Information Security Tips from Westfield Insurance

How to spot an email scam

PC World magazine put together a short tutorial on recognizing eleven common email scams. Each page includes an actual example, most culled from recent messages being sent out by the notorious Storm Warn gang, a group of hackers based out of Germany who not only run the scams themselves, but also sell their hacker toolkits to others.

Some of the scams seem pretty obvious (like number 10, the IRS scam) but others are very sophisticated in their tactics such as number 9 where the hacker is impersonating an indignant eBay customer accusing you of not responding to his question or number 11 where the hacker took the time to personalize the attack based on the victim's alumni listing.

Number 5, the NFL stat-tracking software, is particularly effective because the webpage is so professionally done. And there really are some good free software programs out there. (Well, not completely free since they're ad-supported but for an avid fan a few ads might not be too much to pay.) The problem is that there are a few very dangerous landmines hidden among the legitimate tools. Short of completely rewriting the code yourself, there is no way to tell the safe ones from the scams.

Never download "free" software unless you are completely sure of the reliability of the source and never load any software onto your work computer yourself. Always call your IT department.

Security of hosted email – the last mile

If you have your own datacenter and have a dedicated IT staff that runs your own email system, you can skip this week's Tip. If you use webmail (such as Gmail, Hotmail or Yahoo mail) or if you use an email service (such as XO Communications or AppRiver), you are using hosted mail (that is, someone other than your own IT people has a copy of your email on their servers and manages your email for you) and you may need to think about how to keep your emails safe between your computer and the host.

Hosted mail can be a very useful service. It lets individuals and small companies buy top-quality email services without needing a full data center and 24 hour support staff. (Personal webmail accounts can also be useful for keeping personal and professional messages separate. See the 27 Jan 2007 Tip for more.)

However, hosted email adds a layer of complexity to your security arrangements. When your email system is completely in-house, you can trust your perimeter defenses to protect messages from one employee to another even if the message itself is not encrypted. When you use hosted email, the message is leaving your perimeter before it gets back to your co-worker. Since standard email is not encrypted, that message could be intercepted and read by basically anyone during that period while it's outside your perimeter.

The same applies when emailing outsiders. More and more companies are implementing secure email in order to protect messages with confidential content. Many of those systems use Transport Layer Security (TLS) which scrambles the message while it's moving from the sender's email system to the recipient's email server but does not protect the message between the recipient's email server and his/her desktop. That leg is a responsibility of the recipient.

While it is dangerous to generalize from just a few examples, all the email services that I've talked to have some way to secure that last mile from their email server to your desktop. XO Communications, for example, has detailed instructions on their webpage explaining the settings and port numbers that you have to set up on each desktop in order to connect to them securely. AppRiver has instructions for how to use the capabilities built into MS Outlook to protect the connection.

Unfortunately, the connection for the users of webmail is harder to make secure. Gmail claims on their website that encryption is available but a number of requests for help on their discussion groups have gone unanswered. Yahoo has yet to return our request for information.

If you can set up that last mile securely, you need to do so. If you can't, be very sure that you do not use email to send or receive any confidential information such as SSNs or Drivers License numbers.

Use bcc: for large email distributions

Have you ever replied to an email message only to realize too late that you just sent your reply to the entire department? Or worse, to the entire company? Reply to All should be used only when you are sure that every recipient on the list really wants and needs to read your reply.

Unfortunately, accidentally hitting Reply to All is an easy mistake to make.

If you are the sender of the original message, you can make life easier and safer for your readers if you use the bcc: field instead of the To: field in the email header. Bcc: stands for "blind carbon copy. Every user will receive the message but the recipient will see only his or her own name in the bcc: field. If a user accidentally hits the Reply to All button, the reply message will only be sent to the original sender.

As a matter of ettiquette, you should disclose the distribution list to your readers in the body of the message. This avoids any appearance of attempting to hide the distribution. A common convention is to use small italicized text in the first line with the text "sent bcc: to MidwestDivision".

Fathers Day card from the FTC

I normally tell people to avoid ecards like the plague. Once upon a time, they were fun and cute. Now, they are too often loaded with phishes and viruses. Very few ecard announcements are legitimate anymore.

That said, here is a Fathers Day ecard from the Federal Trade Commission on phishing and other information security tips. This is a great card. (And, yes, I will certify that it's legitimate. The music's a little hokey, though so you might want to turn down the volume before you play it.)

Take a few minutes to check it out and maybe forward the link on to someone who taught you how to stay safe.

www.ftc.gov/dad

Scareware - defined

Have you ever seen a "free" offer to scan your computer for security vulnerabilities? The most common one that I get is a pop-up ad that reads "Your computer may be infected with harmful spyware programs. Immediate removal may be required. To scan, click 'Yes' below." It looks like a great idea. You're offering to test my machine for free so I know what, if anything, needs fixing. Doctors, mechanics, even the lawn guy offers that kind of free screening as a legitimate way to build a relationship with new customers.

Unfortunately, most if not all of these computer scanning offers are scams. They are rogue programs that will always report something that needs to be fixed or cleaned whether the flaw is real or not. They are designed to scare you into believing that there is something terribly wrong with your computer that only their software can fix.

Examples that attack Windows computers include SpySheriff, WinFixer, IEDefender and Cleanator. Interestingly, Mac users ran into this problem for the first time in January with a product called MacSweeper. MacSweeper is so "thorough" that it even finds flaws when it's run against a PC – flaws that can only exist on a Mac.

Most of these are simple attempts to con you out of money or credit card numbers. Some are more malicious and will load spyware onto the computer or even disable your existing antivirus programs.

Never run software from unknown sources. If you do suspect that your computer may be vulnerable, use your own anti-virus and anti-spyware software. Don't trust that "free" offer.

Note: The word "scareware" also includes more harmless pranks such as the program that pops up and says "Erase everything on hard drive?" with two buttons labeled "OK" and "OK". (Nothing is actually deleted in this prank.) Just ignore those pranks.

A few more popup examples: