“While this is not unexpected, we know that phishing and hacking attacks occur every day of the year, this shows how increasingly sophisticated the attacks are becoming on what might have previously been thought innocuous targets. Students are particularly vulnerable to phishing, especially those who are looking at the next round of education / courses for them to attend. Cyber-squatting on similar URLs has been an issue for many years and shows no sign of abating, despite the known problems and measures to ensure that verified entities are the ones requesting the domain.
As per usual, there needs to be education to the students around the issue – and to be very wary of requests made. Universities should look to subscribe to services around cyber-squatting which watch for similar domain registration to ensure that they are not being faked… as ultimately this will damage their reputations. There is talk of two factor authentication (2FA) for access to university services, with everyone having access to a mobile phone (constantly!), there is no reason not to do this using something like Google Authenticator. Universities are a source of our brightest people and ideas they need to be kept as safe as possible from cyber-attackers.”
‘Regardless of whether or not these universities were singled out or not, the simple fact remains that phishing emails are still a major threat. People with UK university log-ins were sent phishing emails to trick them into giving up their passwords and I wouldn’t be surprised if a sizable number fell for it. It seems plausible that your university library would email you as a student, direct you to a page and then ask for your credentials. This would indeed be something that the students would be expecting and therefore comply with, especially someone with an untrained eye unaware that the redirected page could be fake. We have to remember that we are human and humans make mistakes. Even cautious people can sometimes click on malicious attachments or links. This is simply because education still isn’t enough and people will continue to be fooled. It’s just that simple.
We need to remind people that even with the best systems in place, simple phishing emails can still get through the net and do some damage. Maybe the universities could implement two factor authentication as another layer of security to help mitigate further attacks so even if the criminals grab hold of the passwords, they would still struggle to penetrate the network.’
Corin Imai, Senior Security Adviser at DomainTools:
“This is a different nation-state tactic than ones we hear about most often. While there’s a plethora of examples of election hacking, disinformation and disruption, attempting to access intellectual property for nefarious purposes could be just as dangerous. The fact that the Iranian nation-state targeted cyber-focused UK university courses indicates this feeds directly into the nation’s cybersecurity strategy; By understanding what students in the West are being taught about cyber, it gains them the upper hand in terms of bypassing the protective efforts. The fact that the Universities were targeted via phishing emails is further proof (if ever proof was needed) that phishing is still an effective method of compromise, and one that the general public still needs to be educated on.”
“When receiving an email you didn’t expect, containing a link, it is better if you go to link manually and not by clicking it. Having said that, it is easy to notice the trend in phishing, where the attackers are targeting specific sectors with a common interest, so they can gain the trust of the victims easily. We’ve come to a point where the human eye just doesn’t cut it and only advanced algorithms can flag the bad correctly.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.