From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by sympa.inria.fr (Postfix) with ESMTPS id 963977F332; Thu, 5 Dec 2019 20:00:19 +0100 (CET) X-IronPort-AV: E=Sophos;i="5.69,282,1571695200"; d="p7s'?scan'208,217";a="417935983" Received: from iguacu.irisa.fr (HELO [131.254.11.179]) ([131.254.11.179]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES128-SHA; 05 Dec 2019 19:59:31 +0100 From: Nicolas Gouble Reply-To: dsi soc Organization: INRIA To: dsi soc Message-ID: Date: Thu, 5 Dec 2019 19:59:27 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.3.0 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms070700090600040203080102" Subject: [Caml-list] =?UTF-8?Q?URGENT_/_IMPORTANT_=3A_Vous_avez_=C3=A9t?= =?UTF-8?Q?=C3=A9_cibl=C3=A9_par_un_phishing_/_You_have_been_targeted_by_p?= =?UTF-8?Q?hishing?= This is a cryptographically signed message in MIME format. --------------ms070700090600040203080102 Content-Type: text/html; charset=utf-8 Content-Language: fr Content-Transfer-Encoding: quoted-printable

[ENGLISH BELOW]

Bonjour,

Le 05/12/2019 un message frauduleux a =C3=A9t=C3=A9 envoy=C3=A9 =C3=A0 = un certain nombre d'utilisateurs Inria.

Ce message, qui avait pour sujet "En attente de notification: Inria partage un fichier avec vous", demandait =C3=A0 ses destinataires de saisir leurs identifiants Inria dans un formulaire en pi=C3=A8ce jointe.

Nous avons d=C3=A9tect=C3=A9 que vous avez pu recevoir ce messag= e.

Merci de nous faire savoir si :
- vous avez ouvert la pi=C3=A8ce jointe
- vous avez saisi vos identifiants Inria dans le formulaire frauduleux

Ne r=C3=A9pondez au pr=C3=A9sent mail que si vous avez effectu=C3=A9= une des deux actions ci-dessus.

Dans le cas o=C3=B9 vous auriez communiqu=C3=A9 vos identifiants Inria,= il faut imp=C3=A9rativement modifier votre mot de passe Inria dans les plus brefs d=C3=A9lais.
Si vous avez ouvert la pi=C3=A8ce jointe et si votre poste de travail e= st sous Windows ou MacOS, nous vous demandons de lancer un scan antivirus sur celui-ci.

Nous vous invitons =C3=A0 signaler =C3=A0 l'adresse cert@inria.fr tout mail vous semblant suspect re=C3=A7u dans votre bo=C3=AEte professionnelle et vous demanda= nt de cliquer sur un lien ou de saisir vos identifiants Inria.

Votre correspondant s=C3=A9curit=C3=A9 SI (CSSI) de centre est =C3=A9ga= lement disponible en cas de doute sur un incident potentiel de s=C3=A9curit=C3= =A9 informatique. La liste des CSSI se trouve ici :
https://intranet.inria.fr/Inria/Directions/D= irection-generale/Securite-Defense/Securite-informatique

Merci par avance de votre retour (seulement si vous =C3=AAtes dans un des deux cas ci-dessus),

Le service DSI-SOC.

____________________________________________________________________= _______________________________________________________________________

Hello,

On 05/12/2019 a fraudulent message was sent to a number of Inria users.

The message, which was about "En attente de notification: Inria partage un fichier avec vous", asked its recipients to enter their Inria credentials in an attached form.

We have detected that you may have received this message.

Please let us know if:
- you have opened the attachment
- you have entered your Inria credentials in the fraudulent form

Reply to this email only if you have performed one of the two actions above.

In the event that you have provided your Inria credentials, it is essential to change your Inria password as soon as possible. If you have opened the attachment and your workstation is running Windows or MacOS, we recommend that you run an antivirus scan on it.

We invite you to report to cert@inria.f= r any suspicious e-mails received in your business mailbox asking you to click on a link or enter your Inria credentials.

Your centre IT security correspondent (CSSI) is also available in case of doubt about a potential IT security incident. The list of CSSI can be found here:
https://intranet.inria.fr/Inria/Directions= /Direction-generale/Securite-Defense/Securite-informatique

Thank you in advance for your return (only if you are in one of the two cases above),

The IT Security Service (DSI-SOC).

