The Monthly “Steal” by David Steele

The Monthly “Steal” is a bit of relevant technology information intertwined with personal thoughts, opinions and some real life experiences. It is written by David “Steele” and is free, hence a “steal” from a “Steele”.

Over the last 2 months, Intrada has seen a huge increase in email scams designed to steal individual identity, access online accounts or control computers. In the IT industry, we call these Phishing Scams because they are fishing for information. It is largely known not to plug in any device or USB drive or insert a disk into your computer if you don’t know where it came from. But, phishing scams are delivered mainly through email, not by plugging in an external device. These email scams many times look harmless or even like legitimate emails. But, once you click on the attachment or the link in the URL, the scammers usually try to install malware, ransomware or other backdoor applications that cause loss in data and a violation of your privacy.

Phishing Scams are not new. Phishing was first recognized in the mid 1990’s by a hacker named Khan Smith. Smith used the arrow symbols <>< that resemble a fish and commonly used in online chat communications, making it hard for AOL to filter the communications. This same symbol is associated with Christians and was used as a secret Christian symbol long before Smith. Combine this symbol with stolen or hacked email accounts to see why most credit Smith with leading the phishing epidemic.

So how do you keep from getting caught by Phishing Scams? If you receive an email that you are not expecting or from a sender you do not recognize, it’s best not to open it. I suggest you think of it as junk mail and trash it.

But, maybe your curiosity lured you to open the email. Here are some additional ‘red flag’ checks:

Why doesn’t most virus protection software catch phishing scams? This is because the email does not actually contain a virus. The email contains a link to a website that tricks users into providing access information or to download and install an application to protect their computer. But, in reality, the person just infected their machine. Virus protection does not stop a user from loading software unless it is identified as malicious. Also, if the email has an attachment that is zipped; virus scanners can’t scan zipped files. Other attachments include Microsoft Word documents, that, when opened, require micros. When the user hits enable, the virus installs the malware that can infect the computer.

The latest lure in phishing scams is ransomware. The user is tricked into running a program or accessing a website that runs a program that will encrypt and lock all your data. The sender, who is usually in another country, holds your data hostage then requires a payment from you to purchase the password that will unencrypt your data. In a corporate setting, this can be a real sinker because it will normally encrypt all data across a corporate network, including network drives. When you have been a victim of ransomware, you are presented with two options:

1. Pay the ransom to get your password, which is not guaranteed, to unlock your files and reload the infected computer.
2. Reload the infected computer and restore files from backup.

Bottom line – it’s just ugly and nothing is worse than having your privacy violated or someone holding your personal data hostage. The best protection from phishing scams is:

1. Educating yourself and your staff to not be click happy.
2. Have good virus and spam filtering solutions in place to help prevent the temptation of hitting the inbox.
3. Backups.

If you are a customer of Intrada and received a questionable email, contact tech support and have emails and websites verified before opening or installing any software. If you would be interested in learning more about Intrada or our scanning services, give me a call or email me today.

User Notice Document - AVOID GETTING CAUGHT IN A PHISHING SCAM
Short version of article to be distributed to all employees. (click here)

David Steele, Partner / Webmaster

djsteele@intradatech.com
570-321-7370