Pandemic Email Scammers!

First things first, there are a bunch of fake emails going around that could be claiming themselves to be from WHO. Some emails claim that they are starting their new job in the world Health Organization and claiming they are from a specific area and demand money. One of the subject matter could be saying "Urgent New Coronavirus warning from the WHO." As the number of coronavirus cases increased, so too do internet scams and hoaxes. Real-looking emails supposedly from the World Health Organization and C.D.C. asking for money. These agencies do not ask for direct donations by email. If you click on a link or download an attachment from those emails, you could be giving hackers your personal information. So what we're looking at here is domain spoofing, and we see it greatly concerning the coronavirus in particular. This really has been totally unprecedented, the teams have never seen anything like this in their lifetimes. Uniting all different types of actors behind an available real pretext for people to do all kinds of things, whether it's stealing their password, is what we call credential phishing.

Whether or not it's installing malware, it's trying to get you to download a specific file that they have sent. Researchers at I.B.M. found that the file contains malware that captures screenshots and logs your keystrokes and steals username and passwords. Beware of criminals that are pretending to be from the WHO. The WHO has actually published guidance on this and are aware that this is happening. The WHO's number one advice is to verify the sender by checking their email address. We know that it's pretty easy to fake at this point, people don't usually point this out because people might think that if it has the word W.H.O. INT address, that means it's legitimate. In reality it's a necessary but not sufficient condition. What's interesting was that people tried spoofing a bunch of domains and some of them went through the inbox. In yahoo mail you are more vulnerable to get these responses than in Gmail, where they enlist it as spam. People have been looking for this and it seems like the greater context around that is that when email was created back in the eighties, no one bothered to make any way to verify that the sender is who they say they are. Really it is the foundational technologies of the internet being built with no security in mind and no central database of who is who that gives rise to this problem. Since then there has been a lot of attempts to sort of build a verification system. The problem is just that the participation is not as high as it should be. To make sense of this, it might help to think about another type of verification problem. Which is that society doesn't want teenagers to get into bats to buy alcohol.

To prevent that from happening, we need two things: we need a way to verify ages, which is our I.D. system, and we need businesses to then check for their I.D's. Now imagine if that I.D. system was voluntary. So you have a bunch of adults who might not bother to get an I.D. Then, when they come to the bar, the business has a decision to make. Either they require I.D's, knowing full well that plenty of legitimate adults don't have one, or, to avoid pissing people off, they just let them in and maybe end up letting in some kids too by accident. Probably, every bar is going to make a slightly different decision. In comparison, That's similar to what we are now dealing with regarding email authentication.