____________________________________________________________________= ____________________________________

Le mail frauduleux / The fraudulent email :

From: Inria <xxxx@i= nria.fr> Sent: Thursday, December 5, 2019 4:42 PM Subject: En attente de notification: Inria partage un fichier avec vous =C2=A0 ATTENTION Votre document a =C3=A9t=C3=A9 mis en attente. Veuillez t=C3=A9l=C3=A9charger et vous connecter pour lib=C3=A9rer = vos documents

Pi=C3=A8ce jointe / Attachment :Login - CAS =E2=80=93 Central Authentication Service.htm

____________________________________________________________________= ________________________________________

--=20
Nicolas Gouble
DSI-SOC
Centre de recherche INRIA Rennes - Bretagne Atlantique / Irisa
Campus universitaire de Beaulieu, 35042 Rennes cedex, France
T=C3=A9l. : +33 2 99 84 73 65

--------------ms070700090600040203080102 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: Signature cryptographique S/MIME MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG 9w0BBwEAAKCCClwwggUAMIID6KADAgECAhADS+4XH7fhBjcv1HJCQL0qMA0G CSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0Rp Z2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xNDExMTgxMjAwMDBaFw0y NDExMTgxMjAwMDBaMGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1I b2xsYW5kMRIwEAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEd MBsGA1UEAxMUVEVSRU5BIFBlcnNvbmFsIENBIDMwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDGpbsfVYL0pTRyFHJlm1/V6qBo2JuCiU9TYpx7 jM4O2tQyDq8bjMum69vg6wM0lMGHflMgqB75GxeKfQFmEldoXi2cLishqFUv U2cJeM3SaRsLk2BsuCgTzh9NsYgmrUX60KHOq7eYKVZxbPFWJF2nMOBuMXNu 2qBXTGSLeLXHnNvG3r7TLzGg1oA5teAxQE6Eo8ySSeIXbP7wZB76urwlh51P IbrJZjkDjdQVELh7OlTP1WO6T/Hf6BsEfeFcpoa1e+MW/lw0VetTPPHQ15HY KYP2WYohHxzDiC+QUwE7UZVBlp9cXIpwHuDzSibc5RG3z0n/j2SQCx0Dk5FM AUErAgMBAAGjggGmMIIBojASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB /wQEAwIBhjB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9v Y3NwLmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMu ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNydDCBgQYD VR0fBHoweDA6oDigNoY0aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lD ZXJ0QXNzdXJlZElEUm9vdENBLmNybDA6oDigNoY0aHR0cDovL2NybDQuZGln aWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNybDA9BgNVHSAE NjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNl cnQuY29tL0NQUzAdBgNVHQ4EFgQU8CHpSXdzn4WuGDvoUnAUBu1C7sowHwYD VR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcNAQELBQAD ggEBADrCGyv+Y967YbS5R6j8fAWxJiAiUZvIPfn1xVgesF6jspwCQY8xGn/M G04d+Jh97I8I/Xfx29JEEFq2rQmw4PxiO9RiDZ7xoDxNd4rrRDR7jrtOKQP8 J+o+ah0vSOP62hnD/zPS7NRMtIyVS2G277KAL5fIR62ngr984fmJghDv0bsj GAmeu3EP0xhUsDJT61IoAGoKBnxBPAeg3WXsdSm4Gn7btyvakeyFtYebr2Km OBSa28PRqGSDur56aZhJoM2eMzc6prmvGwwtAzRsc5t2OsKRuHWV6O3anP2K 27jGZR2bi1VX1NQUvIbpVNTuwjm+XcZtsa/AAJF9KGkEseAwggVUMIIEPKAD AgECAhABml08iMKjIX/P9w7CjHpdMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV BAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1Ib2xsYW5kMRIwEAYDVQQHEwlBbXN0 ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEdMBsGA1UEAxMUVEVSRU5BIFBlcnNv