Update on Google Phishing Scheme + 5 Ways to Protect Yourself

May 18, 2017
Categories: News

On May 3, a worldwide phishing incident happened where people were invited to click a “shared” Google Drive document. Once people clicked the link, they were then asked to allow access to their account so they could access the Google Doc. It was a “bait & switch,” so to speak.

Upon discovering the problem, ITS immediately notified Google and the campus via email, System Status alerts and Twitter. Google stopped the attack and removed malicious access in approximately one hour; however, within that time, over 600 employees and students clicked the link and then clicked a second time which gave the offenders access to their contacts and Google Drive.

Do I need to worry if someone has my account information?

Google has issued this statement: “While contact information was accessed and used by the campaign, our investigations show that no other data was exposed. There’s no further action users need to take regarding this event; users who want to review third-party apps connected to their account can visit Google Security Checkup.”

You can also read this Google blogpost for more details about the incident.

5 Ways to Protect Yourself from Phishing Schemes

No system is foolproof; however, here are 5 ways to protect yourself:

  1. Hover before you click on any link; if the link is suspicious, report the email to spam@uncc.edu and then delete it.

  2. Look at the email To/From/Subject information. See the “hhhhhhhhhhhhh” in the “To” field from last week’s email?

  1. When it comes to Google, you should never be prompted to allow access to Gmail, Contacts, Calendar or Drive via email. If you are, delete it.

  2. Do not authorize access to anything unless you are 100% sure the request is legitimate ( e.g. you’re installing an approved Google app).

  3. Subscribe to ITS’ System Alerts group. Not only will you be automatically notified when a campus-wide system is having problems, you’ll also receive reported large-scale phishing attempts. Follow the instructions in this FAQ to join the group.

For more information on how to protect yourself, here’s a list of best practices, as well an FAQ about ITS Security Awareness Training sessions. As always, please contact the IT Service Desk for other questions or concerns at x. 7-5500 or visit the Walk-Up Service Desk on Atkins Library’s main floor, room 140C.