Uncategorized Archives -

Many computer viruses, malware, ransomware, and other unwanted software get installed because someone opens an email attachment or click on a link that they think is legitimate. Often, the email seems to come from a bank or a common website like amazon or ebay, and it tells you that you need to click on a link to fix a problem with your account or look at an attached bill to avoid additional fees.

It is vitally important to be able to differentiate between legitimate emails and those that only appear to be legitimate. Here are 2 easy steps that you can take when you get an unsolicited email that tries to get you to click on a link or open an attachment:

Don’t Click On Links in Unsolicited Emails

If the email contains a link to go to your account, view a message from the website, pay your bill, etc. DON’T click on the link. Rather, open your web browser and type in the website directly. Then log in and see if there is a message waiting for you. Never trust a link in an unsolicited email because there are many ways to trick you into thinking that it is a valid link when it is not.

Also, if it is not a legitimate email, often the link will contain tracking information so the sender would know that you read and responded to that email. Armed with this information, the sender can continue to send you similar emails in the hopes that you will trip up once and fall into their clutches.

Check the Actual Email Address

Most email programs or web-based email systems only show you the name associated with the email address. For instance, you will see Bob Smith as the sender and his email address bsmith@acme.gov will not be visible. This allows a malicious email sender to disguise their true identity. For instance, here is one that I pulled out of my Spam folder: PayPal Security Team <security@payservices.net> – the real email address appears between the < and >. The name that you see as the sender is PayPal Seurity Team, but the real email address is security@payservices.net. A legitimate email from PayPal should be from …@paypal.com not …@payservices.net. So, before clicking a link (which you hopefully won’t do) or downloading a document, verify that the email address matches the claimed sender.

Another trick that is used is putting a fake email address as the name so that it appears in the sender column to be a legitimate email address. For instance, the fake Paypal sender could have used support@paypal.com <security@payservices.net> as an email address with a name that looks like an email address. Most email applications or web-based email systems will display the support@paypal.com part and you could be fooled into thinking that the sender was legitimate. Don’t forget that the real email address is between the < and >, so the real address is security@payservices.net but the malicious sender hopes that you won’t notice.

Here is how to see the full email address for some email platforms:

Gmail

To see the real email address in gmail, simply move your mouse over the name of the sender and leave it hovering there for a few seconds. The complete email address then pops up underneath like this:

Outlook Web

The real email address is displayed between < and > above the message like this:

The real email address is in the red rectangle.

Thunderbird

The real email address is displayed between < and > in the header above the actual message like this:

Other Email Systems

Most email systems will show you the real email address above the message itself, similar to Outlook Web and Thunderbird, or by holding your mouse over the sender name, like gmail. If you have problems finding the real email address, you can search for “see actual email address in …” where … is your email system. That is exactly what I would do if you asked me the question.

On a smartphone

I highly recommend not even opening suspicious emails on your phone. Just opening an email may send information to the sender letting them know that you got the email and are reading it. It is best to leave these emails unread until you can open them on you computer.

Conclusion

The 2 suggestions mentioned in this post will help you catch a lot of illegitimate emails that are trying to trick you into clicking on a link or downloading a malicious document or software. There are many other things that you could look for, but I wanted to share a couple of simple concepts that could prevent you from falling into common traps.

Please be paranoid about unsolicited emails about accounts, bill, fees, collections, or even security related emails that look like they come from a popular website. If you are not sure if something is legitimate, be cautious. Getting rid of a virus or other malware is often very painful and costly.

There are often times that it is necessary to backup your gmail mail and import the resulting mbox file into your favorite email client. I use Mozilla Thunderbird as a powerful, yet free, email client. However, the mbox file that is exported by gmail is flat – all email from the gmail account are put into one mbox file. Writing a Thunderbird extension was quickly becoming too tedious. (The developer documentation is the worst documentation I have seen! But that is a rant for another time.) So, I decided to write a simple python script to split the mbox file into separate files for each label. It is not perfect (an email in gmail can have multiple labels but will only exist in one mbox file).

Without further ado, here is the script:

import sys
import getopt
import mailbox

def main(argv):
	in_mbox = "MikeBackupInbox.mbox"
	prefix = "MikeBackup"
	try:
		opts, args = getopt.getopt(argv, "i:p:", ["infile=", "prefix="])
	except getopt.GetoptError:
		print("python splitgmail.py -i  -p ")
		sys.exit(2)

	for opt, arg in opts:
		if opt in ("-i", "--infile"):
			in_mbox = arg
		elif opt in ("-p", "--prefix"):
			prefix = arg
	print("Processing file - " +in_mbox+" with prefix = "+prefix)
	boxes = {"inbox": mailbox.mbox(prefix+"Inbox.mbox", None, True), "sent": mailbox.mbox(prefix+"Sent.mbox", None, True),"archive":mailbox.mbox(prefix+"Archive.mbox", None, True)}

	for message in mailbox.mbox(in_mbox):
		gmail_labels = message["X-Gmail-Labels"]       # Could possibly be None.
		if not gmail_labels:
			boxes["archive"].add(message)
			continue
		gmail_labels = gmail_labels.lower()
		if "spam" in gmail_labels:
			continue
		elif "inbox" in gmail_labels:
			boxes["inbox"].add(message)
		elif "sent" in gmail_labels:
			boxes["sent"].add(message)
		else:
			saved = False
			for label in gmail_labels.split(','):
				if label != "important" and label != "unread" and label != "starred":
					box_name = prefix+label.title()+".mbox"
					if box_name not in boxes:
						boxes[box_name] = mailbox.mbox(box_name, None, True)
					boxes[box_name].add(message)
					saved = True
					break
			if not saved:
				boxes["archive"].add(message)

if __name__ == "__main__":
    main(sys.argv[1:])

2 Easy Steps to Prevent Computer Infection Through Email