Lies in your inbox 2004

Most of the readers of my site probably understand this already, but I want to give an example of the kind of malicious email being sent these days. Unfortunately, unscrupulous people have abused this wonderful communication system terribly. It is still worth using and just incredible when you think about how it has enabled friends and family to stay closer, but it must be said that it is sorely damaged.

Know these things about email:

1. Your address is probably on one or more big lists of addresses which are sold to companies who do not mind inconveniencing millions of people in order to make a very small number of sales. Thus, just because it's addressed to you doesn't mean the sender wants to contact you personally.

2. The "From" address can be faked. Unfortunately, it is probably another name chosen from such a list. It is possible if not probable that if you receive spam (junk email) that it has also been sent out in your name. Thus, just because it says it came from someone doesn't necessarily mean it really is.

3. The text of email can be lies. Thus, just because it says its from a company you do business with, it may not necessarily be. If a phisher (someone trying to steal personal identification and financial information) sends out millions of a letter claiming to be from, say, CitiBank, some will probably end up happening to reach an actual CitiBank customer who might be fooled into divulging information. Here's an example of a related tactic which I received in June:

Dear user, the management of Metagrrrl.com mailing system wants to let you know that,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

For details see the attach.

Cheers,
The Metagrrrl.com team http://www.metagrrrl.com

Attachment converted: ire:Attach.pif ( / ) (0012E22C)

This came to dinah at this domain and claimed to be from administration at this domain. The attached "anti-virus tool" is probably spyware (software which collects information as it is entered on your computer) or some other malicious program such as one which could allow another user access to your machine. Thus, just because it seems on the surface legitimate, doesn't mean it isn't an attack against your privacy in disguise. After receiving such an unexpected letter, always visit the web site of the company by typing in the address yourself in your browser rather than clicking a link or downloading from the email itself. When personal information is requested - the classic "update your records with our company" phishing technique - call the company (and not using a phone number listed in the email!) to see if they do legitimately need the information. When you receive such a scam email for the first time, you can forward them with their header information to the company's abuse department. This department email address is usually "abuse@" whatever the company's domain name is. They will only need one example of each distinct scam you received and it is probably only worth forwarding the email to them if it is within the first hour after you received it or if you receive a lot of spam and this one seems to be using a new phishing technique which you want them to warn their customers about.

Comments

Lies in your inbox

Most of the readers of my site probably understand this already, but I want to give an example of the kind of malicious email being sent these days. Unfortunately, unscrupulous people have abused this wonderful communication system terribly. It is still worth using and just incredible when you think about how it has enabled friends and family to stay closer, but it must be said that it is sorely damaged.

Know these things about email:

1. Your address is probably on one or more big lists of addresses which are sold to companies who do not mind inconveniencing millions of people in order to make a very small number of sales. Thus, just because it's addressed to you doesn't mean the sender wants to contact you personally.

2. The "From" address can be faked. Unfortunately, it is probably another name chosen from such a list. It is possible if not probable that if you receive spam (junk email) that it has also been sent out in your name. Thus, just because it says it came from someone doesn't necessarily mean it really is.

3. The text of email can be lies. Thus, just because it says its from a company you do business with, it may not necessarily be. If a phisher (someone trying to steal personal identification and financial information) sends out millions of a letter claiming to be from, say, CitiBank, some will probably end up happening to reach an actual CitiBank customer who might be fooled into divulging information. Here's an example of a related tactic which I received in June:

Dear user, the management of Metagrrrl.com mailing system wants to let you know that,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

For details see the attach.

Cheers,
The Metagrrrl.com team http://www.metagrrrl.com

Attachment converted: ire:Attach.pif ( / ) (0012E22C)

This came to dinah at this domain and claimed to be from administration at this domain. The attached "anti-virus tool" is probably spyware (software which collects information as it is entered on your computer) or some other malicious program such as one which could allow another user access to your machine. Thus, just because it seems on the surface legitimate, doesn't mean it isn't an attack against your privacy in disguise. After receiving such an unexpected letter, always visit the web site of the company by typing in the address yourself in your browser rather than clicking a link or downloading from the email itself. When personal information is requested - the classic "update your records with our company" phishing technique - call the company (and not using a phone number listed in the email!) to see if they do legitimately need the information. When you receive such a scam email for the first time, you can forward them with their header information to the company's abuse department. This department email address is usually "abuse@" whatever the company's domain name is. They will only need one example of each distinct scam you received and it is probably only worth forwarding the email to them if it is within the first hour after you received it or if you receive a lot of spam and this one seems to be using a new phishing technique which you want them to warn their customers about.

« | Main | CSS, reputation and gender »

Blog (noun) A weblog or similar brief journal usually containing links and commentary thereon. Term coined by Peter Merholz.
Visit Typepad or Blogger to start your own. (I began with hand coding, then switched to Blogger when it first became available, then to Movable Type when I wanted more control over my weblog and to have it hosted at a place of my choosing (Hurricane Electric). Now I use Typepad, built by the same folks who made Movable Type and I love it).

You may write to Dinah @ this domain.

Except where otherwise noted all content is copyright 1965-2012 Dinah Sanders. Please do not repost my writing or other creations elsewhere. Instead, copy a tiny bit and link to the rest. Thanks! Images are copyright of their original creators. MetaGrrrl logo and photos by Dinah are copyright 1965-2012 Dinah Sanders. Inkspot Books and the Inkspot logo have been Service Marks of Dinah Sanders since 1993.