Mendalla
Happy headbanging ape!!
- Pronouns
- He/Him/His
There's a whole raft of them, but the granddaddy of them all is the "419" scam (in fact, it predates the Internet, having begun as a mail and fax scam). You know, those emails that promise you millions from the fortune of some guy that's stranded in an overseas bank waiting to be unlocked if you just send them X dollars. Modern Rogue, one of my current favorite Youtube channels, did a piece on them this past week that I'll post as a reminder that they have not gone away even if they aren't a major news story anymore.
And there is, of course, a raft of others. Mrs. M got a very authentic looking "spear phishing" message purporting to be from Amazon recently. Your order has shipped, open attached PDF for information was the gist of it.
Problem: (aside from the fact that we have no open orders with Amazon) Amazon doesn't send PDF attachments on acknowledgements and other order-related email. In fact, because of how the computer she was using was configured, I could see that there was a ".htm" extension hidden behind the ".pdf" extension. An htm file would be able to carry some kind of malicious code written in JavaScript or similar. Likely, if you opened it, it would drop some kind of malware that would send private information (passwords, etc.) to the scammer or lock up your computer until you pay a ransom (called, appropriately, ransomware).
So, the rules of the game remain (I have been telling staff at work this forever) that if you have any reason to doubt the provenance of an email whatsoever, delete the sucker. Unknown sender? Nuke it. Weird attachment? Nuke it. Regarding an account or order that you never set up? Nuke it. Unexpected email purporting to be from someone you know? Contact them directly to confirm it and then nuke it if not confirmed.
Also, if you get email purporting to be from your bank or other agency asking you to follow a link and enter your credentials? Don't do it. Go directly to the agency's website and login that way. No reputable organization should be asking for your credentials that way. Similarly, if you get a password change notice from an account that you know you did not request a change for, go directly to that site (ie. don't use any links in the message) and change your password asap, then delete the message.
I'm sure I will think of more as time goes on and others may have tips and stories of their own to add. Given the importance of the subject to those of us who dwell on the Internet a lot, I'm stickying this.
And there is, of course, a raft of others. Mrs. M got a very authentic looking "spear phishing" message purporting to be from Amazon recently. Your order has shipped, open attached PDF for information was the gist of it.
Problem: (aside from the fact that we have no open orders with Amazon) Amazon doesn't send PDF attachments on acknowledgements and other order-related email. In fact, because of how the computer she was using was configured, I could see that there was a ".htm" extension hidden behind the ".pdf" extension. An htm file would be able to carry some kind of malicious code written in JavaScript or similar. Likely, if you opened it, it would drop some kind of malware that would send private information (passwords, etc.) to the scammer or lock up your computer until you pay a ransom (called, appropriately, ransomware).
So, the rules of the game remain (I have been telling staff at work this forever) that if you have any reason to doubt the provenance of an email whatsoever, delete the sucker. Unknown sender? Nuke it. Weird attachment? Nuke it. Regarding an account or order that you never set up? Nuke it. Unexpected email purporting to be from someone you know? Contact them directly to confirm it and then nuke it if not confirmed.
Also, if you get email purporting to be from your bank or other agency asking you to follow a link and enter your credentials? Don't do it. Go directly to the agency's website and login that way. No reputable organization should be asking for your credentials that way. Similarly, if you get a password change notice from an account that you know you did not request a change for, go directly to that site (ie. don't use any links in the message) and change your password asap, then delete the message.
I'm sure I will think of more as time goes on and others may have tips and stories of their own to add. Given the importance of the subject to those of us who dwell on the Internet a lot, I'm stickying this.
