Continuing my series
on simple threat models for internet users, I'll now address the
second threat I mentioned: threats via e-mail.
There are two kinds of e-mail attacks: direct attacks, and trojan horses. First let's talk about direct attacks.
The basic idea behind a direct e-mail attack is that the program you use to read your e-mail might have flaws in it, which a specially-crafted message will exploit. That message will have a program in it, and a mistake by the programmers who wrote your e-mail client will cause that program to be executed.
Unlike attacks from the outside, which you can very simply protect against by denying outside attackers access to your computer entirely, there is no fool-proof method to protect against this kind of threat. E-mail formats are highly complex, and messages can contain multiple parts, including images, etc. The code that decodes images is notoriously prone to security problems. Even e-mail programs which don't process images are occasionally prone to security problems dealing with the structure of certain messages.
Chances are that you are going to want to read e-mail somewhere, and you probably want to be able to see images and download attachments; shutting off e-mail completely isn't really an option. The more general advice I gave against the first threat still applies, though: keep all your software up to date, including your e-mail client. People who make e-mail software take these kinds of threats very seriously and release updates very quickly when problems are discovered.
One way you can mitigate this risk, and reduce the amount of work required to keep up to date (and therefore the opportunity for you to forget to do so) is to use a web-based e-mail client like GMail. If you use GMail, the potentially vulnerable program running on your computer is just your web browser, and you already need to keep your browser up to date for other reasons. The code which deals with the structure of messages is all run on the server, and constantly kept up to date by the fine folks at Google. Similarly, they take steps to protect your browser; stripping out harmful attachments and filtering spam for you so that potentially dangerous messages never reach you.
The much more common form of e-mail attack is easier to defend against, but is attacking something more potentially vulnerable than your e-mail software: it's attacking you. A trojan horse is a program which doesn't do anything tricky to get itself run automatically, but instead elicits your cooperation in making it run. Whether you run a web-based email client or the oldest, buggiest version of Microsoft Outlook, you are equally vulnerable to these kinds of attacks.
The key to defending yourself against a trojan horse is to understand what you are double-clicking on. Look inside that trojan horse before you open it; there may be a bunch of armed greeks inside. Before you open any document or run any program that was attached to an e-mail, very carefully read the message that it came from. Ask yourself a few questions:
In using the Internet, this is a generally useful skill, and particularly important when it comes to security. It will be particularly useful when I discuss threat #4, phishing attacks.
There are two kinds of e-mail attacks: direct attacks, and trojan horses. First let's talk about direct attacks.
The basic idea behind a direct e-mail attack is that the program you use to read your e-mail might have flaws in it, which a specially-crafted message will exploit. That message will have a program in it, and a mistake by the programmers who wrote your e-mail client will cause that program to be executed.
Unlike attacks from the outside, which you can very simply protect against by denying outside attackers access to your computer entirely, there is no fool-proof method to protect against this kind of threat. E-mail formats are highly complex, and messages can contain multiple parts, including images, etc. The code that decodes images is notoriously prone to security problems. Even e-mail programs which don't process images are occasionally prone to security problems dealing with the structure of certain messages.
Chances are that you are going to want to read e-mail somewhere, and you probably want to be able to see images and download attachments; shutting off e-mail completely isn't really an option. The more general advice I gave against the first threat still applies, though: keep all your software up to date, including your e-mail client. People who make e-mail software take these kinds of threats very seriously and release updates very quickly when problems are discovered.
One way you can mitigate this risk, and reduce the amount of work required to keep up to date (and therefore the opportunity for you to forget to do so) is to use a web-based e-mail client like GMail. If you use GMail, the potentially vulnerable program running on your computer is just your web browser, and you already need to keep your browser up to date for other reasons. The code which deals with the structure of messages is all run on the server, and constantly kept up to date by the fine folks at Google. Similarly, they take steps to protect your browser; stripping out harmful attachments and filtering spam for you so that potentially dangerous messages never reach you.
The much more common form of e-mail attack is easier to defend against, but is attacking something more potentially vulnerable than your e-mail software: it's attacking you. A trojan horse is a program which doesn't do anything tricky to get itself run automatically, but instead elicits your cooperation in making it run. Whether you run a web-based email client or the oldest, buggiest version of Microsoft Outlook, you are equally vulnerable to these kinds of attacks.
The key to defending yourself against a trojan horse is to understand what you are double-clicking on. Look inside that trojan horse before you open it; there may be a bunch of armed greeks inside. Before you open any document or run any program that was attached to an e-mail, very carefully read the message that it came from. Ask yourself a few questions:
- Were you expecting this message?
If you weren't expecting the message, you should double-check to make sure. In the best case, use some mechanism other than e-mail to check. Give the sender a phone call. Ask if they actually sent you the message in question. - Is the message really from who it says it's from?
It's very easy to fake e-mail addresses, so if you are used to receiving messages from Bob Dobbs and you see "From: Bob Dobbs <bobdobbs@example.com>", you shouldn't necessarily believe it. Does the text of the message read like Bob wrote it? Does Bob usually send you these kinds of attachments? Is the "To" line correct? Does he use your real name? A lot of spam which includes viruses is very generic, but it is increasingly cleverly disguised as coming from people in your addressbook. - Is an attachment trying to disguise itself?
Sometimes, even messages you are expecting, from people that you know, will contain evil attachments. If Bob's computer is infected with a virus, he may well have actually legitimately written you the message but a trojan horse packed itself along for the ride. In this case, you need to see if the attachment is trying to look like something different than it is. Does the file's name have multiple extensions? For example, "business-plan.doc" is a Word document, but "business-plan.doc.exe" is an executable program, with its name changed to pretend to be a Word document to fool you. - Is anything trying to warn you?
Most browsers and operating systems these days will double-check with you before opening executables which you've downloaded. If a box pops up saying "Are you sure you want to do that?", don't just click past it immediately; read it completely and try to understand what it's telling you. Even if you don't understand a word, pausing for a moment to reflect on whether the warning is serious or not will often help you realize that something might be amiss.
In using the Internet, this is a generally useful skill, and particularly important when it comes to security. It will be particularly useful when I discuss threat #4, phishing attacks.