Brits lack email security awareness – says a Cisco report

by Michael Smith

British workers are the most likely to open dodgy-looking emails than any other developed nation except the Chinese, according to new research by Cisco on the habits of corporate workers.

I must say that this finding does come at no surprise to this writer as I have seen this happening but the Brits are not alone here, of that I am sure. There are also enough of them in the United States who will do that and also fall for the kind of spam like “pass this on to 100 of your friends or your PC will blow up” and stuff like that.

While only 25% of US workers, 23% of French workers and 28% of Japanese admitted opening suspicious emails, the figure in the UK rose to 45%. Only the Chinese, at 54%, showed a higher level of curiosity.

Maybe the Brits are a little more honest than the workers from other countries when they answered the questions.

But although the Brits like to see the message text, they are better disciplined when it comes to opening unsafe attachments or going to websites of dubious origin. Only 3% admitted doing so – far fewer than most other countries. In Japan, 14% opened attachments, followed by India (11%), China (8%), Germany (6%) and Australia (5%). Only 2% of US workers admitted opening attachments or suspicious URLs.

The problem is that not all URLs are suspicious looking, and that is the problem here. However, the advice should be not to open attachments or follow links unless we know who sent them and that they are safe. If need be check back with the supposed sender.

The Cisco research marks the second year the company has surveyed attitudes in 10 industrial countries, questioning 100 IT decision-makers and 100 remote workers (end-users) in each country.

The survey also found an increase in workers using their work computers for personal use, such as shopping. In the UK, 43% of respondents said their company had no objection to them doing so.

It seems also that the lines between work and home computers are blurring, with a greater proportion of remote workers using personal devices to access work files, and work devices to access personal files than they did in 2006. That trend seems to be strongest in China and the US.

Because of this blurring trend devices such as the MXI Secure Stealth MXP loaded with MojoPac Enterprise desktop environment are so important nowadays. People use their own PCs to connect to networks of their companies and organizations and could, inadvertently introduce the gods only know what into the system. A secure desktop on a USB drive is the answer here. But, I digressed.

There is some risky behaviour about. We have more remote workers, and we are blurring the lines between personal and corporate assets. And with Web 2.0, everyone has hopped on the bandwagon of socialising with people around the world.

A lot of people at work feel comfortable because they believe their PCs are locked down tightly. With the threat vectors changing, however, we need to take a look at how to tackle such threat. This means that users have to be trained properly and that proper procedures and devices must be used to make things as secure as possible.

Hackers from around the world starting to use stealth tactics to get into networks and steal intellectual property. Who wants to pay millions in research and development when they can just go and steal the information?

Often poor security procedures are allowing hackers to penetrate networks and once inside, they escalate their privileges to become basically an unpaid systems administrator. They then grab the corporate data and remove it very slowly piece by piece, so that no one even knows that they have been there.

Technology and procedures can only do so much. A cultural and behavioural change needs to imposed in the organisation so that people understand the implications as to their own vulnerabilities.

People have to be made aware of the potential repercussions of any mistake or a "moment's lack of thought".

For compliance purposes organisations also need to be able to show they provide users with adequate training and information, so that they can prove good practice in the event of a security breach.

© M Smith (Veshengro), September 2008
<>

Shady spammers getting more creative with links

Spammers Use Free Web Services to Shield Links

by Michael Smith

It is becoming more than obvious that the shady emailers have no intention of cutting back their malicious messages, so it is time to once again give a warning.

Take that “Chief Yussuf Osman of Nigeria” who is expecting an immediate answer by from you to get those millions he wants to share with you. By the way, no offense to any actual Yussuf Osman, chief or no chief, out there. So many people tend to fall for it and without knowing what they are clicking on, especially when using Microsoft's Internet Explorer of what ever number, and when they do so they tend to end up with a lovely little Trojan in their system which then turns their system into a bot in a botnet, sending out more and more spam.

Also the likes of Yahoo! Lotteries, which do not exist, asking for your personal dossier, as well as wire transfer requests to receive unclaimed fortunes, are dangerous, it could be even more important that people recognize the dangers of deceptive links in messages.

I am sure that many of the readers have often been warned about clicking links within unexpected emails. A common approach is to link you over to a spoofed login page to collect your password. In the beginning scammers didn’t worry much about what the link looked like but once people began looking more closely at the domain in the hyperlink the scammers started creating links that looked like they pointed to one place, but when you put your mouse over them you would see that the link actually directed you elsewhere. I personally, as and when possible, do a check on any email that I am not sure with by using the full headers.

In Outlook, Outlook Express, or similar client program, this can be called up by the use of a right-click of the mouse and then using the “properties” tabs. Here you can more often than not spot the danger by looking at the return path. If the return path for a supposedly official email from a company is to one joe.blogs@whatever.com then it should already be obvious that this is a spoof.

But theose guys get “better” every day. Malicious spammers are finding new ways to make their links look more legitimate. The latest trend is – drumroll - free web services. Yes. Those free storage facilities, the photo sharing and -storage services, and others.

One of the services, a photo-hosting site called ImageShack, lets people upload different types of photo formats, including Flash files.

Flash files, which have the extension “.swf”, can be used for animated graphics and can also be used to automatically redirect people to other Web sites. That feature can be abused.

The attack involving ImageShack works like this: Spammers upload a Flash file then copy the link for that file which comes from ImageShack's domain in a spam message. If the link is followed, the Flash file redirects the victim to a spam site.

The technique offers an advantage for spammers. Antispam software will often scan links in e-mail and block those e-mails with suspicious-looking ones. But ImageShack's domain is considered to have a good reputation, so messages won't be blocked.

Another more dangerous variation on this theme is a spam e-mail promoting a video.

If the link is clicked, a Flash file redirects the victim to a site where a pop-up window immediately implores the user to download a codec supposedly needed to play the video file. Invariably, the file isn't a codec but some piece of malicious software.

Even if the spam link in the e-mail appears to be OK, there are many other ways to tell if a message is spam.

A similar type of abuse has been made of Microsoft's Windows Live SkyDrive, which is an online file storage service.

The scenario is almost the same: The link is connected with a file on SkyDrive, but then the link performs an HTML redirect to a dodgy site. SkyDrive also allows Flash files to be uploaded, offering another possible way to attack.

Also remember that whenever an email directs you to a site (typically where you have an account and would need to login), you should instead visit the site via typical methods (bookmark, typing URL by hand, even a web search). If there is something significant going on with your account, whether at your email service, such as Yahoo Mail, or your bank, they will usually tell you when you login. If you feel that you absolutely HAVE to click on the link in an email you should examine it closely before clicking on it!

So, remember, it is a dangerous world out there, also ion cyberspace, and we need to have out wits about us. Do not open an email that you are not sure about, especially not it is has an attachment and do not click on links in email that you are not sure of. Also remember that the sender's address can be spoofed and they can even use the name of friends of yours. So, if in doubt, before ever opening the email send the sender, if know to you, e.g. a friend, colleague, member of the family, etc., an email asking for verification. It works and keeps you and your computer safe.

© M Smith (Veshengro), September 2008
<>