Have you just ordered a PC from PC World? No? Nor have I.
But PC World is sending me plenty of order confirmations.
They must have made a mistake. Never mind, they have thoughtfully attached a document that is sure to have all the order and delivery details contained therein. We can read this and find out who has really ordered the shiny new PC.
Or we could download a virus
Unfortunately, these attachments are what are known as ‘clickbait’. They are attachments, links, or images that phishers want you to click on, preferably without thinking first.
Most of the time, the worst that will happen is that you will be taken to some sort of advertising. But you could also end up downloading viruses that will spy on your computer, or use your PC to send out spam, or lock your hard drive and hold you to ransom.
This type of attack is known as phishing. The sender of the email is sending you some bait, which they hopefully think you will take by clicking on a link in the email.
Sending spoof order confirmations is not the only way phishers dangle their bait. Receiving an email from someone well known is another way of gaining your attention. For example, I frequently get emails from the United Nations Secretary Ban Ki-moon, or from Larry Page, the co-founder of Google.
Late last year, Larry Page was good enough to send me a Google Official Notification Letter to let me know that I had won £950,000. I was asked to click on a PDF attachment for more details. Unfortunately, opening this document would have downloaded malware to my PC.
World events are another popular way of getting your attention. Last year, people started receiving emails from the Dubai Police Force. The email warns of a terror alert and reads as follows.
Sir,
We got a terror alert regarding your business area.
Be advised to follow the protective measures (SECURITY TIPS) as attached to keep yourself, your company and your family secured.
Best regards,
Lieutenant General, General Security from the Emirate of Dubai
There were two attachments to the email, one was a harmless decoy, but the other would have downloaded a virus called Jsocket which allows an attacker to download files onto an infected computer.
So how can you protect yourself?
Well firstly, don’t open attachments from people you don’t know. Also, don’t open attachments from people you do know, but who’s emails look suspicious. For example, you may receive an email from a contact you know, which contains just one link to a website. This can happen if phishers hijack someone’s contact list from an infected computer and then use real emails as the ‘from’ address for their spam emails.
Make sure you have the latest versions of Acrobat Reader, as phishers can exploit weaknesses in older versions that allow them to hide viruses in PDF documents.
Be doubly vigilant if you receive an email associated with an important date or event, as this is a favourite opportunity for phishers to try and catch you. Here are a few events to be wary of.
- 6 Nations Rugby
- Mother’s day
- Budget day
- Easter Sunday
- The Queen’s birthday
- Saint Georges Day
- The London Marathon
- The FA Cup Final
- UEFA Euro 2016 football tournament
- Wimbledon Tennis
- Rio Olympics
- The US election
These are the dates when phishers know people are most likely to click links, so watch out for offers that are too good to be true.
