{"id":132631,"date":"2021-11-11T12:20:07","date_gmt":"2021-11-11T11:20:07","guid":{"rendered":"https:\/\/www.erasmusmagazine.nl\/en\/?p=132631"},"modified":"2025-12-19T11:25:58","modified_gmt":"2025-12-19T10:25:58","slug":"hundreds-of-eur-students-tricked-by-phishing-e-mail","status":"publish","type":"post","link":"https:\/\/www.erasmusmagazine.nl\/en\/2021\/11\/11\/hundreds-of-eur-students-tricked-by-phishing-e-mail\/","title":{"rendered":"Hundreds of EUR students tricked by phishing e-mail"},"content":{"rendered":"

You receive an Excel file by e-mail from a co-student and before you\u2019ve really thought about it, you\u2019ve clicked on it, making you a victim of phishing. That Excel file wasn\u2019t a file at all but a link, and when you thought you were logging into Office, you were actually giving your password away to hackers.<\/p>\n

\"\"

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tElzeline Kooy<\/a>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure>

Some 7,000 EUR students received such an e-mail in their inbox two weeks ago. Approximately 10 percent of them also clicked on the malicious link in the phishing e-mail. At least six of them had their student account password stolen.<\/p>\n

Some students received an e-mail that appeared to contain an Excel sheet as an attachment. In reality this was no Excel file but a link to a website with an Office 365-like login form. If the students entered their e-mail address and password there on the assumption that they could view the file, the attackers obtained their password. Other students received an \u2018attachment\u2019 that appeared to come from the software company Citrix. This deceived the students in a similar way.<\/p>\n

E-mail goes viral<\/h2>

Once an e-mail address has been hacked, the contact list is often read to spread the virus further, explained ethical hacker Sijmen Ruwhof, who studied the phishing e-mails at EM\u2019s request. The obtained e-mail addresses were then used again to send the phishing e-mail to other students. The attackers then, presumably accidentally, stumbled across an e-mail list for all students who started studying in 2019. The e-mail then went viral and ended up in 7,000 inboxes. This e-mail list should not have been accessible to everyone and has now been blocked.<\/p>\n\t

\n\t\t

‘My laptop warned me’<\/h2>\n

On the condition of anonymity, one of the students who was victim of the phishing attack told EM what happened. \u201cI received an e-mail from a director of an external organisation where I\u2019d previously worked. That\u2019s why I trusted it. When I tried to open the attachment, my laptop warned me that the link was dodgy. I then quickly closed the e-mail and deleted it.\u201d The student did not enter any account details on a form. The student then received no e-mails for two days before hearing that \u2018a huge number\u2019 of fellow students had received the phishing e-mail from the student\u2019s account. It is unclear for which part of these e-mails this student is \u2018responsible\u2019.<\/p>\n

The student\u2019s name is known to the editors.<\/em><\/p>\n\n\t<\/div>\n

Security<\/h2>
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tElzeline Kooy<\/a>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure><\/div>

The attack took place in the week of 25 October. Rory O\u2019Connor, EUR\u2019s Chief Information Security Officer immediately noticed that a \u2018password spraying\u2019 attack was taking place. This is when an attacker tries out the same password simultaneously on many different EUR accounts. Five accounts later appeared to have been hacked. Two phishing e-mails were then sent.<\/p>\n

There are all kinds of protections against phishing and EUR uses several of these. EUR uses a system known as Safelinks that should block phishing links in e-mails. And yet, the malicious links slipped through the system. \u201cThat\u2019s because these links were not yet known as phishing sites; they were made especially for EUR,\u201d explained O\u2019Connor. \u201cThey have now been added to the blacklist by Microsoft and the company that manages the phishing websites has been asked to remove the fake login forms.\u201d If someone clicks on the links now, only an empty page appears.<\/p>\n

EUR also uses a so-called SPF record as defence mechanism, stated Ruwhof. \u201cThat prevents unauthorised persons from sending e-mails using EUR\u2019s domain. Normally this is possible: the e-mail protocol dates from a time that criminality was not yet an issue on the internet. That\u2019s why hardly any protections are built in. \u201cHowever, with an SPF record people can e-mail on behalf of EUR, but your spam filter will ensure that the e-mail automatically ends up in your spam folder.\u201d<\/p>\n

Missing lifesaver<\/h2>

Another lifesaver could have been multi-factor authentication (MFA), but EUR has not yet activated this for student e-mail. MFA is a protection in which you need to demonstrate, in addition to a password, that you are the owner of the account, for example via a code that is sent to your e-mail or telephone.<\/p>\n

This protection is available for researchers and employees, but not yet for students. \u201cThat\u2019s a huge group and we need to introduce MFA very carefully,\u201d was O\u2019Connor\u2019s explanation for why this is missing. He could not yet say within which period MFA would become available for students.<\/p>\n

According to Ruwhof, it is extremely important that MFA is introduced quickly. \u201cYou certainly need MFA on e-mail. If a hacker accesses this, they can often hack into many more of the victim\u2019s accounts.\u201d<\/p>\n

Only university<\/h2>

As far as O\u2019Connor is aware, EUR is the only university that was targeted. \u201cWe always have contact about this via SURF, the IT cooperative arrangement for universities. But nothing was known about this at the other universities. I deduce from this that we stopped the attack in time.\u201d<\/p>\n

The university contacted the Rotterdam police cybercrime unit, so that the unit could investigate who was behind the attack. \u201cHowever, we know from experience that it\u2019s unlikely that we\u2019ll find out,\u201d stated O\u2019Connor.<\/p>\n

The motive for the attack is also still unclear. \u201cThe attackers focused on collecting login details. As we were able to stop the attack at an early stage, it\u2019s not clear what the attackers were planning to do next.\u201d They could have been planning to obtain sensitive scientific information or an attack with ransomware.<\/p>\n

Don\u2019t just click<\/h2>

You can do various things to avoid becoming a phishing victim, explained Ruwhof. \u201cIn any event, never just click on a link! First hover over it with your mouse to see where the link leads to. And ask yourself: why have I received this e-mail? It\u2019s so stupid, but just one click can take you somewhere on the internet where you don\u2019t want to be. Then sooner or later you\u2019ll fall prey to criminal hackers.\u201d If you think you\u2019re a victim of this, contact the university service desk, recommended O\u2019Connor. \u201cThen we can act quickly to stop the attack before things get worse.\u201d<\/p>\n\n\t

\n\t\t\n\t\t
\n\n\t\t\t\t\t\t\t

Read more<\/h2>\n\t\t\t\n\t\t\t