Digital Hero

Okay, I know I've already blogged about email phishing scams, but this one was close to home, so I thought I’d share. I received an email this morning, supposedly from ScotiaBank… NOT. Let’s review…

1. banks NEVER send requests for confidential information by email; and
2. banks aren’t going to make spelling and grammar mistakes on professional communications to clients.

So, here’s what the email looked like, marked up with the appropriate comments:

And how did this phishing scam of an email find yours truly? It took 6 jumps:

1. it originated in Germany
2. made a short visit to France
3. then to another server in France
4. it hopped across the Atlantic landing in Boston, Massachusetts
5. it scooted up to Burlington, Massachusetts
6. zipped from the east coast over to the west landing in one of Apple's servers in Cupertino, California
7. and finally was delivered to my Apple iCloud account from which my mail program pulled it down.

It's trip took only a couple of minutes start to finish.

I'm going to split into two directions now: for those that don't want to know how I traced this back, stop here and take with you five things:

1. if you receive an email from someone you don't recognize, DON'T OPEN IT, instead delete it
2. if you open an email and it's asking you to click a link... READ the email... did you order the product or service it's about? If not, delete it
3. if an email is asking you to click a link... hover over - DON'T CLICK - the click and check the URL in the yellow tool tip against what is displayed - if they aren't the same or at least look like they're going to take you to the intended website... you guessed it, delete it
4. governments, banks, cell phone companies, and pretty much EVERYONE doesn't use email to verify personal/private/confidential information because email is largely UNENCRYPTED and NOT SECURE - if you get an email asking ANYTHING to do with personal/private/confidential information, delete it
5. if you want to report the phishing attempt to the organization the attacker's email is pretending to be from, check the organization's website or call them since most have an abuse@ or phishing@ email address that you can forward the email to and they'll attempt to track the source and take appropriate action 

How did I trace the source of this email phishing scam?

If you've hung on to this point, then you want to know how I traced this email to its origin, so here we go. Every email has a header... the part at the top that contains the "From", "To", "Subject", "Date", information. What you don't realize is that there's WAY more in the header than just what we normally see.

Our email programs are set to display the "friendly" headers we are used to seeing. In fact, the header of each email contains its routing information that accumulates as the email travels from its origin to its destination. Spammers and scammers rely on the fact that most people don't know about the routing info in the headers, how to access it and how to use that information to trace the origin of their phishing emails.

Let's pick apart the detailed header of this email so you can see how I traced the path of this Geschenk (gift):

The only extra step was in #4... 10.20.15.2 and 10.20.13.1 are internal network IP addresses, so I had to look up the external IP address of the eigbox.net domain. This is where the link from my info@ address to my @me.com address took place.

To look up the IP addresses I used WhatIsMyIPAddress.com and for looking up the hostname to get the IP address in step #4, I used the hostname to IP address lookup page from the same website. This website also has a page that will attempt to trace the source of an email automatically by allowing you to paste the full header of the offending email into their webpage - what I did the long way - but in my case it wasn't able to figure out the route. You may want to try this before you roll up your sleeves and do it my way.

How do you display the full header information on your email program?

To set your own email program to display the full email headers, follow the instructions for your program by checking your help file. Here are the instructions for some of the more popular email programs borrowed from the Google Email Support Page:

Until next time!
Bob

Comment on this blog item.

Yes, Macs CAN be infected. Period.

Granted that because of the way their operating system is built (largely thanks to the UNIX core it draws from) it is more difficult to infect them, but none the less they can be infected. More importantly, your Mac can be a carrier for malware spreading that malware to others you email, etc.

One reader of my blog sent me an email they received, apparently from PayPal, telling them that a payment had been deposited into their account. Fortunately, after reading my earlier blog item about avoiding bogus emails and phishing scams, they were able to recognize the warning signs. First, they didn't recognize the person who had supposedly paid them. Second, they hovered over the links and none of them matched their displayed counterparts.

