A while back I wrote a blog about how to keep your Steam/email account safe from unscrupulous people on the internet. After a bit of thinking, it has occurred to me that it would not be a bad idea to write another one, on how to stay safe from email traps and ambushes. So here we go…
It usually begins in roughly the same way as when someone tries to scam you. They send you an email. In that email they put a message deliberately written to startle and alarm you, since a person who’s a bit rattled is less likely to remember to be careful with their log in information or to pause and think for a moment. The email might look like this:
Dear Skype Member:
Attention! Your Skype account has been limited!
As part of our security measures, we regularly screen activity in the Skype system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:
Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.
Click here to activate your account **URL removed for security reasons**
2010 Skype Limited
This email looks genuine, and anyone who has purchased Skype Credits, or is paying for one of the services they offer (caller ID, voice mail, et cetera) is of course not going to want to lose that money. That’s why the first line says “Attention! Your Skype account has been limited!” It’s intended to frighten you and distract you from paying too close attention to the rest of the email. If you are unfamiliar with this type if email scam that opening line is an open threat to take your account away, and worried and perhaps a little frantic, you immediately click on the link in the email to reactivate and verify your account.
When you do, then as soon as you type them in your user name and password are recorded by the scam website. Your log in information is now in someone else’s hands, and by the time you have finished reading this sentence, so is their Skype account and the credit card information stored in it.
Even if you stop when you realize that the page doesn’t look like the official Skype page, and close the window and delete the email, you could still lose your account, just from clicking on the link; sometimes just visiting a website is all it takes. Sometimes opening the email is all it takes.
You see, emails can have scripts and/or html-code in them that activate when you open the email, and attempt to install malware, hijack your browser, and various others nasty things. If you have an MSN email account, you should be familiar with the yellow bar that appears at the top of emails with the phrase, “Attachments, pictures, and links in this message have been blocked for your safety”, and a link that lets you view the blocked content if you want to. Microsoft added this feature just to stop attacks like that, and to give you a chance to look at the email and judge whether it is safe to show the extra content or not. Use it wisely, by pausing and thinking it over before clicking to see the links.
As a matter of act, all email clients, either web based email ones like Yahoo or Gmail, and installed ones like Thunderbird and Outlook, have their set of risks s well as their own lines of defense.
The vast majority of web based clients today have contracts with anti-virus companies to help keeping the email secure, for example if you have a Yahoo Account, all your email attachments are scanned with McAffee before you can open them. If you are using Outlook, your resident anti-virus will offer to act as your email scanner on installation. (You want to accept that offer, by the way. You really do.)
This takes us to the next part of this little guide…
…EMAIL ATTACHMENTS ARE DEADLY
Okay, that was a bit of an exaggeration. However, nearly every single friend or co-worker who needs my help removing a virus from their computer needs that help because they opened an electronic greeting card from an email address that looked vaguely familiar, or because they opened a file named adorable_puppies.gif that a stranger sent them, without first scanning it with their anti-virus.
If you’re lucky, these types of malware attachments are simple nuisances, like a little browser hijack that redirects your google searches to porn websites. Granted, this becomes a bit awkward if your 12 year old daughter uses this computer for online research for her school projects, but it’s not at all the worst that can happen.
The malware may take over your computer so completely that nothing can be done. Hopefully you had copies of those tax records and wedding photos, because you probably won’t get them back once you’re done reformatting the hard drive and reinstalling your Operating System…
Still not the worst that can happen.
The worst that can happen is that the email attachment installed a keylogger, and the next time you log in to your online banking account, the keylogger registers your keystrokes and memorizes your login information. You never know about this, because the first thing the keylogger did when it installed itself was to disable a few processes here and add a few others there, and hide itself from your anti-virus, so it can sit there and phone home to its heart’s content, sending over all the information it has memorized. This gives the origins of the keylogger access to your banking information, your credit card information, your mortgage… oh, were you among the millions of Americans who submitted your taxes online this year?
I’m sure you can see where I am going with this. A worst case scenario rarely happens, but that’s not from a lack of trying on the malware authors’ part.
SO WHAT DO I DO?
Thankfully, the threat of email attachments is easily avoided. To begin with, make it a rule to delete any and all attachments from people you don’t know. It doesn’t matter who they claim they are, if you were not expecting them to send you a file, delete it without opening or downloading it.
If you are expecting a file over email, or if it is from a person you know, you still want to be very careful. If they have malware on their computer without knowing it, they will give it to you via email. Yes, malware spreads by emailing itself to everyone in your Outlook address book. Your college professor, or the company you just emailed your resume to, will probably not appreciate that…
Because of this it’s important to remain cautious with any and all email attachments, regardless of who they’re from. Never open them straight from the email, never run the file, even though Internet Explorer will want to do that rather than save it. Always, always, save the file to a location where it’s easy to find, and then scan it with your anti-virus. Only open the file if it comes back clean; if the anti-virus says it’s infected, follow your antivirus program’s recommendation for what to do with it. If you’re not going to follow its advice you might as well uninstall it since it’s not going to be of use to you anyway.
Remember, paranoia is a virtue, and no one on the internet will ever give you anything for free. Not even advice.