« November 2010 | Main | January 2011 »

December 2010

Friday, 10 December 2010

The Twelve Days of Phishmas 2010

Phishers are full of holiday spirit again in 2010. Some of the lyrics are changed from 2009 but the carolers are filling IRC channels with the merry sounds of Phishmas anew!

On the first day of Phishmas, a nice man texted me...

Western Union’s holding money for me!

On the second day of Phishmas, the IRS faxed me...

I am due a refund, and Western Union’s holding money for me!

On the third day of Phishmas, Chase Bank emailed me...

I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the fourth day of Phishmas, a casino emailed me...

Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the fifth day of Phishmas, a broker informed me

MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the sixth day of Phishmas, Nyamwasa wrote to me...

Help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the seventh day of Phishmas, a merchant offered me...

Cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me! 

On the eighth day of Phishmas, a hot chick sexted me...

I could last much longer, cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the ninth day of Phishmas, PayPal emailed me...

My account's been frozen, I could last much longer, cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me! 

On the tenth day of Phishmas, Koobface Facebooked me...

I am trapped in Paris, my account's been frozen, I could last much longer, cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the eleventh day of Phishmas, tweeted me...

Tweet for cash it’s easy, I am trapped in Paris, my account's been frozen, I could last much longer, cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

On the twelfth day of Phishmas, my BFFL ‘booked me...

Did you see these photos, Tweet for cash it’s easy, I am trapped in Paris, my account's been frozen, I could last much longer, cheap Tank Francaise, help me transfer millions, MY HOME’S BEEN SOLD! Three nights in Vegas, I am overdrawn, I am due a refund, and Western Union’s holding money for me!

As you can see from the lyrics, phishers exploit email, text, and all forms of social media. During this holiday season, please remember to Stop, think, connect.

Posted at 09:39 AM in Anti-Malware and Anti-phishing | | Comments (1)

Tuesday, 07 December 2010

Legal disclaimers in email messages

Legal disclaimers for email messages are appearing more frequently as organizations recognize the need to exercise control over corporate communications. I'm referring to the two kilobytes of legalese bloat appended to the tail of an email message that proclaims "this message is privileged and confidential!" and blather on, explaining that, if mis-delivered, the recipient should notify the sender, destroy the copy, keep whatever he might have read confidential, degauss the hard drive on which the copy was stored...

Being a long-time advocate of secure email, any time I read a legal disclaimer, I try not to laugh at the futility here, or at best, the misplaced notion of trust. Email is fundamentally like a post card. Postal handlers, the mail boy, or anyone who happens to see the post card as they pass by your office desk can read it.

David Steele, a colleague and attorney, made some helpful observations about attaching such disclaimers to the tail of your mail in a thread on a public list. David explains that the flaw in this practice is obvious. "...Putting disclaimers at the bottom of an email means that the reader has to read down the email to get to the part that says 'this is confidential and don't read it if you're not the intended recipient."

David's solution? "Whenever I send something that is really confidential, I put the notice at the top of the email, with the statement PRIVILEGED AND CONFIDENTIAL COMMUNICATION in all caps as well. I then add a bunch of blank lines to make sure the message is well below the notice. This, in my view, achieves the requirement of providing the notice before the information is read". This practice gives early notice and provides the reader with an opportunity to stop scrolling before reading the correspondence, but it doesn't alter the fact that the message has been disclosed to unintended recipients: for this, you need secure (encrypted) mail.

Many employees pay little attention to the details of a disclaimer policy. They were told to attach disclaimers to faxes and the "right for fax, right for email" logic has proven expedient for many organizations. Unfortunately, the tendency among employees is to attach the disclaimer to every message. I suspect this is because disclaimer policies are simply implemented badly: IT or employees configure mail clients to attach it to every message sent.

