From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by c5ff346549e7 (Postfix) with ESMTPS id E624B5D5 for ; Thu, 5 Dec 2019 19:00:27 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.69,282,1571695200"; d="p7s'?scan'208,217";a="417936214" Received: from sympa.inria.fr ([193.51.193.213]) by mail2-relais-roc.national.inria.fr with ESMTP; 05 Dec 2019 20:00:26 +0100 Received: by sympa.inria.fr (Postfix, from userid 20132) id 1271B7F332; Thu, 5 Dec 2019 20:00:26 +0100 (CET) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by sympa.inria.fr (Postfix) with ESMTPS id 963977F332; Thu, 5 Dec 2019 20:00:19 +0100 (CET) X-IronPort-AV: E=Sophos;i="5.69,282,1571695200"; d="p7s'?scan'208,217";a="417935983" Received: from iguacu.irisa.fr (HELO [131.254.11.179]) ([131.254.11.179]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES128-SHA; 05 Dec 2019 19:59:31 +0100 From: Nicolas Gouble Reply-To: dsi soc Organization: INRIA To: dsi soc Message-ID: Date: Thu, 5 Dec 2019 19:59:27 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.3.0 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms070700090600040203080102" Subject: [Caml-list] =?UTF-8?Q?URGENT_/_IMPORTANT_=3A_Vous_avez_=C3=A9t?= =?UTF-8?Q?=C3=A9_cibl=C3=A9_par_un_phishing_/_You_have_been_targeted_by_p?= =?UTF-8?Q?hishing?= X-Loop: caml-list@inria.fr X-Sequence: 17898 Errors-to: caml-list-owner@inria.fr Precedence: list Precedence: bulk Sender: caml-list-request@inria.fr X-no-archive: yes List-Id: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is a cryptographically signed message in MIME format. --------------ms070700090600040203080102 Content-Type: text/html; charset=utf-8 Content-Language: fr Content-Transfer-Encoding: quoted-printable

[ENGLISH BELOW]

Bonjour,

Le 05/12/2019 un message frauduleux a =C3=A9t=C3=A9 envoy=C3=A9 =C3=A0= un certain nombre d'utilisateurs Inria.

Ce message, qui avait pour sujet "En attente de notification: Inria partage un fichier avec vous", demandait =C3=A0 ses destinataires de saisir leurs identifiants Inria dans un formulaire en pi=C3=A8ce jointe.

Nous avons d=C3=A9tect=C3=A9 que vous avez pu recevoir ce mess= age.

Merci de nous faire savoir si :
- vous avez ouvert la pi=C3=A8ce jointe
- vous avez saisi vos identifiants Inria dans le formulaire frauduleux

Ne r=C3=A9pondez au pr=C3=A9sent mail que si vous avez effectu=C3=A9= une des deux actions ci-dessus.

Dans le cas o=C3=B9 vous auriez communiqu=C3=A9 vos identifiants Inri= a, il faut imp=C3=A9rativement modifier votre mot de passe Inria dans les= plus brefs d=C3=A9lais.
Si vous avez ouvert la pi=C3=A8ce jointe et si votre poste de travail= est sous Windows ou MacOS, nous vous demandons de lancer un scan antivirus sur celui-ci.

Nous vous invitons =C3=A0 signaler =C3=A0 l'adresse cert@inria.fr tout mail vous semblant suspect re=C3=A7u dans votre bo=C3=AEte professionnelle et vous deman= dant de cliquer sur un lien ou de saisir vos identifiants Inria.

Votre correspondant s=C3=A9curit=C3=A9 SI (CSSI) de centre est =C3=A9= galement disponible en cas de doute sur un incident potentiel de s=C3=A9curit=C3= =A9 informatique. La liste des CSSI se trouve ici :
https://intranet.inria.fr/Inria/Directions= /Direction-generale/Securite-Defense/Securite-informatique


Merci par avance de votre retour (seulement si vous =C3=AAtes dans= un des deux cas ci-dessus),

Le service DSI-SOC.

__________________________________________________________________= _________________________________________________________________________=

Hello,

On 05/12/2019 a fraudulent message was sent to a number of Inria users.

The message, which was about "En attente de notification: Inria partage un fichier avec vous", asked its recipients to enter their Inria credentials in an attached form.

We have detected that you may have received this message.
Please let us know if:
- you have opened the attachment
- you have entered your Inria credentials in the fraudulent form
Reply to this email only if you have performed one of the two actions above.

In the event that you have provided your Inria credentials, it is essential to change your Inria password as soon as possible.=
If you have opened the attachment and your workstation is running Windows or MacOS, we recommend that you run an antivirus scan on it.

We invite you to report to cert@inria= =2Efr any suspicious e-mails received in your business mailbox asking you to click on a link or enter your Inria credentials.

