Validate with the sender. 2
If it’s a friend or colleague 3
that has sent you something 4
with a link or attachment that you didn't request, 5
then use a different medium to contact them 6
and validate that they sent it. 7
If it’s sent from a company, 8
like your bank or a social site, 9
you should contact them too if it’s possible 10
to confirm the legitimacy. 11
If it’s from a company or a person 12
you have no relationship with, then be immediately suspicious. 13
Check the domain name of the email address 14
that it has been sent from. 15
If it's not the domain of the company, 16
and it’s something like Hotmail or Gmail, 17
then it’s definitely fake. 18
Companies can afford their own domain names, 19
they don't need to use Yahoo, or Gmail, or Hotmail. 20
Copy the email contents 21
and past it into your favorite search engine. 22
But be careful not to click on any link. 23
If it’s a known attack, 24
it will be found by your \search engine, 25
if it’s an attack that’s been out for a few days. 26
If it’s a brand new attack, 27
it may not come up in the search engine results, 28
but here we can see phishing scam straight away, 29
and you will get that 30
for many of the phishing emails that you get, 31
because they are identified 32
by the security companies fairly quickly. 33
There’s often an option to view 34
the raw email and email headers 35
that you’ve received 36
depending on the email client that you’ve got, 37
so this is an option that isn't always available within webmail, 38
but if you do have it, 39
say it’s in Thunderbird, or mail for OS X, 40
then you can look at this, 41
you can examine the content 42
and see whether it matches what it’s claiming to be. 43
And to make that easier, 44
you can use this site, parsemail.org, 45
so copy this, paste it into here, 46
click this, after five minutes, Submit. 47
This here is just an example of an email that I’ve got, 48
this is actually a legitimate email. 49
So if this was from a company, like this is, 50
I can check out things like 51
its IP address where it come from, 52
the various domains, 53
and see whether that is actually 54
genuinely associated with that company. 55
You can do a search for the company name 56
and see if it has a legitimate internet presence, 57
see if it has their own site, 58
their own telephone numbers to call. 59
If not, it’s likely to be fake. 60
If they do have a website, 61
does it have a private listing in Whois? 62
You can go to any of the Whois services 63
and do a search for this, 64
but if you go for this one, 65
I’ve just picked an example here, blob.com, 66
do a search 67
and let's have a look at blob.com. 68
And we can see here that blob.com 69
is using a privacy protection service, 70
which mean it’s hiding who the owner is. 71
A private listing is okay 72
for a personal website or a blog 73
or an information only website. 74
If it is a private listing, 75
then this could be a sign that something is a bit off, 76
because mostly businesses that are selling something 77
will have non-private listings. 78
They should identify the company that owns the domain, 79
or the person that owns the domain. 80
Example being the BBC here. 81
So you can see 82
the full details of who owns the BBC, 83
the company, the address, the registered address, etc. 84
That’s the sort of information 85
you would want to see from a Whois result. 86
If you look here, you can also do a reverse IP address lookup. 87
So this is the IP address of the server 88
in relation to this domain name, blob.com. 89
If we do a reverse look upon it, 90
we can see what other domains 91
are associated with this IP address. 92
And we can see here, 93
it’s listed three and another 1.1 million other domains, 94
so that is extremely unusual. 95
But what you can do here is, 96
you can look to see whether 97
any of these other domains are suspicious. 98
So you could Google these domains as well 99
and that will be an indicator as to whether 100
the main domain that you had, 101
blob.com in this case, is a legitimate domain. 102
Also you can just 103
look at the general characteristics of the website, 104
does the site look like it’s been quickly put together? 105
Did the links on the website work? 106
And there unrelated photos or content? 107
Do the pictures, links and contents on the page match, 108
and the theme and purpose of the page and website 109
all go together? 110
Is the information vague or inaccurate 111
if they’re trying to sell you something? 112
You can determine if something’s cloned 113
by copying and pasting parts of the site 114
into your favorite search engine, 115
and see whether this site has been cloned. 116
Again, this gives you an indicator 117
as to whether or not it's some sort of scam. 118
Another warning sign is a redirect. 119
So if you typed in the URL, 120
or you clicked on the link 121
and then it forwards you to somewhere else, 122
that’s a sign of a scam as well. 123
You should validate any attachment 124
that is with the message, 125
so never download and run any file 126
you don't 100% trust, as I’ve said. 127
You can use total virus 128
to check if the attachment is a known malware 129
