This web page contains information about hoaxes, chain letters and phishing scams on the Internet.
What are Email Scams?
How to Recognize a Hoax
How to Recognize a Chain Letter
How to Recognize a Phishing Scam
Validating a Warning
What To Do When You Receive a Suspected Hoax
Recent Examples Sent to TAMU
What Are Email Scams?
Internet hoaxes and chain letters are e-mail messages written with one purpose; to be sent to everyone you know. The messages they contain are usually untrue. A few of the sympathy messages do describe a real situation but that situation was resolved years ago so the message is not valid and has not been valid for many years. Hoax messages try to get you to pass them on to everyone you know using several different methods of social engineering. Most of the hoax messages play on your need to help other people. Who wouldn't want to warn their friends about some terrible virus that is destroying people's systems? Or, how could you not want to help this poor little girl who is about to die from cancer? It is hard to say no to these messages when you first see them, though after a few thousand have passed through your mail box you (hopefully) delete them without even looking.
Chain letters are lumped in with the hoax messages because they have the same purpose as the hoax messages but use a slightly different method of coercing you into passing them on to everyone you know. Chain letters, like their printed ancestors, generally offer luck or money if you send them on. They play on your fear of bad luck and the realization that it is almost trivial for you to send them on. The chain letters that deal in money play on people's greed and are illegal no matter what they say in the letter.
Phishing is an email scam that relies on a combination of fraudulent messages and spoofed websites to deceive people into divulging personal or financial information. Typically, phishers send an email message made to appear as though it came from a legitimate bank or other business. They do this by spoofing brand names and logos. The message usually contains a link leading to a malicious website where the visitor is prompted to type in sensitive information. Many people get scammed because they can't tell the difference between legitimate websites and ones created by phishers to mimic legitimate websites.
How to Recognize a Hoax
Probably the first thing you should notice about a warning is the request to "send this to everyone you know" or some variant of that statement. This should raise a red flag that the warning is probably a hoax. No real warning message from a credible source will tell you to send this to everyone you know.
Next, look at what makes a successful hoax. There are two known factors that make a successful hoax, they are:
- (1) technical sounding language.
- (2) credibility by association.
If the warning uses the proper technical jargon, most individuals, including technologically savvy individuals, tend to believe the warning is real. For example, the Good Times hoax says that "...if the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop which can severely damage the processor...". The first time you read this, it sounds like it might be something real. With a little research, you find that there is no such thing as an nth-complexity infinite binary loop and that processors are designed to run loops for weeks at a time without damage.
When we say credibility by association we are referring to who sent the warning. If the janitor at a large technological organization sends a warning to someone outside of that organization, people on the outside tend to believe the warning because the company should know about those things. Even though the person sending the warning may not have a clue what he is talking about, the prestige of the company backs the warning, making it appear real. If a manager at the company sends the warning, the message is doubly backed by the company's and the manager's reputations.
Both of these items make it very difficult to claim a warning is a hoax so you must do your homework to see if the claims are real and if the person sending out the warning is a real person and is someone who would know what they are talking about. You do need to be a little careful verifying the person as the apparent author may be a real person who has nothing to do with the hoax. If thousands of people start sending them mail asking if the message is real, that essentially constitutes an unintentional denial of service attack on that person. Check the person's web site or the person's company web site to see if the hoax has been responded to there. Check the links below for hoaxes to see if we have already declared the warning a hoax.
Hoax messages can follow the same pattern as a chain letter (see below).
How to Recognize a Chain Letter
Chain letters and most hoax messages all have a similar pattern. From the older printed letters to the newer electronic kind, they all have three recognizable parts:
- A hook.
- A threat.
- A request.
The Hook
First, there is a hook, to catch your interest and get you to read the rest of the letter. Hooks used to be "Make Money Fast" or "Get Rich" or similar statements related to making money for little or no work. Electronic chain letters also use the "free money" type of hooks, but have added hooks like "Danger!" and "Virus Alert" or "A Little Girl Is Dying". These tie into our fear for the survival of our computers or into our sympathy for some poor unfortunate person.
