To: All Users

Recently, some university members reported that someone is using external email addresses to impersonate them and send messages to students and other members of UM community. Please be vigilant and protect yourself from these scams!

Kindly note the following: 

1. Watch Out for Emails sending from Outside of the University:  Check carefully the sender’s email address, especially if it comes from a domain other than UM (e.g., outlook.com, gmail.com.). Scammers often use email names similar to those of UM members, but with a different domain. You may look out for emails with “External Email Warning Tag”:
   
2. Use University Email Whenever Possible: When communicating with professors, students, or administrative staff within UM, please use the official UM email address (@um.edu.mo, @connect.um.edu.mo) whenever possible.
3. Verify Suspicious Emails: If you receive a suspicious email, please verify its authenticity with the sender by phone or in person.
4. Report Losses Immediately: If you suffer financial or other losses due to this fraud, please report it to the judicial police immediately.
5. Protect Your Personal Information: Do not click unknown links or download suspicious attachments, to avoid revealing sensitive personal information.
6. Report Suspicious Activity: If you discover any suspicious emails or fraudulent activity, please contact the ICTO Help Desk immediately.
   

Thank you for your cooperation in maintaining a secure campus network!

Reference:

• New Feature of Email Services- External Email Warning Tag (https://e-bulletin.um.edu.mo/notice/323058/)

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Microsoft have recently released its May security update notice, there are 78 vulnerability updates this time.

The updates this time mainly cover the following components:  Windows Routing and Remote Access Service (RRAS), Windows Virtual Machine Bus, Windows Installer, Windows Drivers, Windows File Server, Azure, Windows Win32K – GRFX, Microsoft Scripting Engine products vulnerabilities.

Details of the vulnerabilities: 

• Windows Scripting Engine Memory Corruption Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30397

• Windows Common Log File System Driver Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32706

• Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32709

• Windows Common Log File System Driver Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32701

• Microsoft DWM Core Library Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400

• Microsoft Office Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30386
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30377

• Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29833

• Remote Desktop Client Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29966
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29967

For more details about Microsoft May Updates, please refer to: https://msrc.microsoft.com/update-guide/releaseNote/2025-May

If the relevant affected products are used, please install the security updates released by Microsoft as soon as possible. 

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Google have recently issued a zero-day security vulnerability about Chrome browser.  This vulnerability is widely exploited.

• Please update to Google Chrome version 134.0.6998.177 or later

For more details, please refer to:  https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html

Steps to update Google Chrome browser

• Open your Google Chrome browser on your desktop.
• Click the three vertical dots in the upper right corner to open the dropdown menu.
• Select “Settings“.
• Click “About Chrome” on the left-hand sidebar.
• Chrome will automatically check for updates or you can click the button “Update Google Chrome”.
• Restart the Chrome.

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Microsoft have recently released its April security update notice, there are 126 vulnerability updates this time.

The updates this time mainly cover the following components:  Windows Hyper-V, Remote Desktop Gateway Service, Windows Routing and Remote Access Service (RRAS), Windows Common Log File System Driver, Windows TCP/IP, Visual Studio, Windows Active Directory Certificate Services, Windows Kerberos, Windows Kernel products vulnerabilities.

Details of the vulnerabilities: 

• Windows Common Log File System Driver Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824

• Windows Remote Desktop Services Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27480
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27482

• Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26670
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26663 

• Windows Hyper-V Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27491

• Microsoft Excel Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29791
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27752 

• Microsoft Office Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27749
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27748
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27745 

• Windows TCP/IP Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26686

For more details about Microsoft April Updates, please refer to: https://msrc.microsoft.com/update-guide/releaseNote/2025-Apr

If the relevant affected products are used, please install the security updates released by Microsoft as soon as possible. 

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

In today’s digital world, our online accounts hold a vast amount of personal and professional information. Protecting this information is crucial, and one of the most effective methods is to use passwords with reasonable length and complexity. This approach can increase the difficulty for hackers to crack your passwords. In general standard, passwords are recommended to have at least 8 characters long, preferably 15 characters, and consider including uppercase and lowercase letters, numbers, and special characters.

Tips for Setting Passwords:

1. Set Strong Passwords:
   • Passwords should have a specific length and complexity, or use long, easy-to-remember passphrases that are difficult for others to guess.
2. Avoid Using Personal Information:
   • Do not use information that is easy for others to guess, such as your name, birthdate, pet’s name, or common words.
3. Avoid Reusing Passwords:
   • Do not reuse the same password across multiple accounts. If one account is compromised, all other accounts using the same username and password are at risk.
4. Enable Two-Factor Authentication (2FA):
   • Whenever possible, enable 2FA service to add an extra layer of security.
5. Regularly Check Account and Password Safety:
   • It is recommended to regularly check the safety of your accounts and passwords, and change them promptly if you suspect they have been compromised.

By following these tips and developing the habit of using passwords with reasonable length and complexity, you can protect the security of your accounts and information.

Should you have any enquiries, please feel free to contact ICTO Help Desk.

Reference:

• Two-Factor Authentication (2FA)
• How to choose a strong password?
• More information security laws, regulations, policies and guidelines
• How to download and install software in a secure manner

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Microsoft have recently released its March security update notice, there are 56 vulnerability updates this time.

The updates this time mainly cover the following components:  Windows and Windows Components, Office and Office Components, Azure, .NET and Visual Studio, Remote Desktop Services, DNS Server, and Hyper-V Server products vulnerabilities.

Details of the vulnerabilities: 

• Microsoft Management Console Security Feature Bypass Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26633

• Windows NTFS Information Disclosure Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24991

• Windows NTFS Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24993

• Windows Fast FAT File System Driver Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985

• Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983

• Windows Remote Desktop Services Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24045
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24035
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26645

• Windows exFAT File System Remote Code Execution Vulnerability

For more details, please refer to: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21180

For more details about Microsoft March Updates, please refer to: https://msrc.microsoft.com/update-guide/releaseNote/2025-Mar

If the relevant affected products are used, please install the security updates released by Microsoft as soon as possible. 

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office