Enterprise Alert Management

This page contains information about current virus threats and the activity that is currently in progress to address email security issues.

Current Issues:

Reminder about Phishing Attempts (6/16/08)

GroupWise appointments may be moved by one hour during DST time changes in 2007 (12/29/2006).

Information on how IT@Johns Hopkins is addressing the "image spam" problem (10/15/2006)

Reminder about Phishing Attempts (9/16/05)

Important Message Regarding Hurricane Related Fraud (9/2/05)

View the current list of blocked file attachment extensions (updated 2/14/08).

Latest Sophos Information on Viruses and Hoaxes

If you use an email client to connect to JHEM (Outlook, Outlook Express, Netscape, Eudora, Mozilla, etc), your client can be easily set up with a secure connection.  Click Here.

What you can do to help guard against Virus/Worms:

1. Keep your desktop anti-virus software up to date. Visit the Hopkins anti-virus site.
2. Keep your operating system patches up to date, or ask a PC support person for help.
3. Don't open suspicious emails from unknown senders.
4. Don't click on links within email messages to web sites asking for personal information.
5. Call your LAN support group or 5-HELP, if you are fairly sure you have a virus, shut down your system or disconnect it from the network until you can get help.

 View the current list of blocked file attachment extensions.

Email, Messaging Alerts & Information

6/9/2008 Legacy Listproc servers will be decommissioned on June 30th, 2008

4/21/2008 Microsoft Exchange address book synch established to populate Exchange address book with JHEM and GroupWise addresses

3/25/2008 SPAM Quarantine service retention time reduced from 21 days to 15 days.

2/14/2008 File extension block for .WMF files was removed from the perimeter email attachment block list to address concerns associated with Office 2007 document types.

1/17/2008 Incoming POP & IMAP ports closed at the perimeter firewalls.  This only affects insecure ports 110 and 143.  Secure ports for POPs and IMAPs are still supported for inbound connections.

12/27/2007 SMTP authentication issue resolved.

12/24/2007 A software bug has been discovered affecting outbound SMTP authentication for internal Hopkins customers.  Customers may experience intermittent delays when sending outbound messages.

10/30/2007 Work completed to close port 25 for internal email servers.  Specific exceptions have been made.

7/1/2007 New anti-SPAM/virus hardware and software installed at the email perimeter.

12/2006 New anti-SPAM technology is installed in the perimeter messaging environment.  This new technology uses a packet shaper to control incoming spam.

10/2006 A second anti-SPAM product has been added to the perimeter messaging environment in an attempt to reduce image SPAM.

7/2006 JHEM hardware upgrade is complete.  JHEM customers using email client with POP must reconfigure the client to use secure forms of the POP client with SSL support.  Insecure POP has been disabled.

1/1/06 Insecure IMAP connections scheduled to be disabled.  All email clients should be configured to use secure IMAP connections.  Insecure POP is scheduled to be disabled in the spring with dates TBD.

12/1/05 JHEM Calendar server was unavailable for a 24 hour period while database issues were addressed.  System availability was restored on 12/2/05 and normal operation was available on 12/4/05.

1/4/05 Email to excite.com was temporarily blocked for a period of time on 1/3/05 and 1/4/05. 

12/21/04 The legacy anti-spam software application was completely disabled the enterprise email environment.  This should result in improved spam detection.

12/20/04 AOL blocked email sent from Hopkins over the past weekend and Monday due to a combination of AOL user complaints against Hopkins and technical issues that AOL experienced on Saturday.  This resulted in numberous reports from Hopkins email users that messages sent to AOL users were returned as undeliverable.  We worked with AOL Monday afternoon to correct this problem and this was resolved as of Tuesday morning. 

12/16/04 Due to a large number of email messages infected with the W32.Erkez.D@mm virus, email messages with .ZIP attachments are temporarily blocked from a portion of Hopkins email systems.  This began Tuesday, December 14th at 8pm.

12/14/04 Most of the outstanding issues with webaccess to JHEM that resulted from the upgrade have been resolved.

 11/17/04 GroupWise - JHEM address book synchronization established. Click here for more information.

1. The ability to righ- click "Save As" on an attachment has been removed from webmail.
2. When using Internet Explorer to access webmail, if an attachment has more than one "." in the file name (ex: first.draft.doc), IE cannot download the file.
3. We have received sporatic reports of Internet Explorer "crashing" when viewing PDF files but have been unable to reproduce in our test environment.
4. The option available through webmail for "Always spellcheck before send" has been removed. Spell check must be started manually by clicking "Spell Check" in the compose window.

11/12/04 New problem with JHEM web client discovered.  The option to use spellcheck before sending a message has been disabled in the web client.

11/11/04 Hotfix applied to JHEM to fix outstanding issues from the 10/23/04 upgrade.

11/9/04 Reputation services modified to block

11/6/04 Relay patches scheduled for Friday at 5pm but will not result in an interruption to message flow.

11/2/04 JHU Directory Server upgrades temporarily disabled SMTP Auth for JHU users for a period of time this morning from approximately 6am to 9am.

10/23/04 JHEM application upgrade completed.  Outstanding issues include: 1.  Delay in enabling vacation/forward rules from the web client. 2.  High utilization on the POP process.

9/23/04  Policy to block SPAM based on reputation services implemented.

8/9/04 File attachments with the .ZIP extension were queued for a 12 hour period ending 8/10/04 at 9:00am in response to the initial outbreak of W32.Beagle.AO@mm virus until virus signature files were updated.

8/4/04 JHMI-side email relay servers are listed in SpamCop for a 20 hour period ending on 8/4/04 at 6:30pm.  This affected any mail clients using the JHMI smtp servers that may have sent email to a destination that blocks email based on a SpamCop as a single source for email blocking.

7/30/04 Implement and monitor reputation services.

7/29/04 Second list of top 20 hosts-domains MX records directed to new email servers.

7/19/04 Attachments with the .CPL file extension are blocked in response to W32.Beagle.AG@mm.

7/19/04 IP address of JHMI smtp servers changed.  Any systems using hardcoded IP addresses will be affected.

7/15/04 Email clients that use the relay servers to send email can now take advantage of a secure connection to the smtp email servers. 

6/29/04 MX records for top 20 hosts-domains directed to new email servers.

6/29/04 New email relay servers implemented.  Improved SPAM detection available.

6/12/04 JHEM storage system upgrade will result in downtime starting at 6am Saturday 6/12 and JHEM will be available Monday 6/14 at 6am.

5/27/04 Send "live" email through evaluation software for anti-spam testing.

5/12/04 External email relays upgraded to Symantec SAV version 4.0.  Expected increase in spam detection by 40-50%

5/7/04 Internal email relays upgraded to Symantec SAV version 4.0.  Expected increase in spam detection by 40-50%

5/4/04 Two Hopkins email servers were incorrectly identified as producing spam by AOL and were blocked for a three day time period ending 5/4/04 at 7pm.

4/22/04 JHEM Internet email traffic redirected to internal email gateway servers.

4/20/04 Attachments with the .CMD and .BAT file extensions were blocked in response to MyDoom.J

4/15/04 GroupWise Internet email traffic redirected to internal email gateway servers.

4/15/04 Attachments with the .COM and .SCR file extensions were blocked in response to Netsky.Y and Netsky.W.

3/12/04 POP and IMAP disabled for GroupWise users.  SSL based POP and IMAP are available.

 3/9/04 Attachments with .PIF file extension names were blocked in response to Netsky variant.

Enterprise News & Alerts