Selected Newsletter

News | Diary | Newsletter | Newsletter Archive | Seminars

1 May 2004

Viruses, spam, phishing and other nasties

Dear MirandaNet members,

 

You will all know me as your friendly web editor – always here to help.  Well this time I thought I’d share a moan with you. Currently I receive at least three spam or virus messages to every genuine email message. Sometimes it’s worse. One day recently I received a stream of over 100 virus messages one after the other. I felt I was under attack. If things get any worse, email is in danger of becoming a thing of the past.

 

What can the individual do? Quite a lot, actually, provided the individual acts with lots of others. Hence this message.

 

Let’s start with the viruses. We all need to make sure that our machines trap virus messages on the way in, and also on the way out. A good anti-virus program will do this automatically, provided we keep the data files up to date. If your AV program doesn’t update automatically, why not make it your daily task to check for updates, before opening your email program?

 

The hoax virus seems to be a rare commodity these days, but do watch out for them – those messages from well-meaning people sent to everyone in their email box telling you to remove part of the operating system, or something. The MirandaNet notice board has an automatically updated list of viruses and hoaxes.

 

Another thing to remember with viruses is that all the current ones doing the round have ‘spoofed’ From: addresses, so if you receive a virus from someone you know, there’s more than a good chance that it isn’t actually from them. I have apparently sent myself several, and I have received messages from all over the world, some of them automatically generated by anti-virus software, telling me that my ‘Such and such’ message contained a virus, sometimes even zipping up the virus and sending it back, sometimes with a polite request for me to clean the message and resend it. Needless to say, I didn’t send any of these messages. Responding to a virus message only increases the traffic on the web, and increases the chances of the virus being propagated further if you send it back.

 

This point was brought home to me with quite a jolt today, when our beloved Basia sent me a virus message. The Basia Korczak award is for good ICT practice in memory of Basia.  Whether or not you believe in an after-life, this is taking matters too far. I can assure you I was mightily upset (though I can imagine Basia having a chuckle about it). So it’s worth noting that the spoofing engine in these viruses can pick up bits of email addresses from wherever they find them and bolt them into messages.

 

This brings me to spam. There are several spam trapping programs, including free ones which work as well as the paid for ones. I have the free ‘Spambayes’ but this only works on Outlook – there are other programs for Outlook Express. It clears 99% of my spam messages and puts them into a spam folder. It has never wrongly binned a non-spam message, but it does put a few messages every so often into an ‘Unsure’ folder. Even so, most of the Unsure messages are spam too. NEVER respond to a spam message, never click on the ‘unsubscribe’ link which only confirms that your address is a good one – you’ll get more spam still if you respond.

 

Phishing? Sorry, but that’s the term for those nasty and increasingly sophisticated messages which look as though they are from your bank, asking you to divulge your PIN or password. I get lots of these, and the ones pretending to come from Halifax and MBNA look incredibly like the real thing. But they are NOT. Never click on these (but if you know how to view the source code of these messages you can have a look at where you would go if you did click on them). Never supply personal information in response to an unexpected email, and certainly no bank will ever ask for your password or PIN. People do fall for these ‘obvious’ traps, you know. There are also look-alike messages purporting to come from Microsoft with handy attachments for you to download … Microsoft NEVER send upgrades like this, so try not to fall for the trap.

 

Interested in phishing? There’s a very good site with a whole archive of the kind of messages that have been sent, so you can see what to look out for:

 

http://www.antiphishing.org

 

Finally – where do ‘they’ get our email addresses from for the spamming and virus attacks? From us, unfortunately. From when we inadvertently gave our email address to a spammer. Or from the contacts list in a virus-infested machine. Or harvested from web sites.

 

I have tried to ‘hide’ all the email addresses on the MirandaNet web site. Most are broken into pieces and reassembled via JavaScript routines when you open the page that contains them. Some only appear if you click on a link to generate the page. Spambots and address harvesters haven’t learnt how to do this yet. However, I want to cut down further the possibilities that our web site is a mine for spammers, and will look at ways of cutting out email addresses further. Unfortunately, this goes against everything that the web is about – you know, ‘Click here to contact me’ – but we need to fight back.

 

You can see how ‘visible’ you are by typing your email address into say Google and see where it comes up. If your address is visible to the world on any page of MirandaNet and you want me to remove or hide it, please get in touch. Try it in the MirandaNet search engine too. I might have overlooked something.

 

If you have any other useful pointers put them out on Mirandalink.

Best wishes

Francis

MirandaNet Web Editor

[Back to the top]

[Back]