When it comes to malicious emails, the good news is that the bad news isn’t worse.
If you’re like most of us, you probably feel as if you’re drowning in unwanted email. That’s probably true: Symantec’s latest Internet Security Threat Report found that about 53 percent of all email is spam. What’s worse, a lot of it seems to be designed to trick you into clicking on things that you really shouldn’t click on.
But although it turns out that there’s more and more email carrying actual malware payloads, there’s actually less e-mail that tries to steal your login information.
Although both types of email work the same way – a recipient has to be fooled into clicking on something -- it’s useful to separate those two things out.
Payload-bearing emails carry attachments – typically a Microsoft Word document – that contains a macro that downloads malware. By default, Word’s macro function is turned off, so the payload has to persuade or trick the user into changing that, said Kevin Haley, a director in Symantec’s Security Technology and Response Group.
“What somebody figured out in 2016 and everyone quickly copied, was the fact that you could fool the user into enabling the macro,” Haley said. “You can convince them that in order to read this document, that has to be enabled, and so they will then go and enable the macros themselves. And, once that macro support is enabled, the malware gets launched and they have essentially been a partner in infecting themselves.”
Those infections are now mostly ransomware, which locks your computer until you pay the bad guys. That kind of email is increasing: from 1 out of every 244 emails in 2014, to 1 out of every 131 in 2016.
Malicious emails are becoming more common, said Haley, because “it is cheap and it is effective. You can go and even hire somebody to send massive runs of email out for you. These guys don't care whether it's an ad for Viagra or a piece of malware. You just hand it off to somebody who has servers in place and then go.”
And it’s lucrative. Haley said the typical ransomware payoff was $1000 in 2016, up from $300 in 2015. Moreover, Haley said, a survey showed that 34 percent of people would pay if they got infected.
The other kind of bad-acting email is “phishing,” email that tries to collect your login credentials. Those emails typically mimic security alerts from a financial institution or from Google. They are much less common and are becoming rarer still, dropping from 1 out of every 965 emails in 2014 to 1 out of every 2596 in 2016.
There may be fewer of them, Haley said, but they’re getting more sophisticated. “The old school [tipoff] is if you see a typo, or if you see bad English, [you know] that's a phishing attack. It just doesn't happen anymore. Not only are spell checkers universal, but for the most part these guys are just copying text or images from legitimate emails, or from websites. They're not writing the stuff themselves; they're using the existing stuff that the people they're imitating have written.”
Perhaps the best-known recent successful phish was of John Podesta, chair of the Democratic National Committee, who was fooled last year into giving up his Gmail credentials; the contents of his emails were published during the weeks before the last presidential election.
So, if phishing attacks are lucrative, why aren’t they increasing? Because, Haley said, all the good stuff’s already been stolen.
“Part of the reason that phishing attacks have gone down is that there have been so many login and passwords stolen in data breaches,” Haley said. “It is so cheap to buy that information in the underground economy that I don't need to go to all the trouble to phish for it. The guys who are doing it have gotten better and better, but since there's less need to do it, there are less people doing it. They're all either buying their login and passwords online, or they're off doing ransomware.”
How to defend against attacks? Haley says that Symantec’s mail servers now put the flag [ext] in the subject line of all emails coming from outside the company to help guard against spoofed email addresses. But overall, the old rules still apply: consider all attachments to be suspect. Don’t enable Microsoft Office macros. Never click on a link in an email; go directly to the site yourself.
Because you are not paranoid: they really are out to get you.