1. Home ›
  2. Cybersecurity ›
  3. Recent Security Bulletins ›
  4. Past Security Bulletins

Past Security Bulletins

November 1, 2024

OIT Would Never Ask This!

Scam Email Example

A phishing campaign has been aggressively targeting the Notre Dame community. It is coming from real ND email accounts accessed by hackers. While it looks official, it DID NOT come from the Office of Information Technology (OIT).

Opening links or scanning QR codes in email like this can result in compromised accounts, and can even lead to you losing money.

Notre Dame's Office of Information Technology will NEVER:

🚨ask you to confirm your email is still in use

🚨ask you for your username and password

🚨send you an unsolicited request to authenticate

🚨add QR codes to email that "confirm your account"

If you have received the email described above, do not click on any links. Report phishing immediately and delete the message. To do so in Gmail, click the three dots in the top right corner of the email, and select “report phishing” from the drop down.

Information Security has contained and removed this activity from Notre Dame systems, however, as these attacks continue it is important to remain vigilant and report suspicious emails.

October 15, 2024

Critical GitLab Vulnerability Requires Patching

Who is affected?

  • Developers or system administrators hosting a self-managed GitLab instance.

What You Need to Know

  • GitLab has patched several vulnerabilities, including one critical vulnerability, in GitLab Community and Enterprise that allows attackers to run pipeline jobs as any other user.

  • Immediate patching to versions 17.4.2, 17.3.5, and 17.2.9 is required.

Why it matters

  • By leveraging this weakness, attackers can exploit it to trigger a new pipeline as an arbitrary user.

Go deeper

The Office of Information Technology (OIT) Information Security team requires all GitLab installations running an impacted version to be upgraded to the latest version as soon as possible.

October 11, 2024

Phishing Scam and Firefox Update

This email covers two separate security issues that may affect you:

  • Phishing attack pretending to be Okta

  • Mozilla Firefox security flaw requires browser update

MFA Phishing Scam Summary

  • A phishing attack impersonating the University’s multi-factor authentication (MFA) Okta communications has targeted nd.edu emails.

  • The email asks the recipient to complete the Okta sign up process.

  • The link takes users to a malicious page that looks like the Okta login page, and is designed to capture credentials for account compromise.

If you have received the email described above, do not click on any links. Report phishing immediately and delete the message. To do so in Gmail, click the three dots in the top right corner of the email, and select “report phishing” from the drop down.

What it looks like:

Information Security has contained and removed this activity from Notre Dame networks, however, it is important to remain vigilant and report suspicious emails

Mozilla Firefox Security Flaw

  • Mozilla has announced a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR), which is under active exploitation.

  • Update your Mozilla Firefox browser immediately to Firefox 131.0.2, Firefox ESR 128.3.1, or Firefox ESR 115.16.1.