Tax time brings IRS scam email messages. A variety of scams are circulating in email right now purporting to be important messages from the IRS. Be very suspicious of any incoming email message that claims to be from the IRS, particularly if it includes an attached document. One current example is a message claiming to provide information about a tax refund, in the form of an attached Word document. Very few antivirus programs are detecting this malicious document at present; however, be aware that the IRS does not communicate refund information in the form of emailed attachments. If you are expecting a refund and wish to check its status, visit the IRS Refund information website instead: http://www.irs.gov/Refunds
Many campus users are receiving email claiming to come from an IT support group (sometimes even IMSS or the Help Desk), asking for the user's password and other private information, or requesting that you "verify your account" by logging into a website. Please be aware that this is a form of security attack known as "phishing" designed to fool users into giving their usernames and passwords to an attacker. Please do not reply to these messages or visit any websites they may refer to. IMSS does not recommend providing usernames and passwords by email, and IMSS will never ask users for their passwords by email or by phone under any circumstances. When visiting a website, be sure to check the address bar on your browser to confirm that the site you're visiting is the one you were expecting. If you receive any confusing or worrisome email messages about any of your Caltech accounts, we strongly recommend contacting the IMSS Help Desk (626.395.3500 or https://help.caltech.edu) or your local system administrator. In the event that your password is exposed to an attacker, please be sure never to use that password again, for any purpose, and particularly never for the account it once belonged to.
Java users may have recently auto-updated or received prompts to update from Java 7 to Java 8. Though Java 8 is currently the default version on http://java.com, Caltech users may want to reconsider updating to Java 8 due to compatibility issues with some applications. If the Caltech administrative applications are an integral part of your workflow, IMSS does not recommend updating at this time until we can address these compatibility issues. If you have already updated and need to revert back to Java 7, you may still download Java 7 from the Java Archive.
Effective February 9, 2015, the IMSS-run proxy server which registers campus Red Hat systems to receive updates will be retired and transitioned to a new Satellite server. In order to continue to receive RHEL updates, you will need to download a new script to register your systems to receive updates.
Instructions on how to obtain this new script can be found on the Caltech software webstore. If you previously ordered RHEL from the software webstore, you can find these updated instructions in your software order details:
- Go to http://software.caltech.edu and click on Log In
- Enter your access.caltech credentials
- Click on Your Account/Orders at the top of the page
- Find your previous RHEL order and click View Details
- Click on the link Instructions for obtaining Red Hat updates
- Otherwise, simply place a new order for RHEL to obtain these instructions.
Also note that effective 2/9, toughguy.caltech.edu, a former RHEL resource, will be retired.
If you have any questions about this, please contact us at https://help.caltech.edu, request type IMSS > Software Licensing & Distribution > Other.
Effective 12/12/2014, IMSS retired the long-running Matlab triad license servers. If you are using a network installation of Matlab, please update your license file. This will ensure that your Matlab network installation accesses the new replacement license server. For instructions on how to obtain and update this license file, click here.
NOTE: Standalone installations do not need license files updated since they do not require network access to run. However, if your standalone installation displays a notice that the license has expired, you will need to renew your license for another year. To renew your license, please follow the instructions located at http://imss.caltech.edu/software/matlab-license-renewal-instructions.
A security problem with Bash was publicly disclosed on Wednesday, 9/24. Bash is a very popular operating system component known as a "shell" that comes with all versions of Linux and Mac OSX, as well as other systems. While this vulnerability has been present for many years, it was only discovered recently. As soon as IMSS became aware of the problem on 9/24, core IMSS systems were immediately patched. Less critical systems were patched or mitigated by the following day 9/25. As updates become available, IMSS strongly urges you to apply security updates to any computers you personally run.
For older versions of OSX where official patches aren't available, here are some instructions for patching bash: http://www.macissues.com/2014/09/25/how-to-unofficially-fix-the-shell-sh...
US CERT advisory:
Plain-English explanation of the nature of the vulnerability, in a 4-minute video:
Caltech has a mailing list for announcing computer security issues to campus system administrators and other interested parties:
Microsoft's recent Windows updates include an update to Internet Explorer that blocks older versions of Java. If you encounter issues using Java-dependent applications after applying this Microsoft update, please update your version of Java. Instructions on how to download and install Java can be found at http://www.java.com/en/download/.
Additionally, IMSS recommends downloading and installing a custom Java configuration file on your computer. Installing this configuration file will further assist with security and compatibility with IMSS applications and it will prevent persistent, yet harmless, security warnings from appearing when using specific IMSS applications. Instructions for downloading and installing this file can be found at http://imss.caltech.edu/help/java-config-file.
IMSS would also like to remind you that you can avoid any potential Java issues with Kronos by using Kronos Limited instead, which does not require Java to run. To use Kronos Limited, go to http://kronoslimited.caltech.edu.
Lastly, note that IMSS Managed Computing customers do not need to take any action. IMSS will update Java and will install the custom configuration file for managed computers during our maintenance window on 8/21/14.
For questions or further advice, please contact the Help Desk (x3500, https://help.caltech.edu.)
Caltech's RedHat certificate has expired. To resolve this, RedHat users should run the following command to get the updated SSL certificate:
curl -o /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT http://rhupdate.caltech.edu/pub/RHN-ORG-TRUSTED-SSL-CERT
Some campus customers are receiving calls from people claiming to be from Microsoft regarding a supposed computer problem. The callers offer to fix the problem and request remote access to the customer's computer. This is a very common scam with typical goals of installing malicious software on the victim's computer, or obtaining the victim's credit card number (to pay for the unsolicited, but fake "tech support"). Microsoft will never call you like this. More information about this type of scam can be found here: http://www.microsoft.com/security/online-privacy/avoid-phone-scams.aspx If in doubt, always feel free to contact the IMSS Help Desk for questions and advice.