Alumni Help Desk → Advisories → Phishing Attacks (June, 2008)

Phishing Attacks (June, 2008)

June 24, 2008

Problem

Some alumni may have received an e-mail purporting to be from Wesleyan (“support@wesleyan.edu”) asking for your username and password. This is called a “phishing attack”—an attempt by a malicious third party to gain access to your confidential information by posing as an authority and asking you for it.

Please note that Wesleyan will never ask for your password. Even if you forget your password, we don’t need to know what it is in order to help you. We simply reset the password and a program generates a temporary new one.

What to do

If you haven’t responded to a phishing e-mail you don’t need to do anything except for making sure that your password is a strong one (see below). If you sent your credentials in response to this message please change your password immediately. You can do this by navigating to Resources → Password Manager in WesNet. If your existing password does not allow you in to your account, please submit a support ticket explaining the problem.

Choosing a password

The most secure passwords consist of two “roots” with an “appendage” in the middle, e.g. roots1301shoots where neither the roots nor the appendage could be easily guessed about you from contextual information (e.g. keywords like “wesleyan”, “foss”, “hill” or your graduation year are not a good idea).

More information

The Wesleyan ITS article How to Deal With Phishing has more information. The essay Secure Passwords Keep You Safer by Bruce Schneier provides solid advice on choosing a password.

Getting Help