untangling_the_web

DOCID: 4046925
UNClASSIFIEDfiliOft OlililelAL USE ONLY
Don't Open Email Attachments
I can't say never open any email attachments because there are times when you
trust the user and are expecting a document via email. However, do not open email
or attachments from unknown or even questionable sources. If you don't know the
person who is sending you an email, do not open the email or any file attached to it.
Even if you do know the sender, be very careful about opening the email and
attachment (people sometimes unwittingly spread malware). If the mail appears to
be from someone you know, still be careful, especially if it has a suspicious subject
line (e.g. "I love you" or "look at this!") or if it seems odd (e.g., it was sent in the
middle of the night). It may not actually be from the person you know but may be
using a "spoofed" or fake email address using your friend's identity. Also be
especially wary if you receive multiple copies of the same message from any source
because they are likely to be spam.
The best thing to do with suspicious email is to delete the entire message, including
any attachment, and empty your email reader's trash. If you really must open a file
from an unknown source, save it first and virus scan the file. However, you need to
know there is still a risk because no virus scanning software can detect every piece
of malware.
"Finally, remember that even friends and family may accidentally send you a virus or
the e-mail may have been sent from their machines without their knowledge. Such
was the case with the "I Love You" or "Love Bug" virus that spread to millions of
people in 2001. When in doubt, delete!,,188
Stop ..Email Wiretapping" by Disabling JavaScript in Your Email
A malicious user could insert hidden JavaScript code into an HTML email message
and send it to another person's email reader that has both JavaScript and HTML
enabled. Then if that unsuspecting person forwards the email message to others,
the JavaScript, using a web bug or hidden form, surreptitiously sends a copy of the
forwarded email back to the original sender, who can retrieve and read the
forwarded message. This is a great method for spammers to harvest email
addresses. Turning off JavaScript in email offers some measure of protection for
188 Awareness and Outreach Task Force, "Report to the National Cyber Security Task Force," 18
March 2004, < http://www.educause.edu/ir/library/pdf/SEC0403.pdf > [PDF], Top 10 Cyber Security
Tips, p. 25, (1 February 2007).
UNClASSIFIEDhTOR OFFICIAL ~SE .ONLY 545