Have you ever found yourself saying: I’m too smart to get a virus like that on MY computer? Famous last words… Scammers have become much savvier, and many of us are falling for their schemes, especially when it comes to opening email attachments.
Security guru and CEO of Stickley on Security, Jim Stickley, shares how you can fight back. Just a few extra minutes could save your computer and your identity!
Most people understand there are risks when opening attachments. That said, thousands of people end up with malware on their computers after opening malicious attachments. It is often a case where the person who became infected was fully aware there are risks with attachments. The problem is that they thought the attachment they were opening was safe. There are a number of reasons for this, but the most common two are (1) that the email came from someone they trusted, or (2) because the type of attachment didn’t seem like something they needed to worry about.
Let’s start with an email coming from a trusted source. You’re at work and receive an email that appears to have come from the IT department. The email contains a message explaining that a security patch needs to be applied to your computer ASAP. The email is from the IT person, and he calls you by name and talks specifically about the patch resolving issues related to a job function that you do. The attachment included is a zip file and for security reasons, the file has been locked with a password that will be sent to you in a different email. It is easy to understand how a person might think this email is legitimate.
A minute later, a second email arrives from the IT person, and this one contains the password and a note asking you to get started ASAP. At this point, you open the zip file, provide the password, and run the patch installation just as you were asked. A minute or two later you are all done, and the patch is applied. So you think.
Of course, you didn’t actually install a patch, and the email didn’t come from the IT person. This is a very common type of phishing attack where a user is tricked into installing malicious software via an attachment. The reason for the success is that the source of the email appears to be trusted and the message seems very realistic.
While the message and type of attachment may vary, the goal is always the same: to trick the user into opening the attachment and installing malware. While the example above would require the user to follow a few steps, in other cases you may never even know that something was installed. This leads to malicious attachments that may be sent from trusted or random individuals.
Now, it seems like if you received a malicious attachment from some random person, you would obviously not open it. Yet, there is a very good chance in just the past seven days you may have done just that. You see, people have an idea in their mind that a malicious attachment is a very specific type of file, such as an executable or zip file. In reality, numerous other types of attachments can be just as dangerous if not more so. For example, have you ever received a PDF file from a vendor doing business with you? It turns out that Adobe Acrobat, the software most commonly used to view PDF files also has been found to contain numerous security vulnerabilities. That means that if you are not up to date with the latest security patches for Adobe Acrobat, simply opening the PDF file to view it can cause malware to be installed on your computer. Of course you won’t have any idea this has happened because the PDF file will open as normal for you.
Word docs, spreadsheets, PDF files, and numerous other attachment types can all contain malicious software and be used to exploit vulnerabilities and compromise your computer. Much like links in email, users should be extremely cautious when opening any attachment received in an email. Of course there will be situations where you need to open an attachment sent from a co-worker, but the idea is that the email should be expected when you do. If you receive an unsolicited email from a trusted or non-trusted source, this is the time you should be cautious about opening the attachment. When in doubt, hold off on opening it. If possible, pick up the phone and call the sender of the email or contact someone in IT who can assist you and confirm that the attachment is safe to open.
How DuGood Can Help
At DuGood, protecting your personal and financial information is very important to us! It’s why we publish articles like this one. Want to learn more? Be sure to check out our Security Center for even more tips.
We also offer ID Theft Protection for our debit and credit card holders. For only a few bucks a month, you can cover all of your financial accounts – not just those at DuGood!
