Explore insights and strategies for CTOs and CIOs in education. Discover tools and resources to support technology leadership and innovation.
Have you received a strange email sent to someone with numerous letter h’s in their name? If so, even though you may know the person who has invited you to view the document (and their photo may be displayed), you are seeing a phishing attack. Stop and take a moment before you proceed.
What’s a Phishing Attack?
Phishing is “…the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication” (Wikipedia). That means, even though you see the face of someone you know in the email sharing a Google Doc with you, two things are still possible: 1) Their email has been compromised and 2) They didn’t send you that phishing attack. You can find more information and some helpful infographics about phishing attacks in this blog post by Pixel Privacy. In an earlier blog entry, It’s Not the Phishing, It’s Your Lack of Influence, I pointed out that education is all important when dealing with clever attacks like this. Let’s break down what’s happening.
Scott Laleman (Director of Technology, South San ISD) shares the following:
We’ve blocked mailinator.com in our firewall, filter, and management console, but the messages look like they’re coming from in-house and are “to” an address at mailinator.com (the address with the hhhhhhh in it) with bcc to each person or group, but blocking any messages to or from that domain seems to have stopped them from coming in at this point.
How Do I Avoid the Trap?
But before we do that, let’s ensure you know what your options are in this type of situation:
- When you see a suspicious email asking you to enter your login credentials, you have several options. With Google Docs, simply go to http://drive.google.com and check the Shared With Me section. This will let you know if a document was actually shared with you.
- Open a fresh Compose message and send it to the person who allegedly sent you the message, or call them, tweet them, or Slack them. Ask the question, “Did you share a Google Doc with me?” If the answer is “No,” then delete the document.
- Scrutinize the From: and To: to verify they are authentic.
- If you must click, copy the link to OPEN DOC and create an incognito or private browser window. That way, your login credentials stored in cookies in your browser will not auto-populate or show up in the username/login box. I keep a Firefox browser around for exactly this purpose.
As you will see, each of these steps would have foiled the phishing attack many fell prey to earlier today.
What’s Happening?
At approximately 1:57 pm Central time, users (Update 5/5/17: Google reported, as cited by Threatpost, 1 million user accounts affected) began receiving emails purporting to share a Google document:
If they clicked on the button shown above, the user was taken to a site that looks like this:
If they entered their email, they would see a screen that pulls in their name and email, then asks for their permission. This is unnecessary for Google Docs, and would normally be a red flag (but most users are unaware that it is).
Image Credit: Robert Stubbs, Lockhart ISD
If you were one of the many users snared by this phishing scheme, make sure you follow the steps below to remedy it.
How to Mitigate the Phishing Attack?
If you have fallen for this particular attack, you will need to take the following action:
Go to Apps Connected To Your Account and REMOVE access, as shown in the image below:
Image Credit: Bryce Anderson
Unfortunately, two-factor verification would not have prevented nefarious hackers from accessing your account if you had granted permission. This particular attack has little to do with how you login, and more with how third party apps connect to your Google account.
For a more detailed step by step, check the Reddit Google Forum.
Update 05/05/2017: For school technology administrators, Amplified IT has offered a solution that takes advantage of GAM. “GAM is a command line tool that allows administrators to manage many aspects of their Google Apps Account,” states the GAM Wiki. You can access Amplified IT’s solution online. This solution can only be implemented by your technology administrator and is not intended to be an individual user solution.
What’s Next?
If you haven’t enabled two-factor authentication for your Google Suites for Education domain or begun to educate your staff on how to avoid phishing attacks, then those are your next steps as school district leaders. If you need professional learning on how to accomplish this, don’t hesitate to contact TCEA for assistance.
Taking on new skills and the learning curve that goes along with it may be a frightening and/or frustrating task for your staff members. When possible, always try to set them up for success. They may not know how to break the skill down into manageable pieces, for example, so you may need to help model that aloud. Depending on the skill, you may also need to provide additional resources or training to help them become confident and successful. Put yourself in their position and consider what might be helpful in order to stretch…without breaking.
Talk to your staff about the additional tasks and the need to grow and take on new skills. Having an open discussion can alleviate some of the fear that comes from encountering something new, different, or unknown. When possible, ask questions to find out what they think. They may have a completely different understanding based on their past experiences (or lack thereof). Open dialogue should not be constrained to a single staff meeting however; encourage the conversation to continue. Let your staff know that you want to hear their ideas. Though you may have no control over the growth that needs to take place, you do have a great deal of influence on how well they develop capacity to meet that need.
When talking with a friend about building capacity in his team, he mentioned that he has a few people that can juggle six or seven major things, and he has one person that can only juggle four. No matter how much he wants the four-task-juggler to grow into a five-task-juggler, he realizes that it just isn’t going to happen. And the best thing he can do is recognize it and use it to both his and his staff member’s advantage. In doing so, he needs to set realistic expectations for each individual staff member. Just because you and I find certain tasks easy to juggle doesn’t mean that a another staff member will obtain the skill with ease. If we think back over our experiences, we probably had much more time (and resources) to build capacity in that area. With that in mind, consider how you can adjust expectations, but still arrive at the required destination.
outside of school time to be successful in school. The survey also revealed that 75 percent of Texas 6th through 12th graders use the internet at home for school work. Those who do not have internet access at home are at a distinct disadvantage. Not only do they have fewer options in terms of access to content; they are unable to develop the technical skills necessary in an economy driven by technology. 
