In March 2020, Chatbook, a photo print service, suffered a data breach. Approximately 15 million user records were put up for sale on a dark web marketplace. This information includes email address, names, phone numbers, social media profiles and password. 

19 UMBC accounts were affected by this breach. The affected individuals have been notified via their UMBC emails and/or their alternate emails. If you have a Chatbooks account, please contact them to see if you have been affected by this breach.

This information was provided to Have I Been Pwned(HIBP) by dehashed.com.

For more information about the Chatbooks breach visit:

https://www.bleepingcomputer.com/news/security/chatbooks-discloses-data-breach-after-data-sold-on-dark-web/

To setup a recovery email for your UMBC account follow the instructions here:

https://my3.my.umbc.edu/groups/itsecurity/posts/94776

If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

DoIT Security has received a new variation of a classic get-rich-quick scam, this time claiming to be from a Powerball winner who wishes to distribute millions of dollars, supposedly to lessen the impact of COVID-19. Over 5000 UMBC addresses received emails from this sender, most likely containing the same message.

From: "Bill and Helene" <kkt-co@beige.plala.or.jp>

Subject: We Have Private For Donation

Date: Tue, 11 Aug 2020 14:26:21 +0900

--

The Corona Virus (COVID-19) Outbreak isn't just a major health

crisis -- It's also a large economic disruption leading to people

Losing their Jobs and making it harder to take care of their

Families.

We know that a little financial support can go a Long Way.

I'm Bill Lawrence from Sacramento California the Winner of 150 million

United State Dollars Jackpot from the Power ball lottery held on

December 16, 2019. My Jackpot was a gift from God to me.

Hence my entire Family has agreed to do this.

We are donating $75 million to Help individuals and Small Scale

Businesses around the world.

I write to inform you that Google in alliance with Microsoft and Yahoo has submitted your

"Email" to my request to receive a donation amount of $5,000,000

Please accept this Token as a Gift From me and My Family.

We await your urgent response Via email heleneandbill97@gmail.com

Bill and Helene Lawrence

https://www.powerball.com/winner-story/150-million-powerball-ticket-claimed

Messages like these, which promise large amounts of money, are most likely advance-fee scams. Also known as Nigerian Prince scams, or 419 scams, advance-fee scams promise a large amount of money that can be claimed after paying a comparatively small fee. After a victim pays the fee, the scammer may claim to need another fee, or may vanish. Either way, victims will never receive any money in return.

In addition to the irregular grammar and capitalization, note the From address with a .jp domain, and the time zone, UTC+0900. Both of these indicate that the message originated in Japan, not California. Although the URL provided appears to be legitimate, it does not indicate that the message is really from the Powerball winner. It is always best not to click links in suspicious emails, as they may contain malware, steal personal information, or, as in this case, simply provide misleading information when used in the context of a scam email.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

To read more articles published by DoIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice.

In  the article linked below, the Better Business Bureau is warning of government imposter scams. In these scams, a malicious actor will call or even message the victim claiming to be from a government agency. Their goals are usually to steal the victim’s personal and financial information, to steal the victim’s  money or or to persuade the victim to install malware. 

According to the article, most Americans have encountered this scam before. Research done by the Better Business Bureau found that the Social Security Administration, Service Canada, the Internal Revenue Service (IRS) and the Canada Revenue Agency are among the most impersonated.

Some examples of Social Security-related impersonation scams:

• Increase a benefit: In this scam the malicious actor will claim that the victim is eligible for increased benefits, typically due to a cost of living increase. The malicious actor will request bank account details so that the money can be deposited into the victim’s account. Once the malicious actor has the banking information they are able to steal money from the account.

• Restoring Social Security Number: Some malicious actors will claim the victim's Social Security Number has been suspended. The malicious actor will ask the victim to pay for it to be restored. They may also ask for the victim's Social Security account information, which allows them to apply for benefits under the victims name.

• Social Security Number used in a crime, in this scam the malicious actor will threaten arrest if the victim does not respond immediately.
  
  

When the IRS is used as a cover instead of the Social Security Agency the scams vary, though they have many similarities to the Social Security scams.  For instance,  the malicious actor may claim to be an IRS agent and threaten the victim with arrest for unpaid taxes or even fraud. 

