In a digital world where scammers constantly look for new methods to get into systems, security experts at Oregon State University are concerned that their defenses aren’t catching them all.
According to Lead Security Analyst Cameron McCawley, while software like Microsoft Defender XDR is catching a lot more phishing attacks than it did four years ago, certain qualities of the attacks are becoming more sophisticated, making them more difficult to spot and combat.
An article on the FBI’s website describes a phishing scheme is a scam “designed to trick you into giving information to criminals that they shouldn’t have access to.”
The article said victims will often receive an email that looks like it comes from their boss or a company they have done business with. The email will often have a link to a legitimate-looking website where they will be prompted to enter sensitive information like PINs, Social Security Numbers and bank account info, which the scammers will then steal for their own purposes.
“They’re (getting) a lot scarier,” McCawley said. “They’re able to bypass our Duo multi-factor authentication. We’re seeing a lot of lures that are very tailored to Oregon State University, like DocuSign or employee handbooks.”
Despite these more sophisticated methods, McCawley said the amount of actual compromises they are seeing is “pretty steady” in terms of volume.
“So it’s not really like it’s getting better or it’s getting worse,” McCawley said. “It’s like there’s different parts of these campaigns that attackers are improving on, but our defenses are also improving. So we’re catching them a lot more.”
McCawley said that scammers often compromise accounts for monetary gain through payroll fraud. They will often change direct deposit information, redirecting it to their own account.
Another technique used by scammers to defraud students is the gift card campaign, according to the Chief Information Security Officer at OSU, David McMorries.
“Imagine if you have an attacker who is posing as an OSU official and says something like, ‘hello student, I have a job opportunity for you,’” McMorries said. “You know, ‘I’m the department head of some school at OSU and I have an opportunity for you to pick up some easy money. Just send me your personal e-mail address.’”
McMorries said scammers use this technique to lure students outside of OSU protections, where their systems will be more easily compromised.
According to McCawley, the security team also typically sees a lot of employment phishing schemes at the beginning of summer, when students are looking for a job or internship.
“So the phishing e-mail will be getting (the students) to apply to a fake job,” McCawley said. “And that usually involves them having to send over information like bank information. An attack will send a check. The check bounces, so they get the routing number and they use that to get the bank account. So we see that quite often.”
While these schemes may ordinarily target students, they are usually also part of a broader goal of trying to compromise the university itself.
“So the credential compromise is one step towards that goal,” McCawley said. “Usually they’re trying to get an admin password or someone with high enough privileges where they can actually do some damage and escalate their privileges.”
However, McCawley noted that these attacks don’t often succeed because OSU cybersecurity experts are able to deactivate a compromised account as soon as they see one.
While OSU security experts are working hard to catch every scammer they can, McCawley says there are things the student can do to combat scammers as well. He suggests students should go through OSU’s Security Awareness training as well as report any email they think is suspicious to his team using Outlook’s report features.
“It’s available on the mobile client,” McMorries said. “It’s available on the web client. It’s available on the Outlook client that you might have in your machine and in your OSU account.”
McMorries said that if a student receives an email that looks too good to be true, it most likely is. He said that while 70% of submitted phishing reports turn out to just be spam or marketing, he and his team would rather students report it than not, just in case.
“I’d encourage students to not feel like they should be ashamed or embarrassed if they do fall victim to this,” McMorries said. “Because again, this is a crime and they didn’t ask for a criminal to perpetuate this on them.”
McMorries encouraged students who have been victimized by scammers to take advantage of the resources at OSU, like the Center for Advocacy, Prevention & Education, for help.