The Threat
When you are hooked, you read on to the threat. Most threats used to warn you about the terrible things that will happen if you do not maintain the chain. However, others play on greed or sympathy to get you to pass the letter on. The threat often contains official or technical sounding language to get you to believe it is real.
The Request
Finally, the request. Some older chain letters ask you to mail a dollar to the top ten names on the letter and then pass it on. The electronic ones simply admonish you to "Distribute this letter to as many people as possible." They never mention clogging the Internet or the fact that the message is a fake, they only want you to pass it on to others.
Chain letters usually do not have the name and contact information of the original sender so it is impossible to check on its authenticity. Legitimate warnings and solicitations will always have complete contact information from the person sending the message and will often be signed with a cryptographic signature, such as PGP to assure its authenticity. Many of the newer chain letters do have a person's name and contact information but that person either does not really exist or does exist but does not have anything to do with the hoax message. As mentioned in the previous section, try to use other means than contacting the person directly to find out if the message is a hoax. Try the person's web page, the person's company web page, or this and other hoax sites first to see if the message has already been declared a hoax.
For example, the PENPAL GREETINGS! hoax shown below appears to be an attempt to kill an e-mail chain letter. This chain letter is a hoax because reading a text e-mail message does not execute a virus nor does it execute any attachments; therefore the Trojan horse must be self starting. Aside from the fact that a program cannot start itself, the Trojan horse would have to know about every different kind of e-mail program to be able to forward copies of itself to other people. We have had to modify this statement slightly for the newer html mail readers. If a mail message is formatted with html and contains scripts, those scripts will run when the e-mail message is read. Active scripting should always be turned off for a mail reader so that malicious code like the KAK worm cannot automatically run.
Notice the three parts of a chain letter, which are easy to identify in this example.
The Hook
FYI!
Subject: Virus Alert
Importance: High
If anyone receives mail entitled: PENPAL GREETINGS! please delete it WITHOUT
reading it. Below is a little explanation of the message, and what it would
do to your PC if you were to read the message. If you have any questions or
concerns please contact SAF-IA Info Office on 697-5059.
The Threat
This is a warning for all internet users - there is a dangerous virus propogating across the internet through an e-mail message entitled "PENPAL GREETINGS!". DO NOT DOWNLOAD ANY MESSAGE ENTITLED "PENPAL GREETINGS!" This message appears to be a friendly letter asking you if you are interested in a penpal, but by the time you read this letter, it is too late. The "trojan horse" virus will have already infected the boot sector of your hard drive, destroying all of the data present. It is a self-replicating virus, and once the message is read, it will AUTOMATICALLY forward itself to anyone who's e-mail address is present in YOUR mailbox! This virus will DESTROY your hard drive, and holds the potential to DESTROY the hard drive of anyone whose mail is in your inbox, and who's mail is in their inbox, and so on. If this virus remains unchecked, it has the potential to do a great deal of DAMAGE to computer networks worldwide!!!! Please, delete the message entitled "PENPAL GREETINGS!" as soon as you see it!
The Request
And pass this message along to all of your friends and relatives, and the other readers of the newsgroups and mailing lists which you are on, so that they are not hurt by this dangerous virus!!!!
How to Recognize a Phishing Scam
Signs of potential phishing scam:
- An email with an urgent sounding subject line.
For example, "account update needed," “unauthorized account,” or “security update!” Phishers rely on the fact that people under pressure make hasty decisions and often do things they normally wouldn't do. So don't give in to emails requesting immediate action (e.g., those claiming you need to “act now!”). Think twice before acting on emails requesting immediate action. - An email that addresses you by a generic denomination.
Watch for nonspecific phrases, such as “Dear valued eBay member.” How valuable are you to them if they don't even know your name? - An email stating something is wrong, such as claims of lost or "flushed" information.
Don't fall for it. Most, if not all, companies have back-up policies so that their information is never entirely lost. - An email asking for sensitive information, or information the sender should already have.
