Seven Signs of phishing to watch out for. Hi, everyone.
Leo Notenboom here for askleo.com.
Ask Leo is brought to you free in part due to the support of its patrons.
Thank you, patrons.
If you'd like to become one and help
Ask Leo, continue to do what I do and get access to Patreon exclusive content.
Visit askleo.com/patron
for more information.
So a couple of weeks ago, a friend of mine out of the blue got this message.
You'll see it on your screen?
I've got a lot of private information blurred out.
That's intentional, of course.
But the question she had for me was,
is this legit? The classic case of you're getting a piece of email and it looks just
convincing enough to to maybe maybe be legitimate.
On the other hand, it could be scam.
It could be a phishing attempt.
Let's take a look at some of the signs in this message that show what it really
is and why she was right to raise the alarm.
The seven Signs of phishing that I'm going to talk about in this video include
this message was received out of the blue with no additional context.
I want to be clear.
The person that this message looks to be
from is someone that my friend had corresponded with several months ago.
This message just showed up as being
from that person, no prior conversation, no prior information.
And as you'll note in the message itself, there's no explanation, nothing.
There is no context whatsoever.
That's a sign.
As I said, the message contained no
additional information anywhere about why this document has been sent.
That's a sign.
What I call bogus or misleading file names.
If you take a look at the file name that's
shown here in the middle of this, you've been granted access information.
It S # some numbers,
some more numbers, a slash, a bunch of... It's meaningless.
It's completely meaningless.
Generally, real documents will have real file names.
People don't store things as random numbers.
They actually store them as real file
names that have some kind of indication about what's inside in complete branding.
This is an interesting one.
You'll note that there's
an icon that kind of looks like it's an Excel document.
And in fact, there's a Microsoft logo down here, but in fact, that's it.
There's nothing that says that this is on Onedrive.
If it had been shared using a Microsoft
property, then it would have said Onedrive somewhere on the email.
All it says is Microsoft, and it kind of infers this Excel spreadsheet.
But it is not Onedrive.
The to line that you can't see here because I've obscured it.
This message was actually sent from someone to themselves.
That's a clue.
It's not always a clue.
It is something that people can do
legitimately to basically hide all of the recipients on the BCC line.
It's one way to send an email you send it to yourself, and then you just BCC all
the recipients so that they don't know who else got the message.
But more importantly, they don't get access to everybody else's email address.
And yet,
in conjunction with the other clues we're seeing here, the fact that this message
was not sent to my friend, that she was BCC.
That's a clue.
This next one is kind of surprising.
It looks like this is a legitimate ish email.
We've all seen emails that kind of sort of look like this.
They have some text, they have an icon to a document.
They've got a button to open the document,
they've got a logo, a Privacy statement, all that good stuff.
Except if you look carefully, there's no text here at all.
This is in fact, one image.
If you select it is by dragging your mouse over it.
You'll see that rather than selecting text, we're selecting an entire image.
That's a huge sign.
What that means is that whatever you click
on here, be at the document to download it.
The button that says, Open the document,
or even if you try and go to the Privacy statement, then that we'll open the single
link that this entire email is attempting to get you to go to.
And by the way, that link is bogus.
Let's Hover over this and you'll see now, down in the lower left hand corner,
there's this obscure domain, an obscure number.
Grapedrop.Net.
Now it's possible that Grape drop.
is totally legitimate.
I really don't know.
But the fact that there's this weird domain that has nothing to do
with anything in the document or has nothing to do with anything
that my friend would know about is a huge sign that, you know what?
This is a phishing attempt.
Now there are more clues you could look for.
Absolutely. One of the first things that I did when I
saw this message, when this person sent it to me is I went over to show original.
Now the original has a lot of information and a lot of header information,
a lot of other stuff that honestly you're not expected to know about.
There's a reason that you don't normally see it.
But even to me,
who kind of sort of understands what's going on in those headers,
it wasn't necessarily clear that there was something going on here,
tools that you can use online tools.
And one of them, I point in the article
that this video is based on called email header and Analyzer from MX Toolbox.