Your centre IT security correspondent (CSSI) is also available in case of doubt about a potential IT security incident. The list of CSSI can be found here:
https://intranet.inria.fr/Inria/Directio= ns/Direction-generale/Securite-Defense/Securite-informatique

Thank you in advance for your return (only if you are in one of the two cases above),


The IT Security Service (DSI-SOC).

__________________________________________________________________= ______________________________________

Le mail frauduleux / The fraudulent email :

From: Inria <xxxx= @inria.fr>
Sent: Thursday, December 5, 2019 4:42 PM
Subject: En attente de notification: Inria partage un fichier avec vous

=C2=A0

ATTENTION
Votre document a =C3=A9t=C3=A9 mis en attente.
Veuillez t=C3=A9l=C3=A9charger et vous connecter pour lib=C3=A9re= r vos documents

Pi=C3=A8ce jointe / Attachment : Login - CAS =E2=80=93 Central= Authentication Service.htm

__________________________________________________________________= __________________________________________


--=20
Nicolas Gouble
DSI-SOC
Centre de recherche INRIA Rennes - Bretagne Atlantique / Irisa
Campus universitaire de Beaulieu, 35042 Rennes cedex, France
T=C3=A9l. : +33 2 99 84 73 65
--------------ms070700090600040203080102 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: Signature cryptographique S/MIME MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC ClwwggUAMIID6KADAgECAhADS+4XH7fhBjcv1HJCQL0qMA0GCSqGSIb3DQEBCwUAMGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xNDExMTgx MjAwMDBaFw0yNDExMTgxMjAwMDBaMGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1I b2xsYW5kMRIwEAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEdMBsGA1UEAxMU VEVSRU5BIFBlcnNvbmFsIENBIDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDG pbsfVYL0pTRyFHJlm1/V6qBo2JuCiU9TYpx7jM4O2tQyDq8bjMum69vg6wM0lMGHflMgqB75 GxeKfQFmEldoXi2cLishqFUvU2cJeM3SaRsLk2BsuCgTzh9NsYgmrUX60KHOq7eYKVZxbPFW JF2nMOBuMXNu2qBXTGSLeLXHnNvG3r7TLzGg1oA5teAxQE6Eo8ySSeIXbP7wZB76urwlh51P IbrJZjkDjdQVELh7OlTP1WO6T/Hf6BsEfeFcpoa1e+MW/lw0VetTPPHQ15HYKYP2WYohHxzD iC+QUwE7UZVBlp9cXIpwHuDzSibc5RG3z0n/j2SQCx0Dk5FMAUErAgMBAAGjggGmMIIBojAS BgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjB5BggrBgEFBQcBAQRtMGswJAYI KwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDov L2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNydDCBgQYD VR0fBHoweDA6oDigNoY0aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEUm9vdENBLmNybDA6oDigNoY0aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0 QXNzdXJlZElEUm9vdENBLmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYc aHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAdBgNVHQ4EFgQU8CHpSXdzn4WuGDvoUnAU Bu1C7sowHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcNAQELBQAD ggEBADrCGyv+Y967YbS5R6j8fAWxJiAiUZvIPfn1xVgesF6jspwCQY8xGn/MG04d+Jh97I8I /Xfx29JEEFq2rQmw4PxiO9RiDZ7xoDxNd4rrRDR7jrtOKQP8J+o+ah0vSOP62hnD/zPS7NRM tIyVS2G277KAL5fIR62ngr984fmJghDv0bsjGAmeu3EP0xhUsDJT61IoAGoKBnxBPAeg3WXs dSm4Gn7btyvakeyFtYebr2KmOBSa28PRqGSDur56aZhJoM2eMzc6prmvGwwtAzRsc5t2OsKR uHWV6O3anP2K27jGZR2bi1VX1NQUvIbpVNTuwjm+XcZtsa/AAJF9KGkEseAwggVUMIIEPKAD AgECAhABml08iMKjIX/P9w7CjHpdMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNVBAYTAk5MMRYw