bmFsIENBIDMwHhcNMTkwNzA4MDAwMDAwWhcNMjIwNzA4MTIwMDAwWjCBiDEL MAkGA1UEBhMCRlIxFTATBgNVBAcTDFJvY3F1ZW5jb3VydDFJMEcGA1UEChNA SW5zdGl0dXQgTmF0aW9uYWwgZGUgUmVjaGVyY2hlIGVuIEluZm9ybWF0aXF1 ZSBldCBlbiBBdXRvbWF0aXF1ZTEXMBUGA1UEAxMOTmljb2xhcyBHT1VCTEUw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9oakL6sELjrifi0QA UWRE8uV2MgB4CLtp2VO9oI9+R66ADvm8sjpTYSVGg5UMoHhuntz9OwzzPYn+ q4I0vAV+TlaqmNWd7RSt5o8HEyCgt5I8XVWBZn+1GaAsGaPLvdoy80hR35IN uDWbik1FjE4lU/daEaZYkRiq9TYzr6+IeQLF5NJdIXBgEAVwa/U2IB2Jk6X4 atFSenKwU4PjS+7qgcFncZi81Qpy8kWMAld0phwvVGNIMvTWs0G0DoUAJ6aa n/FUMMf34SJWVMsJuRuICJOxGH7TDAYtB8gZjPS81tneWsYpPv77t0uOiUEp pqrAImul8p2repmxeHewSlv9AgMBAAGjggHWMIIB0jAfBgNVHSMEGDAWgBTw IelJd3Ofha4YO+hScBQG7ULuyjAdBgNVHQ4EFgQUPmOrX1Y53jO9NmPIVbhS 5i8X62cwDAYDVR0TAQH/BAIwADAiBgNVHREEGzAZgRduaWNvbGFzLmdvdWJs ZUBpbnJpYS5mcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9bAQBAjAqMCgGCCsG AQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHUGA1UdHwRu MGwwNKAyoDCGLmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9URVJFTkFQZXJz b25hbENBMy5jcmwwNKAyoDCGLmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9U RVJFTkFQZXJzb25hbENBMy5jcmwwcwYIKwYBBQUHAQEEZzBlMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wPQYIKwYBBQUHMAKGMWh0 dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9URVJFTkFQZXJzb25hbENBMy5j cnQwDQYJKoZIhvcNAQELBQADggEBAGxiMplfQ78n6FBbCBh2uzNYHDGROQEm w+JZ7Jo0SqZLlfrbSk0gLWFbIfq9wxDEd0mYaUhGp1501PoHXd18kANizYar lRn2HcEiNGm+pqJTAbWzx52SVAIlCNMETfCfpsrefaMjOp67NAP9VehZiNSv kyokWRGzp7ylfsXknolKKF0ULnYhp2SFrikRuNXqladSxiTd3B8W4nXdkVFY hMZ92iOumpZygJvjD0Se80uofQlDYDc9MbygrUR6RHzxfKezVXRXgmky7P7f 6ZY7HvTPlUCLLF2jodWXIaQxaoHO3JWJbLrXMQMlMxVOrr4L/X9z4It9LLC2 QJOmCP1J5jsxggOjMIIDnwIBATB9MGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQI Ew1Ob29yZC1Ib2xsYW5kMRIwEAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoT BlRFUkVOQTEdMBsGA1UEAxMUVEVSRU5BIFBlcnNvbmFsIENBIDMCEAGaXTyI wqMhf8/3DsKMel0wDQYJYIZIAWUDBAIBBQCgggH3MBgGCSqGSIb3DQEJAzEL BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTIwNTE4NTkyOFowLwYJ KoZIhvcNAQkEMSIEIGnlQnVUUdWlHRVUuc8wt5SUJAnMi7iJtW80PeaNiikE MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAK BggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYF Kw4DAgcwDQYIKoZIhvcNAwICASgwgYwGCSsGAQQBgjcQBDF/MH0waTELMAkG A1UEBhMCTkwxFjAUBgNVBAgTDU5vb3JkLUhvbGxhbmQxEjAQBgNVBAcTCUFt c3RlcmRhbTEPMA0GA1UEChMGVEVSRU5BMR0wGwYDVQQDExRURVJFTkEgUGVy c29uYWwgQ0EgMwIQAZpdPIjCoyF/z/cOwox6XTCBjgYLKoZIhvcNAQkQAgsx f6B9MGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1Ib2xsYW5kMRIw EAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEdMBsGA1UEAxMU VEVSRU5BIFBlcnNvbmFsIENBIDMCEAGaXTyIwqMhf8/3DsKMel0wDQYJKoZI hvcNAQEBBQAEggEAEP849ieTmM/9/qfUBQbMyEMMnq4NrQQhp4fMnEbxWRJb +LJyyESyrs2mmQUHMGEvR5olGxoSOjyzyZaYl9a1wE1u5SXpkC0KSTDZ31mS wxuTCfeVe9ceIFySFFhy6XLf02JUgPGywAjEd01WCVeMQ0r1EhhkD+SY3cl9 6ZYdu+n5NV6ZxfN21PwaBsU2sF7GDuYhHlVaOMkTUKuOG4AxD6mhypbkDKks 7dUiiq6EXD2d5AaJ/RkWldy5IVseLVERFEgqXDUo6LCMUNemOt9G5WJeRpOJ 7leSVoHIosAWZIOhCoWrcSRVZ8DyzPYURiuTFWLeQ5F8oGWtDUVVyCVuJAAA AAAAAA== --------------ms070700090600040203080102--