You can then copy and paste the headers
from the email that we just had and into form on their site,
and they will tell you what they can tell about the email.
One of the important things is something called Dmrk or SPF and DKIM.
In this case, this particular email failed.
Both SPF, which basically says
this was sent by a server that is allowed to send email on behalf of the person
sending the email which it wasn't or dkim, which says this email was
legitimately sent by that particular domain, which it wasn't.
Again, are more clues that you can find
out to determine whether or not an email you've received is in fact legitimate.
Now, the question, of course, is, why didn't a spam filter catch it?
Well, lots of reasons.
It's possible that it looked good enough.
Many of the clues that I've talked about so far are subjective.
They are just clues.
They are not absolute rules.
Computers love rules they don't like so much are vague things, subjective things.
Typically, what happens with a spam filter
is it will take a look at some of those clues, and each of those clues will be
given some amount of weight as to whether or not they all add up to something
that says, Yep, this email probably should be considered spam.
Unfortunately, also, many of the clues, like using BCC
or even the SPF and DKIM failures, they're actually common in legitimate males.
They shouldn't be. I get that.
But they can be.
And that's part of what makes spam filtering so incredibly difficult.
It has to be very, very clear and very, very subtle.
Typically, a spam filter will err on the side of not marking something as
spam and letting you make the decision, as opposed to a false positive,
which then throws potentially a legitimate email into your spam filter.
So spam filters work and work.
Well, this happens to be a Gmail account, and Gmail spam filters are still,
in my opinion, the best, but they're not perfect.
And this is a great example of how a lot
of these objective clues can all add up to Gmail.
Kind of saying, well, could be legit.
We'll send it on to the inbox and let the user make the decision.
Now, the question, of course,
that I get a lot is what happens if I had clicked on this email?
What happens if my friend had clicked
on this email expecting to download a document?
It's unclear. I don't know.
I have not clicked on it,
and I'm not going to what probably happens is something like this.
Like I said, the email looks relatively legitimate.
The email promises something right.
The goal of fishing the goal of spam is to get you to interact with the email,
to click on the link, or to open the attachment.
So they want to dangle something in front
of you that captures your interest and gets you to interact with that email.
When you click on that link, there is a good chance it will probably
take you to something that looks like a Microsoft Account login page.
Like I said, this kind of is trying
to look like a Microsoft Account shared document.
Theoretically, it should be one drive, but of course it's not.
We know that now, but in theory, it's trying to look kind of Microsoft dish.
So what?
They'll probably take you to is something that looks like a Microsoft login page.
Perhaps on that bogus domain, perhaps on a different page
that that domain then automatically redirects you to on that page.
If you don't realize that it's not a real Microsoft login page,
you enter your account information as soon as you hit log in or sign in.
You've just given your account ID
and password to a hacker, that login will appear to fail.
How it appears to fail. It's unclear.
They may even get you to do it more than once.
The bottom line is that you'll have Typed
in your username and password to a site that is not a Microsoft site.
The hackers can then collect your login ID
and your password and then go hack your account.
They can log in as you change your password, grab your data, hold it hostage.
Act as use as spam as you grab your other accounts, whatever it is they feel like
doing once they've got access to this account.
That's why it's so incredibly important to think before you click.
Remember, the spammers goal is to get you to interact with that email that's either
clicking a link in the email as this email was trying to do, or getting you to open
an attachment included with that email sync before you click.
There are times when it's perfectly
legitimate to click on a link because it is something you're expecting
and from someone you know and from someone you've been having a conversation with.
There are times when it's perfectly
legitimate to open an attachment for those same reasons, but there are many times
where it is absolutely the wrong thing to do.
Spam filters aside.
Ultimately, it's your responsibility to be able to tell the difference.
I hope this helps you at least think of a few of the things to look at when
you're evaluating a piece of email and trying to make the determination
of whether or not it's safe to click or open that attachment for related links.
For a few more examples for comments, updates and more, visit askleo.com/13658
I'm Leo Notenboom.
This is askleo.com