This should be a red flag. Legitimate companies normally don't ask for personal information by email, especially if it's information they should already have. If you receive an email like this, do not respond to the original email or by the contact information presented in the message. Look up the number yourself and call to verify the email request. - The email encourages you to click on a link in the message, which leads to a login screen or form where you're required to input sensitive information.
DON'T follow any link within the email. It could lead to a malicious website where keystroke loggers are waiting to capture your information. - A website or email address with a different domain name than what you are used to seeing.
For example, paypal-billing.net instead of PayPal.com. Phishers can easily spoof email headers, email return address lines, and URLs, so pay attention to detail. - A web form that isn't secure.
Never send sensitive information over the Internet before checking to see if the website is secure. To do this, manually type in the URL (do not cut & paste the address), and navigate to the website. The site is secure if a closed lock appears in the bottom right corner of your browser, or "https" appears in the URL.
Many of the signs listed above are evident in this example:
From: security-service@alliantcreditunion.org To: undisclosed recipient @null Subject: Alliant Credit Union® Online Update Sent: Wed 11/2/2005 7:36 AM Dear Alliant Credit Union Customer, This is your official notification from Alliant Credit Union that the service(s) listed below will be deactivated and deleted if not renewed immediately. Previous notifications have been sent to the AccessOnline Contact assigned to this account. As the Primary Contact, you must renew the service(s) listed below or it will be deactivated and deleted. Renew now! SERVICE : Alliant Credit Union AccessOnline® with Bill Payment. EXPIRATION: November 4th, 2005 Thank you, Alliant Credit Union Online Banking Support, N.A. ***************************************************************************** IMPORTANT CUSTOMER SUPPORT INFORMATION ***************************************************************************** Please do not reply to this message. For any inquiries, contact Customer Service. Document Reference: (92051208). Alliant Credit Union, N.A. Member FDIC. Equal Housing Lender. Copyright © 2005 Alliant Credit Union, N.A. All rights reserved.
Validating a Warning
ITIM recommends that you DO NOT circulate warnings without first checking with an authoritative source. Authoritative sources are:
- Your computer system security administrator, or
- The CIS Information Technology Issues Management (securityoffice@tamu.edu).
Real warnings about viruses and other network problems are issued by computer security response teams (such as CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by the sending team using PGP. If you download a warning from a team's web site or validate the PGP signature, you can usually be assured that the warning is real. Warnings without the name of the person sending the original notice, or warnings with names, addresses and phone numbers that do not actually exist are probably hoaxes. Warnings about new malicious code are also available at the antivirus vendors' sites and at the operating system's vendor site.
What to Do When You Receive a Suspected Hoax
Upon receiving a warning, you should examine its PGP signature to see that it is from a real response team or antivirus organization. To do so, you will need a copy of the PGP software and the public signature of the team that sent the message. The CIAC signature is available at the CIAC home page: http://ciac.llnl.gov/. You can find the addresses of other response teams by connecting to the FIRST web page at: http://www.first.org. If there is no PGP signature, check at this and other hoax sites to see if the warning has already been declared as a hoax. If you do not find the warning at the hoax sites, it just may mean that we have not yet seen this particular hoax. See if the warning includes the name of the person submitting the original warning.
If it does, see if you can determine if the person really exists. If they do, don't send them an e-mail message. It is likely that they have nothing to do with this hoax and thousands of people sending them questions will be just as damaging to them as sending around the hoax message. Instead, check their personal or company web site. Often if a person has been the brunt of a hoax, that hoax message will be debunked on the person's company web site. If you still cannot determine if a message is real or a hoax, send it to your computer security manager, your ISP, or your incident response team and let them validate it. To report phishing emails, go to www.antiphishing.org.
When in Doubt, Don't Send It Out.
In addition, most anti-virus companies have a web page containing information about most known viruses and hoaxes. You can also call or check the web site of the company that produces the product that is supposed to contain the virus. Other useful virus and hoax sites are listed below.