Validate with the sender.
If it’s a friend or colleague
that has sent you something
with a link or attachment that you didn't request,
then use a different medium to contact them
and validate that they sent it.
If it’s sent from a company,
like your bank or a social site,
you should contact them too if it’s possible
to confirm the legitimacy.
If it’s from a company or a person
you have no relationship with, then be immediately suspicious.
Check the domain name of the email address
that it has been sent from.
If it's not the domain of the company,
and it’s something like Hotmail or Gmail,
then it’s definitely fake.
Companies can afford their own domain names,
they don't need to use Yahoo, or Gmail, or Hotmail.
Copy the email contents
and past it into your favorite search engine.
But be careful not to click on any link.
If it’s a known attack,
it will be found by your \search engine,
if it’s an attack that’s been out for a few days.
If it’s a brand new attack,
it may not come up in the search engine results,
but here we can see phishing scam straight away,
and you will get that
for many of the phishing emails that you get,
because they are identified
by the security companies fairly quickly.
There’s often an option to view
the raw email and email headers
that you’ve received
depending on the email client that you’ve got,
so this is an option that isn't always available within webmail,
but if you do have it,
say it’s in Thunderbird, or mail for OS X,
then you can look at this,
you can examine the content
and see whether it matches what it’s claiming to be.
And to make that easier,
you can use this site, parsemail.org,
so copy this, paste it into here,
click this, after five minutes, Submit.
This here is just an example of an email that I’ve got,
this is actually a legitimate email.
So if this was from a company, like this is,
I can check out things like
its IP address where it come from,
the various domains,
and see whether that is actually
genuinely associated with that company.
You can do a search for the company name
and see if it has a legitimate internet presence,
see if it has their own site,
their own telephone numbers to call.
If not, it’s likely to be fake.
If they do have a website,
does it have a private listing in Whois?
You can go to any of the Whois services
and do a search for this,
but if you go for this one,
I’ve just picked an example here, blob.com,
do a search
and let's have a look at blob.com.
And we can see here that blob.com
is using a privacy protection service,
which mean it’s hiding who the owner is.
A private listing is okay
for a personal website or a blog
or an information only website.
If it is a private listing,
then this could be a sign that something is a bit off,
because mostly businesses that are selling something
will have non-private listings.
They should identify the company that owns the domain,
or the person that owns the domain.
Example being the BBC here.
So you can see
the full details of who owns the BBC,
the company, the address, the registered address, etc.
That’s the sort of information
you would want to see from a Whois result.
If you look here, you can also do a reverse IP address lookup.
So this is the IP address of the server
in relation to this domain name, blob.com.
If we do a reverse look upon it,
we can see what other domains
are associated with this IP address.
And we can see here,
it’s listed three and another 1.1 million other domains,
so that is extremely unusual.
But what you can do here is,
you can look to see whether
any of these other domains are suspicious.
So you could Google these domains as well
and that will be an indicator as to whether
the main domain that you had,
blob.com in this case, is a legitimate domain.
Also you can just
look at the general characteristics of the website,
does the site look like it’s been quickly put together?
Did the links on the website work?
And there unrelated photos or content?
Do the pictures, links and contents on the page match,
and the theme and purpose of the page and website
all go together?
Is the information vague or inaccurate
if they’re trying to sell you something?
You can determine if something’s cloned
by copying and pasting parts of the site
into your favorite search engine,
and see whether this site has been cloned.
Again, this gives you an indicator
as to whether or not it's some sort of scam.
Another warning sign is a redirect.
So if you typed in the URL,
or you clicked on the link
and then it forwards you to somewhere else,
that’s a sign of a scam as well.
You should validate any attachment
that is with the message,
so never download and run any file
you don't 100% trust, as I’ve said.
You can use total virus
to check if the attachment is a known malware
by forwarding the email to scan@virustotal.com.
Check out this link here,
follow the instructions that are on here,
and that’ll show you how you can forward your email
to Virus Total for it to be checked,
but essentially you can just forward,
send it to scan@virustotal.com and Send.
But read this to make sure
you’re doing the latest thing
that they’re requesting you to do.
This isn’t obviously a completely conclusive check,
as antiviruses are flawed,
they only know known viruses.
If it shows as clear,
it still can be malware,
and maybe custom malware for you,
or just very new malware,
but if it shows as infected,
then obviously it should be avoided.
What you see here
is a non-exhausted list of executable file types.
You should absolutely never ever run any of these,
unless you are 100% sure that you trust the source.
These are all programs,
so have the power to do anything
on your computer if you run them.
This is a list of the file extensions,
so this will be at the end of the files.
It will be file name .exe, .com, .vb.
And this is a list of document extensions
that also should be avoided.
These can contain executable macro viruses,
so you should be very careful when running these.
Excel, Word, Adobe, in particular,
can contain these viruses,
so be careful about running these.
These are some of the compression and file archive extensions.
These are often used to hide executables,
so be careful with these too,
as you might find executable files
within the archive, if you un-archive it.
And finally, these are a list
of what are probably safe extensions:
.txt, .gif, .jpg,
but it is possible that these could exploit a flaw
if the software you use to view them
has a vulnerability in it, but it’s quite unlikely.
And finally, we’ll finish off
with some of the obvious stuff.
It is obvious, but I’ve got to
say it anyway just to cover it.
If the requester asks for bank account information,
credit card numbers,
your mother’s maiden name or other personal information,
then obviously that is fake.
They’re not going to be sending you that
in an email or a message.
If they send something to you saying you’ve won a prize,
you have won the Nigerian lottery,
or a Prince has contacted you
and he wants to desperately send you money,
obviously these are all fakes. Ignore.
If it contains a lot of hype and exaggerations,
but few facts and details about costs, our obligations,
and how it actually works,
that’s a sign of a scam too.
If you are asked for a fee
for administration processing,
taxes to be paid in advance,
never provide money in advance of receiving anything.
This is the advanced fee scam.
Technical support will never ask you
for your username and password. That’s a scam.
Don't put USBs or CDs
into your computer you don't trust,
especially if you’ve found them on the floor.
Be suspicious of anything that seems to be
too good to be true, it probably is.
If you discover a scam email or link,
or phishing email, or spam,
forward the spam emails onto this email address here
to help stop spam.
If you received a bad email
that’s reportedly from a company,
you can send a copy of that email
to the company
in order to help them prevent the attack.
If you have a phishing email,
you can send it to this email here,
this is the anti phishing work group,
this will help fight phishing attacks.
On vishing and phone calls and phone cons,
one of the best ways to protect
against vishing attacks
is to have a way to confirm with whom you are speaking.
Do not provide any information to an unknown caller,
even if there is a caller id that looks legitimate,
because these can be fake.
With vishing and phone calls,
always have the caller validate their identity.
Ask for their name,
ask for their company name, ask for their title,
and phone number to call them back.
More advanced attackers will have
a legitimate number to call back,
so verify the company by searching the internet
and doing the various checks that we’ve already gone through.
Validate that their company
and everything associated with it is legitimate,
search online for everything that they’ve said
to validate who they are and what they are claiming.
When it comes to offline,
to reduce the risk of being a target
buy and use a paper shredder.
Anything with personal information \should be shredded,
don't carry a social security card with you,
and make sure you report
lost or stolen checks and credit cards immediately.
So these are the behavioral changes,
or perhaps these are not changes
for those of you who are already doing these things,
that can help mitigate against
social attacks like phishing, vishing, smishing, spam, scams and cons.