They wanted me to check out this phishing scam and forwarded me the offending email. When I received it, my anti-virus immediately kicked in and grabbed the attachment. Here's the payload that was trying to launch before I even opened the email:

Notice the "370163.emlx" piece... that was the attachment this email contained. As soon as the attachment was touched by my Mac's operating system, to write it to the hard drive, Kaspersky... my anti-virus-of-choice grabbed it allowing me the privilege of hitting the "Delete" button and bringing this potential nasty to a swift end. By the way... you can set your anti-virus to automatically deal with malware when it's detected. Don't think you need to be bothered every time one is found... I like to know because it's my business.

Here's what this malware was trying to do to my Mac:

I contacted the reader and told them to immediately update their anti-virus definitions, run a complete scan of their computer and told them what to look for. Sure enough, the outdated definitions had allowed the malware to run. Fortunately, the scan was run soon enough after that the compromise was stopped.

The moral of this story?

• Mac users still clinging to the old paradigm that our computers are invulnerable... wake up and smell the malware, baby! Stop being harbingers of malware for everyone you electronically connect with and throw down some anti-virus protection for your Mac. Here's a couple of the best choices: Kaspersky and Intego's Virus Barrier family of products. The latter is especially good right now because the app is also available for your Apple mobile devices. The tablet version of Kaspersky is being worked on for the iPad (no release date available), but currently they cover only Android devices.

Until next time!
Bob

Comment on this blog item.

Okay, let's be honest... who isn't sick and tired of having to remember their password, oh, I mean passwordS? We have passwords for our computer logon, email, banking, iTunes, YouTube, VPN, Gmail, Rogers account, Bell account, social media accounts, parental control software on our computers, parental control on our TVs (does anyone ACTUALLY use them on their TV?), routers, mobile devices... we are drowning in passwords. That's why most of us tend to use one or MAYBE two passwords for EVERYTHING.

To ensure you reduce your risk of being a victim of identity theft, have separate passwords for your logon, email, banking, social media, etc. Don't use your banking PIN for any of them.

Passwords and remembering them has become the bane of our digital existance. Here's a tip on creating strong, easy to remember passwords based on mnemonics - a fancy word that "refers to the study and development of systems for improving and assisting the memory":

1. use a favourite quote, line from a play, movie or book using 8 to 12 words
2. take the first letter from each word
3. capitalize the first letter
4. take the number of people in your family and put that number between the 5th and 6th letter
5. finally put any one of the punctuation characters in front of the number

Once caveat: not all password fields allow punctuation, so be prepared to roll with it.

Here's an example following the steps above:

1. my example saying is: Revenge is a dish best served cold. It's cold in space, Kirk. (look, it's just an example, okay??)
2. the first letter of each word gives us: riadbscicisk
3. capitalizing the first letter gives us: Riadbscicisk
4. the number of people in my family gives us: Riadb5scicisk
5. finally, we get: Riadb%5scicisk

I know what you're thinking... "Riadb%5scicisk"... seriously... how am I supposed to remember that?? You can because you aren't going to remember "Riadb%5scicisk"... let's face it, unless you are gifted, a Navy Seal or part of some other Covert Ops team, your brain isn't programmed to remember meaningless sequences of characters. BUT, your brain CAN remember a favourite saying, say like "Revenge is a dish best served cold. It's cold in space, Kirk." with %5 thrown in the appropriate spot. Try it with a saying that is near and dear to you and you'll be amazed at how easy this is.

Until next time!
Bob

Comment on this blog item.

I'll get calls from people whose computer has been compromised after they opened an email and or clicked on a link it contained. They don't understand why their anti-virus software didn't protect them.

Let's have a look at a potentially nasty email spoof (bogus, fake email) a client received just this morning. No worries - it's safe in the form I'm presenting it here since these are just screen captures.

