The Click That Changed Emily’s Business

As you may recall from Part I of this series, Emily is the sole owner of a small business. She works from a home office and has two employees who also work from their homes.

She uses a smartphone, a PC, and a tablet. For email, she uses a free Internet email service like Gmail, Yahoo, or Hotmail, and has email set up through her domain with her email address as Emily@Emilysbusiness.com. Like many computer users, she has heard a little about the need to keep information secure—especially customer information—so she uses a free antivirus software program. She has a password (her dog’s name) for her tablet and her smartphone but frequently does not use them. She backs up her files but not consistently, and she uses an online backup service.

Her business requires her to collect personal information from customers, such as credit card numbers, bank account numbers, names, addresses, phone numbers, dates of birth, and, in some cases, social security numbers. She keeps all the information stored on her PC at home as well as in a cloud storage service.

Vladimir, our hacker, counts Emily’s PC as one of his bots in his botnet of a few hundred infected machines. He was able to infect her computer after sending out a phishing email through his spam list. He sent the email to about 1,000 random addresses that he collected by hacking a dating site. The fake email appeared to come from a business coaching company offering a free guide to quickly increase sales in two days. The guide appeared in the email as a PDF. Opening the guide, which was an actual guide Vladimir had copied from another site, caused malware to download secretly onto the recipients’ computer, enabling Vladimir to take control of the computer and either steal information or use the computer to attack others or both.

Hackers like Vladimir frequently seek victims through various means such as massive phishing scams or targeted attacks wherein they attempt to trick users into opening emails and their attachments, clicking on links in emails, or surfing websites that have been infected with malware. Once the malware has been downloaded on your machine or device, hackers have a number of options: steal information, disrupt services, or use your computer and its bandwidth to attack other users.

Computer users like Emily need to be very careful about which emails they open, and they certainly need to avoid clicking on links in emails or opening attachments. Now, obviously, if you are in business, there will be many emails from individuals and companies with which you are not familiar. The key is to be cautious. Do not click on any links or open attachments.

If an email contains a link that you believe you really need to open, you can right-click the link, copy it, and paste it into a Word document, and then recopy and paste it into the URL. Sometimes you can right-click the link to reveal the link properties and easily determine whether the URL is legit. This is important because hackers can create a fake link and a fake webpage.

For instance, on occasion I have received an email indicating that someone wanted to friend me on Facebook. I did not click the link, but instead logged into Facebook. Low and behold, the friend request was not there. So, the email, the link in the email, and the friend request were fake. Had I clicked on the link in the email, it would have taken me to a site that looked like Facebook. The hacker’s goal was to get me to input my username and password. He would then have access to my Facebook account and all the information on it. This would enable him to send more targeted phishing attacks to others using the information in my Facebook or other social media account.

With regard to attachments, if you believe you need to open an attachment, ask yourself if it was something you expected. You might want to contact the sender. Unfortunately, if you do not know the sender and it is a hacker, he will obviously say it is legitimate. If the malware in the attachment is a zero-day attack, your antivirus software will not catch it.

Watch for Part 3 where we will continue the discussion about what Emily should and should not be doing to protect her business, and we will take a look at Ernie’s conduct.