<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma",sans-serif;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma",sans-serif;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Verdana",sans-serif;
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Verdana",sans-serif;
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If you see the same user appearing in the logs over and over again, it might be worth getting IT to check their computer for viruses, too. One of our ACS blocks was associated
with a single user whose computer had to be referred to Security/IT; it was downloading the same content over and over, and “not honoring” a block from “Network Quarantine”.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Heather Shipman<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">E-resources Acquisition Specialist<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">110 Olin Library, Cornell University<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="mailto:Heather.shipman@cornell.edu"><span style="color:#0563C1">Heather.shipman@cornell.edu</span></a> ; 607-254-1499<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [mailto:eril-l-bounces@lists.eril-l.org]
<b>On Behalf Of </b>Sally Krash<br>
<b>Sent:</b> Wednesday, June 08, 2016 8:18 AM<br>
<b>To:</b> eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] American Chemical Society blocked IPs<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">They unblocked us Monday afternoon, after we identified the account associated with the unauthorized use. So, they are working on restoring access to libraries.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Sally Krash<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Head of Information Resources Management<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">W.E.B. Du Bois Library<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Massachusetts Amherst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">413-545-6865<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:krash@library.umass.edu">krash@library.umass.edu</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [<a href="mailto:eril-l-bounces@lists.eril-l.org">mailto:eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Bob Pearson<br>
<b>Sent:</b> Wednesday, 8 June 2016 9:59 a.m.<br>
<b>To:</b> Kathleen Folger <<a href="mailto:kfolger@umich.edu">kfolger@umich.edu</a>>; Egan,Noelle <<a href="mailto:nme26@drexel.edu">nme26@drexel.edu</a>><br>
<b>Cc:</b> <a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> [FORGED] Re: [Eril-l] [FORGED] Re: American Chemical Society blocked IPs<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Yep, into our 3<sup>rd</sup> day of being blocked. Identified a compromised account and reset the password and notified ACS. They have asked for
the IP addresses used, which I will collate and give them, but they have not unblocked us in the meantime. </span><span lang="EN-NZ" style="font-size:10.0pt;font-family:Wingdings;color:#1F497D">L</span><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Clearly this was a large-scale planned breach. From my first quick look at IPs they seem to be Russian. I’m curious whether others found the same,
or is there a wider geographic spread?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Bob Pearson<br>
Digital Access Librarian<br>
Digital Services<br>
The University of Auckland Library<br>
New Zealand</span><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [<a href="mailto:eril-l-bounces@lists.eril-l.org">mailto:eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Kathleen Folger<br>
<b>Sent:</b> Wednesday, 8 June 2016 8:37 a.m.<br>
<b>To:</b> Egan,Noelle <<a href="mailto:nme26@drexel.edu">nme26@drexel.edu</a>><br>
<b>Cc:</b> <a href="mailto:eril-l@lists.eril-l.org">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> [FORGED] Re: [Eril-l] American Chemical Society blocked IPs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-NZ">Noelle,<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-NZ">Thanks so much for sharing this information. We got a report from ACS of a breach via our proxy server and investigated as we do normally. We identified a compromised user account and reported back to ACS but they have
not been responding to our requests to have the block removed. Now I know why.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-NZ">-Kathleen<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-NZ"><br clear="all">
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-NZ" style="background:white">_________________________________________<br>
Kathleen M. Folger, Electronic Resources Officer<br>
University of Michigan Library<br>
312 Hatcher North<br>
Ann Arbor, MI 48109-1190<br>
V:(734) 764-9375<br>
F:(734) 764-0259<br>
<a href="mailto:kfolger@umich.edu" target="_blank">kfolger@umich.edu</a></span><span lang="EN-NZ"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-NZ">On Tue, Jun 7, 2016 at 4:19 PM, Egan,Noelle <<a href="mailto:nme26@drexel.edu" target="_blank">nme26@drexel.edu</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi All,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Here at Drexel we had a hack of 4 users account on Sunday, and the accounts were used to download massive numbers of articles from ACS. ACS subsequently blocked our access through
our EZProxy IP address. <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I just got off the phone with Richard at ACS about this, who let me know that many universities had user accounts hacked in the same way, and this breach was affecting several other
publishers as well. I was surprised I hadn’t seen any traffic about the issue on this listserv – has anyone else been blocked by ACS or another publisher in the last few days for excessive downloading?
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">FYI – ACS says they are not unblocking any IP addresses until they have the issue resolved, at which time they’ll email all their affected customers about reinstated access.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks, Noelle<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">-------------------------------------------------------------------</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Noelle Egan<br>
</span></b><i><span style="font-size:10.0pt;color:black">eResources & Acquisitions Librarian</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;color:black">Drexel University Libraries<i> </i></span><b><i><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span></i></b><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Drexel University<br>
</span></b><span style="font-size:10.0pt;color:black">3300 Market Street<br>
W. W. Hagerty Library<br>
Philadelphia, PA 19104<br>
Tel: <a href="tel:215.895.2752" target="_blank">215.895.2752</a> | Fax: <a href="tel:215.895.2070" target="_blank">
215.895.2070</a><br>
<a href="http://www.library.drexel.edu/" target="_blank">drexel.edu/library</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-NZ"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-NZ"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>