Here's the email showing a relatively innocuous link at the bottom and a "trusted source" at the top - apparently from a department in Staples:

This is what we learn when we hover - DON'T CLICK - over the link:

When the URL you WOULD go to is researched (the one in the yellow tool tip), we find it's associated with a number of phishing scams. As defined by Wikipedia, Phishing is:

How did this get past the anti-virus software? There are two types of email spoofs: active and passive. The example above is of a passive email spoof.

Active Email Spoofs: The active email spoofs contain an attachment - a file, photo, song, video, etc. These are particularly bad because as soon as the email is opened, its payload (the attachment) is deployed (activated). Sidebar: this is why having your email preview pane option on is dangerous - you have no chance to think about a suspicious email before your software auto-opens it. In those first few seconds, unless your anti-virus software is up todate and able to detect that email spoof's particular payload, your computer will be compromised. Period.

What to do? Pull the plug!

• IMMEDIATELY unplug your computer's wired connection to the internet. Literally, unplug the ethernet cable that delivers the internet to your computer.
• If your computer uses a wireless connection to the internet, disable it. Know where the hard button is on the outside of your notebook and use that since the infection may render your ability to turn off the wireless capability using your mouse impossible.
• Get your anti-virus scanning your entire computer - NOW, not 2, 15, 30 or more minutes later... NOW!
• Contact your I.T. support person/people of choice and make them aware that you may need them.

Time is of the essence in computer infections/hijacks/compromises! The faster you get your computer's defence systems on the offensive, the better your chances of containing the potential infection. The longer a compromised computer has access to the internet the more likely it is that your personal information can be stolen, the more likely it is that secondary, tertiary and more infections can take place to the point where the system is so badly compromised that the computer is beyond saving.

Passive Email Spoofs: Like our example, above, have nothing actively malicious in them. Instead, they wait until the user clicks their link(s) to take the user to a website that isn't the intended destination. Upon the user's browser arriving at the malicious site, depending upon the browser settings, any number of components may be downloaded through the browser which hijack it or infect the computer. In this case the anti-virus may not kick in because the components downloaded were allowed by virtue of the browser settings... Active-X components, Flash media, etc. the elements that our browsers need to provide a full experience to the websites we visit. Sadly, among the first components that can infect computers this way are ones that redirect browsers to the same or other infected websites only to download even more malware, knock out anti-virus software, change the administrator account password, and the list goes on. Again, having an updated anti-virus program is a good defence, but being aware of the links you are clicking is really the first line of defence.

What to do? The same steps as detailed above for the active email spoofs.

So, let's review:

• if you receive an email from someone you don't recognize, DON'T OPEN IT, instead delete it.
• if you open an email and it's asking you to click a link... READ the email... did you order the product or service it's about? If not, delete it.
• if an email is asking you to click a link... hover over - DON'T CLICK - the click and check the URL in the yellow tool tip against what is displayed. If they aren't the same or at least look like they're going to take you to the intended website... you guessed it, delete it.
• governments, banks, cell phone companies, and pretty much EVERYONE doesn't use email to verify personal/private/confidential information because email is largely UNENCRYPTED and NOT SECURE. If you get an email asking ANYTHING to do with personal/private/confidential information, delete it.

BEFORE you get hacked, check out:

• the RCMP's website on scams at: http://www.rcmp-grc.gc.ca/scams-fraudes/index-eng.htm
• the Canadian Anti-Fraud Centre at: http://www.antifraudcentre-centreantifraude.ca/english/home-eng.html

AFTER you get hacked or you think you've been a victim of identity theft or fraud, use the RCMP Identity Theft and Identity Fraud Victim Assistance Guide or download it as a PDF. Remain calm and work through the steps.

If you are feeling like firing one back on the bad guys, forward the offending email to the organization that the email purported to be from. Most organizations have an email address specifically for reporting email abuse/scams.

Until next time!
Bob

Comment on this blog item.