FAYDVQQIEw1Ob29yZC1Ib2xsYW5kMRIwEAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoTBlRF UkVOQTEdMBsGA1UEAxMUVEVSRU5BIFBlcnNvbmFsIENBIDMwHhcNMTkwNzA4MDAwMDAwWhcN MjIwNzA4MTIwMDAwWjCBiDELMAkGA1UEBhMCRlIxFTATBgNVBAcTDFJvY3F1ZW5jb3VydDFJ MEcGA1UEChNASW5zdGl0dXQgTmF0aW9uYWwgZGUgUmVjaGVyY2hlIGVuIEluZm9ybWF0aXF1 ZSBldCBlbiBBdXRvbWF0aXF1ZTEXMBUGA1UEAxMOTmljb2xhcyBHT1VCTEUwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9oakL6sELjrifi0QAUWRE8uV2MgB4CLtp2VO9oI9+ R66ADvm8sjpTYSVGg5UMoHhuntz9OwzzPYn+q4I0vAV+TlaqmNWd7RSt5o8HEyCgt5I8XVWB Zn+1GaAsGaPLvdoy80hR35INuDWbik1FjE4lU/daEaZYkRiq9TYzr6+IeQLF5NJdIXBgEAVw a/U2IB2Jk6X4atFSenKwU4PjS+7qgcFncZi81Qpy8kWMAld0phwvVGNIMvTWs0G0DoUAJ6aa n/FUMMf34SJWVMsJuRuICJOxGH7TDAYtB8gZjPS81tneWsYpPv77t0uOiUEppqrAImul8p2r epmxeHewSlv9AgMBAAGjggHWMIIB0jAfBgNVHSMEGDAWgBTwIelJd3Ofha4YO+hScBQG7ULu yjAdBgNVHQ4EFgQUPmOrX1Y53jO9NmPIVbhS5i8X62cwDAYDVR0TAQH/BAIwADAiBgNVHREE GzAZgRduaWNvbGFzLmdvdWJsZUBpbnJpYS5mcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYw FAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9bAQBAjAqMCgGCCsG AQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHUGA1UdHwRuMGwwNKAyoDCG Lmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9URVJFTkFQZXJzb25hbENBMy5jcmwwNKAyoDCG Lmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9URVJFTkFQZXJzb25hbENBMy5jcmwwcwYIKwYB BQUHAQEEZzBlMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wPQYIKwYB BQUHMAKGMWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9URVJFTkFQZXJzb25hbENBMy5j cnQwDQYJKoZIhvcNAQELBQADggEBAGxiMplfQ78n6FBbCBh2uzNYHDGROQEmw+JZ7Jo0SqZL lfrbSk0gLWFbIfq9wxDEd0mYaUhGp1501PoHXd18kANizYarlRn2HcEiNGm+pqJTAbWzx52S VAIlCNMETfCfpsrefaMjOp67NAP9VehZiNSvkyokWRGzp7ylfsXknolKKF0ULnYhp2SFrikR uNXqladSxiTd3B8W4nXdkVFYhMZ92iOumpZygJvjD0Se80uofQlDYDc9MbygrUR6RHzxfKez VXRXgmky7P7f6ZY7HvTPlUCLLF2jodWXIaQxaoHO3JWJbLrXMQMlMxVOrr4L/X9z4It9LLC2 QJOmCP1J5jsxggOjMIIDnwIBATB9MGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1I b2xsYW5kMRIwEAYDVQQHEwlBbXN0ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEdMBsGA1UEAxMU VEVSRU5BIFBlcnNvbmFsIENBIDMCEAGaXTyIwqMhf8/3DsKMel0wDQYJYIZIAWUDBAIBBQCg ggH3MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE5MTIwNTE4 NTkyOFowLwYJKoZIhvcNAQkEMSIEIGnlQnVUUdWlHRVUuc8wt5SUJAnMi7iJtW80PeaNiikE MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC ASgwgYwGCSsGAQQBgjcQBDF/MH0waTELMAkGA1UEBhMCTkwxFjAUBgNVBAgTDU5vb3JkLUhv bGxhbmQxEjAQBgNVBAcTCUFtc3RlcmRhbTEPMA0GA1UEChMGVEVSRU5BMR0wGwYDVQQDExRU RVJFTkEgUGVyc29uYWwgQ0EgMwIQAZpdPIjCoyF/z/cOwox6XTCBjgYLKoZIhvcNAQkQAgsx f6B9MGkxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZC1Ib2xsYW5kMRIwEAYDVQQHEwlB bXN0ZXJkYW0xDzANBgNVBAoTBlRFUkVOQTEdMBsGA1UEAxMUVEVSRU5BIFBlcnNvbmFsIENB IDMCEAGaXTyIwqMhf8/3DsKMel0wDQYJKoZIhvcNAQEBBQAEggEAEP849ieTmM/9/qfUBQbM yEMMnq4NrQQhp4fMnEbxWRJb+LJyyESyrs2mmQUHMGEvR5olGxoSOjyzyZaYl9a1wE1u5SXp kC0KSTDZ31mSwxuTCfeVe9ceIFySFFhy6XLf02JUgPGywAjEd01WCVeMQ0r1EhhkD+SY3cl9 6ZYdu+n5NV6ZxfN21PwaBsU2sF7GDuYhHlVaOMkTUKuOG4AxD6mhypbkDKks7dUiiq6EXD2d 5AaJ/RkWldy5IVseLVERFEgqXDUo6LCMUNemOt9G5WJeRpOJ7leSVoHIosAWZIOhCoWrcSRV Z8DyzPYURiuTFWLeQ5F8oGWtDUVVyCVuJAAAAAAAAA== --------------ms070700090600040203080102--