Email is perhaps the greatest communication tool since the telephone was invented in 1876. And just as prank and obscene callers embraced that medium, so, too, did virus writers embrace email. To deter unwelcome callers, phone companies have since introduced caller ID and other services to ensure we only accept the calls we want. With email, things aren’t quite as simple.
Email attachments are the modern day Pandora’s Box. Received from friends and associates, we are convinced they contain cute animations, funny jokes, or useful programs to make our jobs easier. Even when we aren’t sure what they contain, many of us – like Pandora – simply cannot resist opening them. Once they have been opened, we often have the same sinking feeling of doom that Pandora must have experienced when she realized the box contained something other than she had expected.
While it sounds harsh, the absolute best defense against email worms is to simply ignore – or better yet – delete any emails containing attachments that were received unexpectedly. Regardless of source, even if it’s from your favorite Uncle Alfred, consider any unanticipated attachment to be potentially harmful and treat it accordingly. Explain to persons you routinely share email with that you choose not to receive any attachments unless prefaced by a specific message from that person telling you an email is coming with an attachment, what it is for, and why they are sending it. Even with that, if you don't need it, delete it.
Why so tough on attachments? Email worms spread so rapidly that a newly discovered email worm can spread globally in minutes. Antivirus vendors must first analyze and create a signature for the new worm, then deploy those updates to users. This process can take hours. Meanwhile, the new worm is rapidly spreading from inbox to inbox. This allows new email worms to gain a foothold before protection can be put in place to stop them.
When a person opens an infected attachment, it generally scans the user’s PC for other email addresses to send itself. This results in a rapid infection cycle – in short, everyone whose email address is on your system becomes a potential victim just moments after you've clicked open that attachment.
Can’t I just block or ignore certain ones? While there are certainly a great many known filenames of attachments harboring their particular brand of mischief, the fact is that any executable file has the potential to be infected. Filtering does work, but only if the filtering is designed to block all executable file types. Blocking based on file name, or even the name of the extension rather than the type of file, is not adequate and will only lead to a false sense of security. In turn, that can lead to a greater risk of infection.
What if it’s not an executable? By default, Windows hides file extensions from being viewable. Many worms are distributed with a double extension to make a file seem benign (i.e. not an executable). A user who has not changed the default settings may be tricked into thinking an executable file is really a harmless image file (i.e. a .JPG rather than a .PIF file). To change the default settings, visit the Executable File Extensions center for instructions.
What about just reading email? Thanks to a security hole in Microsoft Outlook and Outlook Express, you can be infected simply by reading email or, in some cases, if the message just appears in the preview pane. Kak, the most prevalent virus of the year 2000, was an example of an email virus that infected by just reading or previewing the email. Many vulnerabilities exist - and new ones are constantly being discovered and exploited - that allow thse types of threats to occur. Pay frequent and regular visits to the Windows Update site to obtain the latest security patches for you operating system.
How can I better secure my email? Visit the Email Help Center for tips on securing your email to provide better protection against email worms and viruses.
