Features

More often than not, though, the technical modus operandi falls into a predictable routine. Link manipulation is almost always used to create a link within an email that appears to belong to the supposed sending organisation. Most commonly, this manipulation will take the form of the inclusion of a subdomain such as www.hsbc.com.somewhere-else.com, or simply using HTML anchor text to state one domain while the underlying URL points to another. Both are enough to fool all but the most security-savvy user, as indeed is the use of a similar-sounding domain such as paypal-security.com instead of paypal.com, for instance.

Proposed initiatives such as RFC 4871 - which uses cryptography signatures to verify the domain identity of

ADVERTISEMENT

the sender - might help, but that depends upon future take-up. For now, you click on that fake link and end up at a fake website. Here you might find a simple piece of JavaScript altering the address bar by imposing an image of the real URL over the fake one, or opening a new address bar altogether. Although phishing messages and the websites they link to often look genuine, there are some tell-tale signs that should set off alarm bells; namely, "requests for confidential information via email, emotional language or urgent requests to respond, spelling mistakes, lack of personal greeting or customised information," according to a Webroot spokesperson. Legitimate emails from banks usually include partial account numbers, username or passwords.

Keep it real

Although it isn't always possible to prevent malware attacks, you can still take sensible precautions. Ensure your computer and network is protected by regularly updated security software, and that your applications and operating system remain free of "in the wild" vulnerabilities by setting Windows to Auto Update. Also, avoid the temptation to link-click anything and everything or open unsolicited attachments. Steer clear of the dodgy underbelly of the internet, and don't download freeware without checking its reputation first. Unfortunately, it's the last of these basics that lets too many of us down.