<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-NZ;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Verdana",sans-serif;
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.st
{mso-style-name:st;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Verdana",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-NZ" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Our
</span><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;font-style:normal">IronPort</span></em><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">
</span></em><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;font-style:normal">email</span></em><span class="st"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> security appliance adds the “FORGED”
tag. It is not uncommon for it to add that tag to emails from discussion lists.<o:p></o:p></span></span></p>
<p class="MsoNormal"><span class="st"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p> </o:p></span></span></p>
<p class="MsoNormal"><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;font-style:normal">IronPort does good stuff with blocking or tagging spam and forgeries etc, but it drives me crazy the way it flags emails in ways I consider
inappropriate. I try to accept that spam and security are difficult areas to deal with effectively and economically, but I still get annoyed.
<o:p></o:p></span></em></p>
<p class="MsoNormal"><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;font-style:normal"><o:p> </o:p></span></em></p>
<p class="MsoNormal"><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;font-style:normal">Bob</span></em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Brian Simboli [mailto:brs4@lehigh.edu]
<br>
<b>Sent:</b> Wednesday, 8 June 2016 12:05 p.m.<br>
<b>To:</b> Bob Pearson <b.pearson@auckland.ac.nz><br>
<b>Cc:</b> Kathleen Folger <kfolger@umich.edu>; Egan,Noelle <nme26@drexel.edu>; eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] [FORGED] Re: American Chemical Society blocked IPs<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">Why does the subject header have "[FORGED]" in it?<o:p></o:p></p>
</div>
<p class="MsoNormal">Just curious.<o:p></o:p></p>
</div>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Jun 7, 2016 at 5:58 PM, Bob Pearson <<a href="mailto:b.pearson@auckland.ac.nz" target="_blank">b.pearson@auckland.ac.nz</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Yep, into our 3<sup>rd</sup> day of being blocked. Identified a compromised account and reset the password
and notified ACS. They have asked for the IP addresses used, which I will collate and give them, but they have not unblocked us in the meantime. </span><span style="font-size:10.0pt;font-family:Wingdings;color:#1F497D">L</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Clearly this was a large-scale planned breach. From my first quick look at IPs they seem to be Russian.
I’m curious whether others found the same, or is there a wider geographic spread?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Bob Pearson<br>
Digital Access Librarian<br>
Digital Services<br>
The University of Auckland Library<br>
New Zealand</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l
[mailto:<a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank">eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Kathleen Folger<br>
<b>Sent:</b> Wednesday, 8 June 2016 8:37 a.m.<br>
<b>To:</b> Egan,Noelle <<a href="mailto:nme26@drexel.edu" target="_blank">nme26@drexel.edu</a>><br>
<b>Cc:</b> <a href="mailto:eril-l@lists.eril-l.org" target="_blank">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> [FORGED] Re: [Eril-l] American Chemical Society blocked IPs</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Noelle,<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks so much for sharing this information. We got a report from ACS of a breach via our proxy server and investigated as we do normally. We identified a compromised user account
and reported back to ACS but they have not been responding to our requests to have the block removed. Now I know why.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">-Kathleen<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br clear="all">
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="background:white">_________________________________________<br>
Kathleen M. Folger, Electronic Resources Officer<br>
University of Michigan Library<br>
312 Hatcher North<br>
Ann Arbor, MI 48109-1190<br>
V:<a href="tel:%28734%29%20764-9375" target="_blank">(734) 764-9375</a><br>
F:<a href="tel:%28734%29%20764-0259" target="_blank">(734) 764-0259</a><br>
<a href="mailto:kfolger@umich.edu" target="_blank">kfolger@umich.edu</a></span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, Jun 7, 2016 at 4:19 PM, Egan,Noelle <<a href="mailto:nme26@drexel.edu" target="_blank">nme26@drexel.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Hi All,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Here at Drexel we had a hack of 4 users account on Sunday, and the accounts were used to download massive numbers of articles from ACS. ACS subsequently blocked
our access through our EZProxy IP address. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">I just got off the phone with Richard at ACS about this, who let me know that many universities had user accounts hacked in the same way, and this breach was
affecting several other publishers as well. I was surprised I hadn’t seen any traffic about the issue on this listserv – has anyone else been blocked by ACS or another publisher in the last few days for excessive downloading?
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">FYI – ACS says they are not unblocking any IP addresses until they have the issue resolved, at which time they’ll email all their affected customers about reinstated
access. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Thanks, Noelle</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">-------------------------------------------------------------------</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Noelle Egan<br>
</span></b><i><span lang="EN-US" style="font-size:10.0pt;color:black">eResources & Acquisitions Librarian</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:10.0pt;color:black">Drexel University Libraries<i> </i></span><b><i><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span></i></b><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#003377">Drexel University<br>
</span></b><span lang="EN-US" style="font-size:10.0pt;color:black">3300 Market Street<br>
W. W. Hagerty Library<br>
Philadelphia, PA 19104<br>
Tel: <a href="tel:215.895.2752" target="_blank">215.895.2752</a> | Fax: <a href="tel:215.895.2070" target="_blank">
215.895.2070</a><br>
<a href="http://www.library.drexel.edu/" target="_blank">drexel.edu/library</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org" target="_blank">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<pre>Brian Simboli<o:p></o:p></pre>
<pre>Science Librarian<o:p></o:p></pre>
<pre>Library and Technology Services<o:p></o:p></pre>
<pre>E.W. Fairchild Martindale<o:p></o:p></pre>
<pre>Lehigh University<o:p></o:p></pre>
<pre>8A East Packer Avenue<o:p></o:p></pre>
<pre>Bethlehem, PA 18015-3170<o:p></o:p></pre>
<pre>(610) 758-5003 Fax (610) 758-6524<o:p></o:p></pre>
<pre>E-mail: <a href="mailto:brs4@lehigh.edu" target="_blank">brs4@lehigh.edu</a><o:p></o:p></pre>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>