Recently, it has come to light that there is an active exploit being launched against computers running Microsoft Word on both Windows and Mac operating systems that embeds malware within. Microsoft has released a security advisory (2953095) that explains in detail the entire issue, but in summary this is what we know.
We have received notification from our Staples Online Account manager that there are fraudulent emails being circulated that mimic official Staples communications. The issue, is that these emails have spoofed the content and the web links contained in the communication will direct the user to locations which will download viruses. Please use extreme caution when following links from Staples emails and report any suspicious issues to the Solutions Centre Staff at (403)329-2490 or email@example.com.
Drive By Downloads
The concept of a drive by download is not a new thing in the Information Security field. According to Wikipedia
A drive-by download means two things, each concerning the unintended download of computer software from the Internet:
Recently, it has been discovered that there is a new error in the Java software. Java is used in a wide array of devices, and computers, including most popular web browsers. The issue being reported on claims that that your computer can be infected with viruses and malware without you having to do anything. Simply navigating to a webpage can leave your system compromised.
The following email has been circulating around the local area. It contains fake links to sites that will download malicious software onto your computer. Please do not click on these links.
A way to check for the validity of a link is to hover your mouse over the link and a popup window (sometimes on the bottom of your browser) will emerge that shows you the actual destination. For example:
On Nov 14, 2012 approximately 40 emails that contained links to malware were received by the University. These emails were not trapped by our filters and were delivered to individual's email inboxes without being flagged as malicious. Although our corporate antivirus solution should protect any user from the attachments contained in the link, we want to alert users to be aware of this scam, and to NOT click on links that are suspicious in nature.
The mailicious email looked like this (links have been modified to prevent accidental access):
Notice Date: Aug 31, 2012
What is this IT Services Notice about?