IU warns students about scam

An e-mail sent last week from a student’s hijacked IU computing account threatened many IU students, faculty and staff.\nChief Information Technology Security Officer Tom Davis said the hacker accessed the e-mail account from outside the U.S., most likely through an also-hijacked computer, making it difficult to determine the hacker’s identity.\n“This hijacking could have occurred through a variety of methods, perhaps because the student downloaded a virus, fell for a phishing attack or used the user name and password from a compromised machine in a coffee shop kiosk,” Davis said.\nThe e-mail opened with the statement, “This is the only way I could contact you for now, I want you to be very careful about this and keep this secret with you for now. You have no need of knowing who I am or where I am from.”\nThe e-mail claimed to originate from a person who was hired to murder the recipient, and said the murder could be avoided if the recipient paid $8,000. Throughout the e-mail, the recipient was told not to contact the police. \nAfter the IT Security Office learned of the break-in, it terminated the IU account that sent the message. \nDavis explained that, in these circumstances, University-wide Webmail accounts are not the issue. The student’s user name and password were hijacked and used by the individual who actually sent the e-mail, Davis said.\nIn the future, Davis warned that it is important for students to take adequate measures to protect their personal data by installing and keeping antivirus software up to date as well as configuring computers to automatically update against security threats. \nSome other preventive techniques include turning on the computer’s firewall, not falling for “phising” attempts and being careful not to provide sensitive information such as passwords and credit card numbers to unknown recipients.