|
The dark side of spam
by David Kelleher
Few will argue that spam is not a nuisance. Deleting useless and boring emails from unknown sources selling everything from medicines to software and promising us undreamed-of wealth, pleasure and beauty, has become an acceptable chore for anyone with an email account.
The use of spam filters is commonplace today as companies do their best to keep their mailboxes free of junk mail. For many, the battle is won and the few that escape the filters are no longer of concern.
Unfortunately, spammers are technically savvy individuals who have the means, backup and resources to stay ahead of the good guys. Over the past two years, spammers and spam filter developers have been equally matched, but seeing their inability to beat the technology all the time, spammers have targeted the weakest link in the chain: human nature.
Humans are gullible and inquisitive and spammers are taking full advantage. Instead of pushing products which are easily caught by spam filters, they are using near-genuine emails to usurp information and play on the individual’s ‘fear’ of anything ‘legal’.
A case in point. Over 2,000 C-level executives in the US recently fell for an email scam that informed executives that they had been sued in federal court and must click on a Web link to download court documents.
Concerned executives did just that and were taken to a phony website where they had to install browser plug-in software to view the documents. That software enabled the criminals to access the victim’s computer. Simple, effective and dangerous.
The target group was small; the text void of familiar keywords and the email was credible. And people did as they were told.
Dealing with spam requires a three-pronged approach. The first two are obvious: install anti-spam and anti-phishing software as well as anti-virus engines to check all web downloads, including viruses on websites that spam emails point to.
The third is education. End-users need to be told (and regularly reminded) NOT to open any emails that look suspicious. Even if they appear genuine, federal agencies and official bodies never use email to notify people of pending legal action, but an official letter in the post.
On a wider scale, companies, banks and online retailers never ask their clients for confidential data via email no matter what the email says. If the email looks real, people should check with their bank or the company sending the email to verify. And never click on links in suspicious emails. If it’s too good to be true, it’s usually fake.
Easy to follow and free advice. But how many are actually listening? Over 2,000 US executives did not. Are your employees listening?
The writer is a Communications and Research Analyst at GFI, a leading US based developer of network security, content security and messaging solutions
Published on: Saturday, 30th August, 2008
|
