Re: .edu email phishing

[Dave Koontz <dkoontz () MBC EDU>]

Tim, if you are running Barracuda (Spam Assassin) with ClamAV, check out
Sane Security's Phishing and Scam signatures.  They do a great job of
catching these phishing messages and most of the others out there (like
eBay, banks, etc.)   Just schedule an update to run periodically.

http://www.sanesecurity.co.uk/clamav/downloads.htm
> Winders, Timothy A wrote:
> > Thanks, Jesse.
> >
> > I see that you are the owner of that project.  Is there a way to
> > automatically incorporate that list into anti-X products?  In my case
> > specifically, we use the Barracuda antivirus appliance.  While I can
> > manually enter the email addresses, keeping it updated and current
> > over time seems a monumental task.
> >
> >
> > Tim Winders | Associate Dean of Information Technology | South Plains
> > College
> >
> >
> > > -----Original Message-----
> > > From: The EDUCAUSE Security Constituent Group Listserv
> > > [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Jesse Thompson
> > > Sent: Wednesday, April 02, 2008 9:12 AM
> > > To: SECURITY () LISTSERV EDUCAUSE EDU
> > > Subject: Re: [SECURITY] .edu email phishing
> > >
> > > http://code.google.com/p/anti-phishing-email-reply/
> > >
> > > Jesse
> > >
> > >
> > > Jimmy Kuo wrote:
> > > > Was this a directed (against caltech.edu) attack or was this one of a
> > > > family sent to other .edu lists?  Has anyone seen one like this for
> > > > their school?
> > > >
> > > > The return address was actually set up for:
> > > >
> > > > ask.helpdesk0 () gmail com
> > > >
> > > > Jimmy
> > > >
> > > > > > ----- Original Message ----- From: "ADMIN HELPDESK"
> > > > > > <helpdesk () caltech edu>
> > > > > > To: <undisclosed-recipients:>
> > > > > > Sent: Monday, March 31, 2008 12:39 PM
> > > > > > Subject: VERIFY YOUR CALTECH.EDU EMAIL ACCOUNT NOW.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > Dear caltech.edu Email Account Owner,
> > > > > >
> > > > > > This message is from caltech.edu messaging center to all
> > > caltech.edu
> > > > > > email
> > > > > > account owners. We are currently upgrading our data base and e-mail
> > > > > > account
> > > > > > center. We are deleting all unused caltech.edu email accounts to
> > > > > > create more
> > > > > > space for new accounts.
> > > > > >
> > > > > > To prevent your account from being closed, you will have to update
> > > it
> > > > > > below so
> > > > > > that we will know that it's a present used account.
> > > > > >
> > > > > > CONFIRM YOUR EMAIL IDENTITY BELOW
> > > > > >
> > > > > > Email Username : .......... .....
> > > > > > EMAIL Password : ................
> > > > > > Date of Birth : .................
> > > > > > Country or Territory : ..........
> > > > > >
> > > > > > Warning!!! Account owner that refuses to update his or her account
> > > > > > within Seven
> > > > > > days of receiving this warning will lose his or her account
> > > permanently.
> > > > > > Thank you for using caltech.edu
> > > > > > Warning Code:VX2G99AAJ
> > > > > >
> > > > > > caltech.edu Team
> > > > > >
> > > > > > www.caltech.edu
> > > > > >
> > > > > > Dear caltech.edu Email Account Owner,
> > > > > >
> > > > > > This message is from caltech.edu messaging center to all
> > > caltech.edu
> > > > > > email
> > > > > > account owners. We are currently upgrading our data base and e-mail
> > > > > > account
> > > > > > center. We are deleting all unused caltech.edu email accounts to
> > > > > > create more
> > > > > > space for new accounts.
> > > > > >
> > > > > > To prevent your account from being closed, you will have to update
> > > it
> > > > > > below so
> > > > > > that we will know that it's a present used account.
> > > > > >
> > > > > > CONFIRM YOUR EMAIL IDENTITY BELOW
> > > > > >
> > > > > > Email Username : .......... .....
> > > > > > EMAIL Password : ................
> > > > > > Date of Birth : .................
> > > > > > Country or Territory : ..........
> > > > > >
> > > > > > Warning!!! Account owner that refuses to update his or her account
> > > > > > within Seven
> > > > > > days of receiving this warning will lose his or her account
> > > permanently.
> > > > > > Thank you for using caltech.edu
> > > > > > Warning Code:VX2G99AAJ
> > > > > >
> > > > > > caltech.edu Team
> > > > > >
> > > > > > www.caltech.edu
> > > --
> > >    Jesse Thompson
> > >    Email/IM: jesse.thompson () doit wisc edu