“Hiiiiiiiii! This is Ashley . . .we did not see you in our wedding . . . Well, here I’m sending you a few pics taken in our wedding . . . http://www.FAKEURL.com/photos/ashley/wedding.zip
It’s so easy to click the mouse button on an email like this. Who doesn’t know an “Ashley”?
“Was I invited to a wedding? I wonder what her dress looked like?” The rest of the internal dialogue is less benign, “Oops, that was a .ZIP file, wasn’t it? Hey, that was weird. YOW! My computer — Oh sweet mother of GOD!”
Note that the link in this email was to a .ZIP file format. Spammers like .Zip spam because many email spam detectors and anti-virus programs don’t scan compressed files. It’s a popular way (in certain double-plus-not-good crowds) to slip in BotNet software to turn your computer into a zombie remote processor or open a door to your banking passwords. Possibilities are only limited by a Russian teenager’s imagination.
eWeek reports an uptick in the number of infected .ZIP file spam recently:
Anyone who makes the mistake of opening the attachment is greeted with a Trojan.
[The Trojan] downloads further malicious code from the Internet,” explained Graham Cluley, senior technology consultant at Sophos. “Obviously the nature of the code it downloads can be changed at any time, but the usual suspects would be spyware code to steal your log-in details, turn your computer into a bot, etc.”
Microsoft’s “Security Intelligence Report” blog explains more about BotNets and “Drive-by Download” sites” — websites where vulnerable computers can be infected with malware simply by visiting it, even without attempting to download anything.
The moral of today’s Tale of Terror is “Don’t doze off at the reins while the horses are moving.”
- Never EVER click on a link from an email.
- Always keep your browser, operating system and hardware drivers up to date.
- Don’t rely on a single anti-virus or anti-malware product. No one product will detect everything.
- Avoid Windows Internet Explorer if you can.
- Don’t assume that just because someone has your email address, they are your new best friend.