The only way to avoid being arrested, the victim is told,  is by paying a fine (or the unpaid taxes) immediately.  Victims are told to buy gift cards and to provide the caller with the number on the back of each card. But of course these threats are fake, and these are just scammers trying to use fear to get the victims money or information. 

Just as with phishing scams, the malicious actors follow the headlines and change their scams with thet latest news. During the Covid-19 pandemic and after the passage of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, scammers started to claim to be from the CDC or the United States Treasury Department in order to manipulate and steal personal and financial information from victims.

Some examples of Covid-19 related impersonation scams are: 

• Relief benefits: Malicious actors claiming to be from the IRS and offering to expedite benefits under the CARES Act.

• Fake donations: Malicious actors claiming to be from the CDC requesting donations. Email and text messages making these claims may arrive with malware or URLs that could cause harm to the victim's device.

• Contact tracing scams: Email, texts, or messages on social media claiming to be from contact tracers informing the victim that they have come in contact with someone who has tested positive for Covid-19. These scammers seek personal information and/or send messages that may contain malware. For official information on contact tracing efforts in Maryland please visit https://coronavirus.maryland.gov/pages/contact-tracing.

Scammers have also threatened arrest for missing jury duty, impersonated immigration officials threatening to deport the victim, and offered free money in the form of government grants.

Some red flags to watch for to see if the person claiming to be from a government agency is actually a malicious actor:

• The IRS generally first contacts people by the postal mail. Never provide your bank account or other personal information to anyone who calls you.

• Don’t pay by gift cards. The IRS and other government agencies will not idemand or even accept payment using iTunes cards, gift cards, prepaid debit cards, money order, bitcoin or cash.

• The IRS will never request personal or financial information by email, text, or any social media platform. Do not click on any links in unsolicited emails or text messages.

• Social Security numbers are never “suspended”.

• Caller ID cannot be trusted to confirm that the source is from a government agency. Look up the phone number for the agency and call to see if they are really trying to contact you.

• The Social Security Administration will never threaten to arrest you because of an identity theft problem. 

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information, please check out: 

https://www.bbb.org/article/news-releases/22775-government-impostors-study

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19

The article warns that users are being contacted through emails and/or phone calls claiming that they have opened an Amazon Prime account. The malicious actor then will inform the users that the account was opened fraudulently through a security flaw on their computer.

The malicious actor then asks the user for remote access to their computer to fix the breach. Allowing this will let the malicious actor steal personal and financial information, including passwords and even banking information.

Another version of this scam is very similar but claims there is an Amazon-Music subscription instead of an Amazon Prime subscription.

Amazon has stated that that they will never cold-call a customer, and will never ask for remote access to a computer or payment over the phone. Never give any details to an unknown caller, and if you’re not sure if the call is legitimate or not, log into your official Amazon account and contact customer support through there.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information, please check out: 

http://www.irishnews.com/magazine/technology/2020/07/17/news/warning-issued-over-amazon-prime-phishing-scam-2008855/

To read more articles published by DOIT visit: 

https://itsecurity.umbc.edu/critical/?tag=notice. 

Don't have a recovery email on your UMBC account? 

Follow these steps to set up your recovery email. Please use an email address that is not your UMBC email.

1. Login to your myUMBC account: http://my.umbc.edu/account

2. Go to https://webadmin.umbc.edu/admin//Security/Setup/View

3. Click Account security setup

4. At the top of the page, enter your alternate email address

5. Scroll down to the bottom of the page and click Update my security settings

Don’t have a secondary email address?

Create one with Google or Yahoo. Instructions can be found here: 

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867956

If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for displaying the headers (you normally don't see them) so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

234 UMBC accounts suffered from this breach; DOIT is currently notifying these individuals via their UMBC emails and/or alternate emails. However, if you have a Wattpad account don't wait; contact the site to see if your information has been exposed.

If you don’t have a alternate email address listed on your UMBC account, follow these instructions below:

1. Login to your myUMBC account: http://my.umbc.edu/account

2. Go to https://webadmin.umbc.edu/admin//Security/Setup/View

3. Click Account security setup

4. At the top of the page, enter your alternate email address

5. Scroll down to the bottom of the page and click Update my security settings

DOIT has been notified of this breach via Have I Been Pwned(HIBP).

More about Wattpad data breach visit: 

https://www.bleepingcomputer.com/news/security/wattpad-data-breach-exposes-account-info-for-millions-of-users/

https://bestofprivacy.com/data-breaches/wattpad-data-breach-exposes-account-info-for-millions-of-users/#:~:text=Wattpad%20data%20breach%20exposes%20account%20info%20for%20millions,user-generated%20stories%20on%20a%20variety%20of%20different%20topics.

