Email communication is one of the most common and popular ways to exchange and share information around the world. On the other hand, it is also one of the easiest means for perpetrators to infect a computer and steal data. As people are inclined to trust the contents of emails from friends and families, perpetrators could  simply fake an email message, which looks like coming from the people you know and attaches a malicious content. When people click or open the attachment, the computers will be infected.

 

 

(1) Direct infection: The attachment itself is the malicious code. Some perpetrators may try to hide the file extension or confuse you about the real file extension, such as “.txt.exe” or “.jpg.vbe”. The danger lies in the fact that you think it is a legitimate document, in this case, “.txt” or “.jpg”, but actually it is a harmful executable code, i.e. “.exe” or “.vbe”.

 

(2) Infection via software vulnerability: Attacker would try to exploit the vulnerability of software by creating a specifically crafted file with a common file type, like “.jpg”, “.pdf”, “.doc” and “.mp3“.  For example, when you open such crafted “.pdf” file using the pdf viewing software and if the patch level of the software is not up-to-date, your computer would be infected.

 

(3) In certain infection cases, the malicious code tries to hide itself from you or anti-virus software. You may not be aware of it until you’ve found, e.g. your online banking account and password are stolen.

 

(4) Users should also be aware that even there is no attachment in an email, the email itself cannot be regarded totally safe. Some malicious codes could be embedded directly inside the email content to infect a computer.

 

 

* Always keep a reputable anti-virus programme and its virus definition up-to-date. Apply additional security scanning or filtering on email and its attachments.

 

* Install the latest security patches in Operating System and other software so that attackers can’t take advantage of the known vulnerabilities of this software.

 

* If not required, turn off the option in the email programmes that automatically download, display or open the email content, including attachments or web pages/links.

 

* Be aware of the real file extension of an attachment. Do not open or run the attachment of executable types, like “.exe”, “.com”, “.pif”, “.cmd”, “.js” and “.vbe”.

 

* Read the email and its attachment using an OS account with normal user privilege instead of administrator privilege.

 

* Do not open any email or attachment if you were not sure it is safe.