Phishing Scam Alert: OneClass Chrome Extension

Phishing Scam Alert: OneClass Chrome Extension

Be on alert for the OneClass Chrome Extension.  It is a phishing scam where once the extension is installed, it will attempt to send an email on behalf of the user and collect Campus-Wide Login (CWL) credentials.

 

  • Please note that this critical update is provided for the benefit of UBC students who have installed the
    OneClass Chrome Extension on their computer(s).
  • UBC has no affiliation with OneClass nor does it allow the use of this software under Policy #104 –
    Acceptable Use and Security of UBC Electronic Information and Systems.
  • UBC IT has determined that the OneClass Chrome Extension is malware and that there is significant risk to student’s private information if they have installed this unauthorized software.
  • UBC IT has determined that the OneClass Chrome Extension has code that will collect the student’s login credentials to any website visited while using Chrome, and send this information to offsite servers for malicious intent. These credentials include CWL username and password, as well as any other logins and passwords for external organizations that were entered while using Chrome (such as banks, health agencies, etc.). There is significant risk for identity theft if the OneClass Chrome Extension is not immediately uninstalled followed by the student changing all of their affected passwords.

 

A brief history:

  • On November 24, 2016, students in several courses received an email, sent via Connect, encouraging them to sign up for OneClass.
  • When a thread was posted on the UBC Reddit channel, it became apparent that the email was sent to a number of courses during the afternoon. The UBC IT Learning Applications team was made aware of the thread and began to investigate.
  • Thanks to the UBC students who brought this to our attention, we were able to mitigate this problem quickly and shut down the ability for these kinds of emails to be sent from within Connect.
  • Our investigation showed that the first emails were sent at 12:58 pm. We received the full email header information when a student submitted a ticket to the IT Service Centre at 3:50 pm and had blocked the OneClass spam messages by 4:30 pm. By 5:30 pm, a fix was in place.
  • UBC IT is working with Blackboard, the developers of Connect, to ensure the system is patched to prevent this kind of activity in the future.

 

Recent Developments relating to significant security risks in OneClass Chrome Extension:

  • Beginning the week of December 12, 2016, UBC IT began to notice suspicious activity related to accounts previously identified as having been involved in the earlier email spamming incidents.
  • It was determined that the OneClass Chrome Extenstion that students installed in order to send out the spam email was, in fact, dangerous phishing malware with the ability to collect student’s login names and passwords. This includes Campus-Wide Login credentials along with any credentials entered using Chrome on other webpages (banks, health institutions, etc.).
  • UBC IT detected inappropriate use of some student accounts by external bad actors and immediately began the process to stop this access and secure the student accounts. Affected students were notified as a priority.
  • The immediate advice of UBC IT is that it is essential for any student who has installed the OneClass Chrome Extension to delete this extension immediately and then reset their CWL password along with any other passwords they entered on other websites while using Chrome.

 

How the phishing works:

  • Students will receive an email that includes a link to install the OneClass Chrome Extension.  During the installation, the user will be prompted to accept its permission of “Read and change all your data on the websites you visit.” If the user accepts, a button will be created within Connect pages to “Invite your Classmates to OneClass.”
  • The plugin in the extension will also attempt to send an email to everyone in the user’s class to promote the OneClass plugin. The plugin contains a code that will attempt to collect user credentials (CWL username and password).
  • A copy of the phishing email is below:
    “Hey guys, I just found some really helpful notes for the upcoming exams for <University Name> courses at <URL removed by UBC Information Security>.  I highly recommend signing up for an account now that way your first download is free!”If you receive this phishing email, do not install the extension or click on any links on the email.  Please delete the email.If you already installed the extension, below are the instructions to remove the extension:

    1. Open up your Chrome Browser
    2. Select the 3 vertical dots in the top right-hand corner
    3. Select Settings
    4. Select Extensions in the top left-hand corner
    5. Click the Trashcan beside the “OneClass Easy Invite” extension
    6. Select Remove on the Confirm Removal Popup
    7. Close all Chrome windows and go back to the Extensions page to verify the extension has been removed (Steps 1-4)

Once you have removed this extension, please go to myaccount.ubc.ca to reset your CWL password in addition to resetting passwords for any other sites that you visited while using Chrome with the OneClass Extension installed.

 

If you have any questions, please contact the IT Service Desk at 604.822.2008 or email security@ubc.ca