Richard Craig – EngD Systems Thinking in Cyberdefence

Often you can just tell from the subject title whether its spam;

• It’s not your bank. Unsubscribe from any email or notifications your bank might send to you. Never click on any link within an email to ‘take you to your login’, assume this to be a phising exercise to get your details – In the words of the  X Files: ‘Trust No One’. Make sure you can delete all banking/financial emails without issue and type your bank url into the address bar (or save shortcut link in bookmarks) when you want to do some online banking.
• Don’t open paypal notifications. If you get an email from paypal letting you now about that money transfer that you know nothing about, don’t open it, just delete it and visit the site to check if you’re that worried. When I have actually transfered money and expect an email notification – I still delete it when it comes.
• You didn’t sign up to this . Often the trick is to get you to click ‘unsubscribe’ to first check that your email is valid and second to get you to visit an infected website. Just delete the email, mark as spam so your filter will catch it next time and don’t provide any acknowledgement to the sender.
• You don’t know them. Why open any email from someone you don’t know? Why waste your time? Ok, in a business environment you’re going to get such emails, but you can still apply some common sense when the subject is ‘i am waiting for your respond‘.
• Delivery failure of that package I didn’t order? .Didn’t order a package? Then the email is probably betting on your curiosity, you’ll open it and get infected. Don’t we learn anything from the history of cats?

So when I actually take the time to take a look at some of the spam that has come in, I find the following messages popping up;

Viruses found in a linked image.
Viruses found in the attached files.

SN_122010.zip: Trojan horse PSW.Generic8.ALOK.

I’m not paraniod, all my email is infected!