by forwarding the email to scan@virustotal.com. 130
Check out this link here, 131
follow the instructions that are on here, 132
and that’ll show you how you can forward your email 133
to Virus Total for it to be checked, 134
but essentially you can just forward, 135
send it to scan@virustotal.com and Send. 136
But read this to make sure 137
you’re doing the latest thing 138
that they’re requesting you to do. 139
This isn’t obviously a completely conclusive check, 140
as antiviruses are flawed, 141
they only know known viruses. 142
If it shows as clear, 143
it still can be malware, 144
and maybe custom malware for you, 145
or just very new malware, 146
but if it shows as infected, 147
then obviously it should be avoided. 148
What you see here 149
is a non-exhausted list of executable file types. 150
You should absolutely never ever run any of these, 151
unless you are 100% sure that you trust the source. 152
These are all programs, 153
so have the power to do anything 154
on your computer if you run them. 155
This is a list of the file extensions, 156
so this will be at the end of the files. 157
It will be file name .exe, .com, .vb. 158
And this is a list of document extensions 159
that also should be avoided. 160
These can contain executable macro viruses, 161
so you should be very careful when running these. 162
Excel, Word, Adobe, in particular, 163
can contain these viruses, 164
so be careful about running these. 165
These are some of the compression and file archive extensions. 166
These are often used to hide executables, 167
so be careful with these too, 168
as you might find executable files 169
within the archive, if you un-archive it. 170
And finally, these are a list 171
of what are probably safe extensions: 172
.txt, .gif, .jpg, 173
but it is possible that these could exploit a flaw 174
if the software you use to view them 175
has a vulnerability in it, but it’s quite unlikely. 176
And finally, we’ll finish off 177
with some of the obvious stuff. 178
It is obvious, but I’ve got to 179
say it anyway just to cover it. 180
If the requester asks for bank account information, 181
credit card numbers, 182
your mother’s maiden name or other personal information, 183
then obviously that is fake. 184
They’re not going to be sending you that 185
in an email or a message. 186
If they send something to you saying you’ve won a prize, 187
you have won the Nigerian lottery, 188
or a Prince has contacted you 189
and he wants to desperately send you money, 190
obviously these are all fakes. Ignore. 191
If it contains a lot of hype and exaggerations, 192
but few facts and details about costs, our obligations, 193
and how it actually works, 194
that’s a sign of a scam too. 195
If you are asked for a fee 196
for administration processing, 197
taxes to be paid in advance, 198
never provide money in advance of receiving anything. 199
This is the advanced fee scam. 200
Technical support will never ask you 201
for your username and password. That’s a scam. 202
Don't put USBs or CDs 203
into your computer you don't trust, 204
especially if you’ve found them on the floor. 205
Be suspicious of anything that seems to be 206
too good to be true, it probably is. 207
If you discover a scam email or link, 208
or phishing email, or spam, 209
forward the spam emails onto this email address here 210
to help stop spam. 211
If you received a bad email 212
that’s reportedly from a company, 213
you can send a copy of that email 214
to the company 215
in order to help them prevent the attack. 216
If you have a phishing email, 217
you can send it to this email here, 218
this is the anti phishing work group, 219
this will help fight phishing attacks. 220
On vishing and phone calls and phone cons, 221
one of the best ways to protect 222
against vishing attacks 223
is to have a way to confirm with whom you are speaking. 224
Do not provide any information to an unknown caller, 225
even if there is a caller id that looks legitimate, 226
because these can be fake. 227
With vishing and phone calls, 228
always have the caller validate their identity. 229
Ask for their name, 230
ask for their company name, ask for their title, 231
and phone number to call them back. 232
More advanced attackers will have 233
a legitimate number to call back, 234
so verify the company by searching the internet 235
and doing the various checks that we’ve already gone through. 236
Validate that their company 237
and everything associated with it is legitimate, 238
search online for everything that they’ve said 239
to validate who they are and what they are claiming. 240
When it comes to offline, 241
to reduce the risk of being a target 242
buy and use a paper shredder. 243
Anything with personal information \should be shredded, 244
don't carry a social security card with you, 245
and make sure you report 246
lost or stolen checks and credit cards immediately. 247
So these are the behavioral changes, 248
or perhaps these are not changes 249
for those of you who are already doing these things, 250
that can help mitigate against 251
social attacks like phishing, vishing, smishing, spam, scams and cons.