If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________

Receive any suspicious emails?

Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity

UMBC’s Carlos Romero-Talamas is leading a group of researchers in designing and building a machine to produce nuclear fusion energy. The project is one of just 16 new initiatives selected for support through the U.S. Department of Energy’s Advanced Research Projects Agency-Energy program. The researchers will use the $4 million grant to develop and build a centrifugal mirror that can conduct electricity and will generate energy from fusion reactions.

The team’s goal is to use what is essentially a rotating magnetic mirror machine to produce energy from nuclear fusion, explains Romero-Talamas, associate professor of mechanical engineering. “This type of nuclear energy is considered the ‘holy grail’ of energy sources because of its inexpensive and abundant fuel supply,” he says. He adds that fusion energy does not emit greenhouse gases. 

Design and fabrication

The research team includes researchers from both UMBC and the University of Maryland, College Park (UMD). The device they will design and build will fill a large laboratory at UMD’s Energy Research Facility.

Romero-Talamas explains that the power system will consist of hundreds of large, high-voltage capacitors and electromagnets. It will also include active controls to prevent the magnets from overheating. There will also be a separate space for machine controls, because researchers will not be in the equipment room while conducting experimental runs, as a safety precaution.

The research team will design the vacuum chamber and coils, which will be fabricated by experienced suppliers. The vacuum chamber will be approximately the length of two midsize cars. However, it will weigh a lot more than that, Romero-Talamas explains. The entire structure will be more than seven feet tall. 

Solving long-standing questions

Romero-Talamas will collaborate with Adil Hassam, Tim Koeth, Brian Beaoduin, and Ian Abel, all UMD faculty serving as co-PIs. He and the team will also work with undergraduate and graduate students from both universities. 

As the PI, Romero-Talamas will direct the research project, and will play a significant role in the engineering design and construction of the technology. UMD faculty and students will take the lead on equipment safety and certification. 

“Our efforts are aimed at not only solving long-standing physics questions regarding the possibility of confining thermonuclear plasmas with centrifugal mirrors, but to help in the technology transfer to market and make fusion energy a commercial reality,” Romero-Talamas says.

The researchers will measure the density of the particles, specifically how many particles the team is able to make rotate at a high speed inside the vacuum chamber. They will also measure the temperature and speed of the particles. 

Impact in fusion energy field 

Romero-Talamas says that he has been interested in fusion energy since he was a graduate student at Caltech. “Initially, I wanted to work in plasma rocket engines, but when I took a plasma physics class, fusion energy seemed very exciting, important, and urgent to me,” he recalls. “Since then, the study of plasma physics aimed toward helping fusion energy become a reality has been central to my research.” 

In nuclear fusion, energy is released when two nuclei collide at high speeds. Romero-Talamas points out that the act of fusing nuclei is difficult to accomplish. Like magnets, when ions are brought close to one another they begin to repel, which makes the high-speed collision important to overcome the repulsion and make fusion energy a success, he says.

Fusion energy can be generated from water and lithium, and doesn’t require many additional resources. It requires a small amount of material compared to traditional energy extraction methods, like burning fossil fuels, says Romero-Talamas. When a fusion reactor launches particles at each other at a high speed, their collisions can generate temperatures that are nearly 10 times hotter than the center of the sun.

Romero-Talamas and his research team will also work with experts at Virginia Tech and the Princeton Plasma Physics Laboratory on simulations needed for this work. And students will be involved in every step of the research, from design and construction to presenting findings at conferences and in peer-reviewed journal articles. 

This effort, which we call the Centrifugal Mirror Fusion Experiment, is an important step towards the realization of commercial fusion energy, Romero-Talamas explains. “A commercial reactor based on our concept would be relatively compact with respect to other fusion contenders, lowering the cost and time to market,” he says. “While there will be important materials and engineering questions that will need to be addressed before scaling up to a commercial reactor, we will address the most important physics questions that could put us in a path to a demo reactor in years, not decades. We are very excited to be working on a truly transformational technology that will enable a virtually inexhaustible energy source with very small impact to our planet.”

Banner image: Carlos Romero-Talamas. Photo by Marlanya Demond ‘11 for UMBC.