In the first installment of this two part series on how to avoid email viruses, we discussed overt file based attacks and how to avoid them. In part 2, we are going to cover the more subtle ways that people will try to take advantage of you and your computer system via your email. When you receive an email, ask yourself:
1.) Is it requesting personal information under the guise of an official source?
◦ Financial institution? (Wells Fargo, Bank of America, etc)
◦ Internet service? (Facebook, MySpace, etc)
Many people are prepared for a file-based attack, but some hackers have taken the attack to a much more subtle level. You will receive an innocent and official-looking email from a credible source, requesting that you visit their website for some maintenance task. It will usually be “resetting your password” or “confirming your information.” When you click the included link, however, you are actually taken to a cleverly-crafted forgery, and when you enter your password, it's being saved and sent to the original creators of the hoax. This gives hackers carte-blanche into your personal information and your social networking sites, allowing them to spread viruses and other malicious content at will.
Just like in the real world, there will never be one be-all, end-all list of safety precautions that can guarantee your safety. Predators will constantly be revising their tactics with ever-increasing degrees of subtlety, and it's up to everyone to be on their guard. The key to real security is to remember that, in almost every circumstance, a hacker needs your cooperation to carry out their plans. Whether it's clicking a file, visiting a website, or unknowingly supplying your personal information, your input is always required. Therefore, the first and most important virus scanner is the one we carry with us all the time: our brain. By cultivating the right attitude toward strange files, you can better keep you and your family safe.
So whenever you receive a new email or any digital correspondence, run the following checklist in your head:
1.) Do I know/trust this source?
2.) Can I be sure this email actually came from that source?
3.) Can I independently validate the source?
4.) Is it asking me to do anything? (read a file, visit a site, etc)
If the email doesn't pass muster, delete it! Send an email to the original source, if you know them, and double-check the validity of the file (telephone is even better than email here). It's a minor inconvenience, but if the original sender understands the need for security, they'll appreciate your thoroughness, because it means they can likewise trust your emails in the future.