Information Security Tips from Westfield Insurance

Email spoofing

Have you ever received an error message about an email that you didn't send? Or wondered why someone from your own company's email address is sending you ads for Viagra or financial alerts for penny-stocks? Have you gotten a spam message from yourself? If so, you've just seen email spoofing in action.

Anything about an email can be edited or overwritten including the From, Return-Path, and Reply-To fields. Commands inserted into the header of the email can make the message appear to come from anyone, anywhere saying whatever the sender wants it to say. Spammers and other hackers know that their response rate is 10% higher if they can match the recipient's name – they rely on curiosity and trust to trick you into opening a malicious message. The trick is built right into the hacker tools that are used to generate mass-mailingworms and other malware.

If you think you received a spoofed message, simply delete it. Most email programs allow you to block future messages from that address but that approach is no longer effective at actually stopping spam. The problem is that blocking User1@spoofvictim.com still lets junk through from User2@spoofvictim.com, User3, etc. The odds that the spammer will pick the same victim next time are negligible. But if you ever do get a legitimate message from User1, you'll never see it. If there really is enough spam from one location to justify a black-listing, our spam-filter vendor will find it and include it in their master list. That fixes the problem not just for your email but for everyone else at the same time.

Do not send a complaint to the person that you think sent you the spam. If it was a spoof, they can't do anything about it anyway. If it was not a spoof, all you've done is confirm that you're the kind of person who opens spam messages. You'll get more spam, not less. You can, however, forward a copy to spam@uce.com, a department of the Federal Trade Commission which collects and reports on spam trends.

If you think that your address has been spoofed, delete that message too. Some virus writers are deliberately mimicking the email error messages in the hopes that you'll open the attachment "explaining the problem" and infect your computer with their program. If you don't remember sending the message, trust your memory. It's very likely a scam.

Active Content - defined

At some point, you've probably seen an error message pop up that "Active Content on this webpage has been blocked. Click here for options." Microsoft and the other browser makers give us these warning so we can try to make choices about what to trust on the web and what to avoid. Unfortunately, most average computer users don't know what "active content" is or how to decide what to trust. There are no easy answers for deciding who to trust but after reading this overview, you should have a little more idea of the risks you are taking.

Active content today comes in two basic flavors – web scripts like JavaScript or VBScript and programs such as Java or ActiveX. Both use code embedded in the webpage to help the webpage do something extra (like drop-down menus) or formatting of the page look better. While these scripts make the webpage more user-friendly, they can offer a way for hackers to get into your computer.

Web scripts are used on almost every web site now. These scripts let the web designer customize the look and feel of the site and are very easy to use. The script is written into the webpage and is executed by your browser. There are limits to what the script can do, making them mostly safe. Unfortunately, one of the ways they can be exploited is to redirect you from a legitimate web site to a look-alike malicious one that may download viruses or collect personal information.

Java and ActiveX controls are actual programs that are already on your computer or can be automatically downloaded into your browser. ActiveX can do anything on your computer that you can do. That's helpful if the web page is supposed to find and run a program for you but very dangerous if exploited by a hacker. Untrustworthy ActiveX controls can be used to load spyware, collect personal information, connect to other computers or do other damage. (If you're trying to load or update well-known software like Flash Player or Adobe Reader, it's probably okay. On the other hand, if the browser is trying to launch something like WeatherBug or MemoryMeter, SAY NO!) Java applets usually run in a more restricted environment and have less rights on your computer (and therefore can do less damage if exploited), but if that environment isn't secure, malicious Java applets may be used for attack as well.

In general, you should set your Internet Options to block ActiveX. For computers containing highly sensitive information, you should also consider disallowing Java and JavaScript. Only allow the content through if you are sure that you are at a trusted website. Recognize, however, that the added security may cause some features of the website to not function or to function improperly. Once you've verified the security of a site, you can designate it a "Trusted Site" and allow future active content from that site. And always keep your anti-virus, anti-spyware and firewalls running and your software fully patched.

based in part on CERT Cyber Security Tip ST04-012

Cyber-privacy

Online privacy is hard to achieve – and impossible when you don't think about it enough ahead of time. Anyone can see just about anything you ever wrote online. That includes webpages, blogs, discussion forums, social sites and email. Recruiters routinely check these sources before making hiring decisions. They are also increasingly popular with investigators. Anyone wanting to look into your background can find a wealth of information online.

There is little true anonymity on the internet. Some sites use passwords to limit the number of people who can access information but passwords are routinely compromised. Other sites allow you to use a pseudonym rather than edit under your real name. With a little bit of work (sometimes very little work), almost everything you wrote can be traced back to you.

Many believe that the vastness of the internet protects them. With millions of pages created every day, how would a hacker ever find my little blog or my email where I admit to some personal detail? In a paper-world, correlating all those sources was impossible. Now, we have powerful search engines and intelligent programs that can match details across multiple pages. They are incredible research tools and make the internet far more useful to all of us but they also can be used to create astonishingly complete profiles of you and your family.

None of it really goes away, either. Even if you removed the webpage, deleted your MySpace account and purged all your email, cached versions may still exist scattered all over the internet. Think twice about what you write and how you write it. Once you post something, you must forever live with the consequences.

When posting online, always assume that someone who you can't even guess at today will find and use the information. If you want the information to be private or restricted to a small group of people, the internet is probably not the best way to communicate. Remember too that even if you've never published anything online, you probably have a nephew or distant cousin who is working on a family history and including details about your life. Keeping your private details private takes work and vigilance.

Phishing for senior executives

Last week, Westfield's top executives were targeted with a very specific phishing email alleging to be from the Better Business Bureau. As you can see below, this phish uses the BBB's official logo and colors and follows the format and structure of a legitimate message. When the victim clicks on the "convenient" link in the message, it installs a trojan downloader onto the computer. The downloader then starts loading up the computer with keyloggers, back doors and other spyware. If not caught in time, the hacker will have complete control of the computers of the top executives of the company.

This was not a wide-spread spam attack. The phishers knew exactly who in the company would normally receive these kinds of complaints. They knew the correct names and email addresses of their targeted victims. They also spoofed the return address so the email appears to have come from someone at bbb.com – a registered alternate to their main address, bbb.org. This was a well-crafted phish.

Nevertheless, there are a few clues that this was a phish.

1. Float your mouse over the bold blue link in the message BUT DO NOT CLICK THE LINK. Look in the gray bar at bottom left of your computer screen and you should see the link's destination. In this case, the link goes to http://document-repository.com/redirect.htm?... The BBB's real website is bbb.org. While there are sometimes legitimate reasons for an organization to use an alternate internet domain, it is more often illegitimate. If you see a mismatch, be very suspicious.
2. The case number in the subject line does not match the case number in the body of the message. The odds are that the "case number" in the subject line is a code used by the hacker to see which messages were successful and which were blocked.
3. The date of the complaint is 14 May 2007 but the message was sent in late August. Even the BBB isn't that slow.

If you are an executive or work in close support to an executive, recognize that you are a special target. Hackers know that you have exactly the kind of access and permissions that they most want to target. They believe that you don't have a lot of time to stay current on technological threats. And they know exactly who you are - with all the automated databases and executive listings, there is no anonymity. Hackers (or anyone else) can by listings with your name, title and email address. See here for an example. And yes, this company requires you to sign a written statement promising to abide by the CAN-SPAM law but the kind of person who will steal credit card numbers, fraudulently register internet domains and send out a phish is probably willing to forge a signature on their form.

Always be suspicious of any unsolicited email asking you for information or to follow a link. Double-check the link before clicking it and never disable your anti-virus and anti-spyware protections.