The carpet-bomb approach defeats the purpose of legal disclaimers. David Steele weighs in that, "if you use the notice on everything you send out, regardless of whether or not it is confidential, then the notice will become too diluted and have less or no effect when something that is confidential gets sent out to the wrong party." David's message is clear: use it judiciously.

We now have two elements of a best practice when applying legal disclaimers. If you choose to use a disclaimer, (1) place it  at the top of your messages and (2) apply it only when you are sending a message that merits this special consideration.

David offers this example of a disclaimer:

PRIVILEGED AND CONFIDENTIAL COMMUNICATION This e-mail transmission, and any documents, files or previous e-mail messages attached to it, may contain confidential information that is legally privileged. If you are not the intended recipient or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please: (1) immediately notify me by reply e-mail, or by collect telephone call; and (2) destroy the original transmission and its attachments without reading or saving in any manner.

If  you find this too stuffy and are enough of a counter-corporate culture creature, you could try this version:

This is email. Treat it like a Post Card. While the probability of intentional interception is low, anyone can read it during transit, anyone may have changed it along the way, or anyone may be impersonating me, the purported sender. You may not even be an intended recipient. If this mail or any attachment was delivered to you, and contained malicious code, it probably did *not* come from me, so please don't send me an email with the subject line "your email contained a worm".

I'll save a discussion on the challenge of attaching legal disclaimers to Tweets and instant messages for a future post.

Posted at 09:39 AM in Rants | | Comments (0)

« Previous | Next »
Find me on Mastodon and Facebook

Spotlight Posts

  • FTC's proposed Trade Regulation Rule on Impersonation of Government and Businesses is important for #infosec
    M3AAWG comments on the FTC's proposed rule Trade Regulation Rule on Impersonation of Government and Businesses is available. I was one of the contributors to the comment. In the comment, M3AAWG "suggests additional regulatory solutions and best practices to complement the goals of this rule, such as clarifying the scope of the rule to include the use of domain names in impersonation schemes and the use of technologies that enable impersonation" and the important role that Whois plays in investigating impersonation and fraud. Several reports that my Interisle colleagues and I published are cited in the comment, along with the...
  • Cybercrime Information Center reports sharp increases in phishing attacks, unique domains reported in August-October 2022 time period
    A recent ebb in domain names reported for phishing created some euphoria in the domain industry. With phishing activity, as with tides, ebbs are invariably followed by flows. In their August- October 2022 Quarterly Phishing Activity, the Cybercrime Information Center observed a 40% increase in phishing attacks and a nearly 20% increase in unique domain names reported for phishing.
  • Cybercrime Information Center's YouTube Channel
    My colleagues and I at Interisle have created a YouTube channel to complement the quarterly reporting and studies of cybercrime we host at the Cybercrime Information Center. Our goal is to share, in a few minutes, the findings and insights from our research in a format that's easily accessible and shareable, informative, and entertaining. The inaugural videos provide 2-5 minute summaries of our annual Phishing and Malware Landscape studies. We'll continue to produce videos of our annual studies. If you like what you see, leave us a comment.
  • Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices
    My colleagues at Interisle and I have published a study, Malware Landscape 2022: A Study of the Scope and Distribution of Malware. The study, which analyzed 2.5 million records of distinct malware events from May 2021 to April 2022 collected by the Cybercrime Information Center, explains what malware was most prevalent, where malware was served from, and what resources criminals used to pursue their attacks.
  • New TLDs are coming #Dangerclose.
    A Domain Name Wire post, Time to pay attention to the next round of new TLDs, begins with an ominous: They’re coming. Eventually. While not as dramatic or enduring as Arnold Schwarzenegger's "I'll be back", the reporter cites policy activity at ICANN as evidence that new TLDs are coming. Eventually. In a September 2019 post, and in response to the ICANN memorandum, Readiness to Support Future Rounds of New gTLDs, I asked, Has enough been done to study and rectify the concentration of security threats in the new TLD space? In that post, I quoted correspondence from ICANN's security advisory...

Search

My Photo

Categories