An update from IT Services about Mason’s network issues

Since the beginning of this year, Mason has seen a record number of phishing attacks with 84 fraudulent emails in the first six months alone.

According to Marilyn T. Smith, vice president for Information Technology and Chief Information Officer, the number of attacks is expected to increase.

“We’re no different than any other university or corporation in terms of phishing attacks. Everybody’s been getting more phishing attacks because the hackers are getting more sophisticated,” Smith said.

“[Hackers] know that’s a way, an avenue into systems, is through phishing,” added Robert Nakles, Executive Director of Strategy, Portfolio & Process Management for IT Services.

This past August, a report on phishing was conducted by Nakles; Curtis McNay, the Direct of IT Services; and Karen L. Bates, the Communications Coordinator for IT Services. In this report, phishing is defined as a way cybercriminals, who use real company’s logo or name, trick people into supplying sensitive information and then conduct illegal activities with it.

The report also explains that the reason so many phishing attacks happen at Mason is that it is one of the top research universities in Virginia. According to the report, cybercriminals are looking for access to all the information that Mason has, such as intellectual property, research data, and sensitive personal information. But Mason is not the only university that deals with this problem, the report said.

Smith said that IT Services is able to pick off some of the hackers with anti-spam software, but many hackers are clever enough to keep finding new ways to trick users. She said IT Services is working on new technology to combat these hackers.

“We actually have a project ongoing. Some of these technologies we’re looking at and some of them we’re actually implementing, but we don’t have a time frame yet. We just finished a pilot and we focus on the individuals with the most authority first and where the vulnerabilities is in the university are,” Smith said.

Still, McNay warns that these new technologies won’t necessarily be effective for long.

“It’s a bit of a cat-and-mouse game in that it escalates, and a lot of these technologies are very expensive and what works today may not work tomorrow,” McNay said.

Smith added that the best defense to these attacks is education, as many other universities would agree.

There are several precautions Mason IT recommends students, faculty and staff take in order to better protect themselves against these phishing attacks. An email sent out by Smith outlined a list of steps one should follow upon receiving a suspicious-looking email: Verify the link in any email to make sure the link is legitimate before clicking on it, since links can contain malicious software that can cause problems for users and interrupt the Mason network; never share a username (NetID) or password, since many attacks start with an email requesting this kind of information; and when unsure of the legitimacy of a request in an email, follow up either by logging onto the web site directly by entering the main address into an Internet browser or by calling the company on the phone.

After an email is verified as fraudulent, IT asks that the suspicious email be forwarded to the IT Services Support Center at support@gmu.edu and then deleted.

Phishing attacks aren’t the only issue IT Services has been dealing with lately. They have also had disturbances from hackers and are continuing to address student’s favorite complaint: WiFi.

Last spring, a group of hackers attacked and defaced seventeen websites, all of which were subsidiary websites or tertiary websites to Mason’s main webpage, gmu.edu. The hackers’ work was found right away, and the websites were restored by ten o’clock the next morning. Still, hackers have proved to be just as big an issue as phishing, according to McNay. The two are in fact connected.

“We see more hacking attempts and we see more phishing attempts, and they come hand in hand. They are not independent — phishers are just professional hackers,” McNay said.

Smith said those hacking attacks in the spring were due to outdated plug-ins on the website. Since then, the websites have been updated, and no new attacks have been conducted to that extreme.

In terms of the WiFi, Smith explains that the reason students had problems connecting last week is that there was an issue with Mason’s Internet provider. She added that IT Services is planning to speak with the provider to ensure that such an issue doesn’t happen again. As for the WiFi issues that were rampant last semester, Smith explained that they were due to problems with Mason’s firewall provider.

“We were working with a firewall provider and there were issues with that provider. We worked all summer with that provider and we came up with a solution, and we believe that — and we’re monitoring very closely — things with the WiFi are much better,” Smith said.

Smith added that there are certain spots on campus where Wifi is not as pervasive as IT Service would like it to be but that staff are working with a vendor that will hopefully beef up the local WiFi support in these spots, many of which are in the Johnson Center.

“The recent problems have not been WiFi, but I can understand why students [would think this],” Smith said.

“WiFi by itself is a tuning issue,” McNay added. “WiFi isn’t as simple as putting in a new wireless access point and then people will have access. Tuning it so that one wireless access point detects that it’s overloaded and traffic can be switched to another is like tuning an instrument.”

Some students, like sophomore Claire McTiernan, feel IT Services has not been keeping up with Mason’s needs to the best of its abilities.

While some students may feel IT Services has room for improvement, others like freshman Jacob Farrar think it is doing just fine.

“I think IT is doing a pretty good job of it. I see the notifications on Blackboard telling me what I need to look out for and I’m more knowledgeable about these scams because of this. Also, you can sign up for an email telling you about these scams, which helps a lot,” Farrar said.

All in all, Smith, McNay and Nakles all agree that students who want to protect themselves need to be cautious with unfamiliar emails and links and educate themselves against the risks of cyber-attacks.

“I would say [students should] think twice about anything they do or answer,” Smith said. “We’ve all agreed that we have a bunch of security projects we have to do and education is, if not the most important, almost the most important [project].”