EMAIL THREATS
SPOOFING
One of the top cyberattacks right now comes from bad actors attempting to impersonate your co-workers and employers. If you’re suspicious of a scammer, don’t reply! They’ll do anything they can to trick you into believing that you’re talking to someone you know and trust, through email and web threats.
Emails contain information that a lot of people don’t pay close attention to. One specific item is the “From” email address. Anther is the email address communicating with your email server where to send your “Reply” to. Both of these can be entirely different, and can alter the state of the “From” field to fool you.
Fortunately, MailShield and The Email Laundry protect you from impersonation attempts where the scammer actually uses the email address they are impersonating in the From field. An example of what that might look like is My Boss<myboss@mycompany.com></myboss@mycompany.com>. When you click Reply, it gets sent to the hidden Reply-To item.
Tip! If you create a new email and type in the To field myboss@mycompany.com, it will go to your boss!
Slightly less dangerous is when they don’t hide their sending address, such as My Boss<scammer@iamafake.com></scammer@iamafake.com>. If you receive an email from a coworker that just doesn’t seem right, look for that give away!
PHISHING
Phishing is a very wide spread threat today. There are many types including spear phishing and whaling. Phishing attacks take many forms, but most of them involve posing as someone you know and trust. This can be a person or a company.
A common form of this is an email that claims to be from your server administrator stating that you have emails being held and to click a link and log in to claim them. When you click the link, you may be taken to a site that is made to look like the one you expect and be prompted to log in. You will have just given away your email password.
There are a number of account types that are targeted in this way. Imagine if your bank sends you an email saying click here to handle this urgent matter! You might think, “Uh Oh! I better do it right away!”. This is how your accounts can become compromised. Don’t trust the link, and don’t trust the button!
SPEAR PHISHING
Spear phishing is targeted phishing. This is when a specific individual, or a whole company, is targeted by phishing emails. Generally, the bad actors will start by obtaining as much information from the company’s website as they can. This includes any email addresses listed, as well as the names of any contacts that arelisted on the site. Once this is done, they often implement spoofing techniques.
WHALING
Whaling is the term used when the phishing methods are targeting the senior executives and other high profile targets. It is a specialized form of spear phishing. Generally, once the scammers have obtained enough information about a company, they will pose as the CEO and request a purchase, or a funds transfer. Usually, the purchase will be some kind of gift card and they will ask for the numbers once the purchase has been made.
WHAN YOU CAN DO!
There are some basics things that will help keep you safe from many, if not all, email threats. The first is to utilize an anti-spam service. There are some habits that you should get into that will also help keep you safe.
AS AN INDIVIDUAL…
- Remember the From field of an email doesn’t always show who actually sent it or who will get the Reply!
- Remember the Reply-To hidden item? Click New or Compose instead of Reply if you are suspicious. Then you know who you are sending to!
- If anything about an email seems out of place, be suspicious!
- If a known and trusted contact sends an attachment or shares a document that seems unusual, DON’T OPEN IT! Find an alternative method to confirm they sent it. Phone or face to face is best.
- Only use the method of logging in to online accounts that you normally use. If there is an issue, there should be a notification waiting for you. If you get an email saying there is an issue with your account, don’t click the link.
- Set up multi-factor authentication (MFA) when possible! MFA makes logging a little more of a hassle but the security benefit is enormous!
AS A COMPANY…
- Establish policies! Set and follow rules on fund transfer and purchase requests via email. Phone or face to face confirmation is best, but even clicking New can help here. Except if the requesting email address was compromised…
- Establish protocols. When you begin doing business with another company ask them if, and how, they send documents via email. Include
- Is it an attachment? Or a shared online document?
- What type of document?
- What email address will it arrive from?
- Are they sent on a schedule?
WEB THREATS
PHONE SCAMS
There are two ways you might be targeted by a phone scam. You might get a call from someone claiming to be a Tech working for Microsoft, or perhaps another well known maker of software. The Tech will then tell you they have detected that there is a problem with your computer and that you need to give them remote access to fix it. Hang up!
You may also suddenly receive a pop up while browsing the internet. The pop up will claim that a virus, or other “Urgent” problem has been detected and you will be urged to call a number provided so that you can be assisted.
The results of allowing a remote connection are usually, but not limited to:
- Installation of malicious software that can steal sensitive data. This includes passwords, credit card information, email information, and any other confidential information stored on your device.
- Permanent lock out from your device making future data access impossible without reinstalling the operating system. Worse yet, they may encrypt the data.
- Inevitably, they will charge exorbitant amounts to “fix” the problems that they just caused.
The pop up may sometimes lock up your browser and prevent you from closing the page. In this case, you can:
1. Press CTRL , ALT , and the DELETE keys on your keyboard.
2. Select ‘Task Manager’
3. You will see a list of running applications. Select the browser you are using and press the DELETE key, or click the ‘End Task’ button.