MSU's Office of Regulatory Affairs confirmed to me this afternoon that the email "Re-validate your mailbox" (the one with the benign link) is part of Dr. Richard Wash's project and did have IRB approval (even though that was not stated on the target webpage). ORA waived consent of users because the researcher wanted recipients to believe it was real.
If you or your users wish to provide feedback or explain any concerns / frustations, you may email ORA at [log in to unmask].
~ Esther
Esther V. V. Reed
IT Systems Administrator
MSU Dept of Physics and Astronomy
[log in to unmask]
-----Original Message-----
From: David McFarlane [mailto:[log in to unmask]]
Sent: Thursday, October 27, 2016 5:22 PM
To: [log in to unmask]
Subject: Re: [MSUNAG] Email Phishing
Hmm, OK, so if I get a legitimate looking e-mail from an MSU address that says someone with an IP address in Cairo tried to log in to my account (that is what my message said), and it has a link that goes to msu-itservices.com (instead of msu.edu), am I supposed to follow the link or not? Or just phone the Help Desk, like I did? What exactly is MSU ITS trying to train us to do?
-- dkm
On 2016-10-27 5:01 PM, Kim Geiger wrote:
> It's a redirect to MSU:
>
> http://www.drlinkcheck.com/results/ab7fb5
>
>
>
>
>>>> "Plemmons, Steve" <[log in to unmask]> 10/27/2016 3:44 PM >>>
> The one that someone in my department alerted me to sounds to be almost exactly like yours, but the link was not to an ITS address. It was a link that included the domain msu-itservices.com. Are you suggesting that this IS an MSU ITS domain or does it forward to itservices.msu.edu? I'm not interested in clicking on it to find out.
>
> Thanks,
>
> Steve Plemmons
> Director of IT
> Department of Mathematics
> Michigan State University
> [log in to unmask]
> 517-353-4673
>
> -----Original Message-----
> From: Kim Geiger [mailto:[log in to unmask]]
> Sent: Thursday, October 27, 2016 3:28 PM
> To: [log in to unmask]
> Subject: Re: [MSUNAG] Email Phishing
>
> Well, it does seem like someone at MSU decided to see how many suckers they could catch on campus.
> I pay so little attention to such messages that I barely noticed that I received one that said, "Someone attempted to sign into your email account ([log in to unmask]) with random incorrect passwords from (IP: 207.73.216.41 in Cairo, Egypt)" and that I should click on a link. The rest of the message seemed like it was trying to pretend to use weird spammy syntax, but didn't really succeed in the fakery.
> The link was to an ITS page. Email headers show it to be from an ITS address and a campus ip number Am I the only one who thinks this is just ....uncool? For one thing, it caused some user consternation, and at least one person was unproductive while we scanned her machine for potential nasties because she reported she'd clicked on a phishing link ("because this one looked so real").
> Second, it makes everyone who received it experimental subjects without our permission. A no no no.
> Third, it's ITS again doing something without telling us about it and making life harder for reasons that, in this instance, are hard to fathom -- So, they found out that some people will click on phishing links? My, what a unique insight.
>
>
> Kim Geiger
> WKAR Radio & Television, WKAR.org
> East Lansing, Michigan
> 517-884-4766
>
>
>
>>>> Kim Geiger <[log in to unmask]> 10/26/2016 2:09 PM >>>
> I also had a user fall for this one. How do you know the link is "benign"??
>
> Kim Geiger
> WKAR Radio & Television, WKAR.org
> East Lansing, Michigan
> 517-884-4766
>
>
>
>>>> Gary Schrock <[log in to unmask]> 10/26/2016 11:10 AM >>>
> I had someone forward me one yesterday that it turns out when I go
> back and check the link out it indeed takes one to a page along those
> lines. I thought it was a little interesting that by the time I had
> responded to my user about it that it wasn't being blocked by msu yet,
> since they normally start blocking things pretty quick.
>
> Not sure I'm a big fan of this myself. Not the least of which at the
> minimum, it ultimately means more work for me, since I invariably will
> get people forwarding the various phishing emails to me asking if
> they're legit. And of course, if that link was personalized to the
> recipient (which is quite possible considering the long string of
> seemingly random characters in it), they'll now think that that person
> followed it, when it was actually me when investigating.
>
> On Wed, Oct 26, 2016 at 10:59 AM, James Sprague <[log in to unmask]> wrote:
>
>> Just a thought here, but has anyone else seen an increase in email
>> phishing from MSU related domains? My friend had a user click on it
>> the other day and said when you went the link it showed an MSU page
>> saying something along the lines of you've been phished and was completely benign.
>> Additionally, he looked at the root of site and it went to some
>> Symantec login page. I'm wondering if campus is using
>> https://www.symantec.com/
>> services/cyber-security-services/cyber-skills-
>> development/phishing-readiness and just hasn't told the rest of the
>> IT community.