send out thousands every day,” she said. “It’s a huge criminal industry.”
And she said universities are a prime target for spammers, who want to access the network and take personal information from unsuspecting students.
“These spammers use automated programs that can comb through lists of email addresses, which can be bought,” she said. “People can buy and sell regional email addresses, and then send out the spam to those email addresses.”
EITS is working to campaign against spam emails by informing students about what they can do to stop the phishing.
“Students could set up additional filters in Gmail or other email clients. They could block the execution of JavaScript, which is often used for spam ads that drop trackers,” Heilman said. “Your anti-virus on your computer doesn’t stop phishing. And these emails get past filters because they’re coming from trusted email accounts because someone else clicked on the link in the past.”
Heilman said any time an email asks for a student’s MyID, it is most often fake.
“A lot of students assume that we need that information in order to manage your account, but EITS does not,” she said.