Michael Kassner recently posted on Tech Republic about "Trusted Web sites: Exploit tool of choice" based on the latest Websense Security Labs twice-yearly Web-based malware report (PDF): http://www.websense.com/site/docs/whitepapers/en/WSL_Q1_Q2_2009_FNL.PDF
There is always a fine line between being aware (and making others aware) of security threats and FUD; I think this is safely in the former.
- 233 percent growth in the number of malicious sites in the last six months (671 percent growth during the last year).
- 77 percent of Web sites with malicious code are legitimate sites that have been compromised.
- 95 percent of comments to blogs, chat rooms and message boards are spam or malicious.
- 57 percent of data-stealing attacks are conducted over the Web.
- 85 percent of all unwanted emails in circulation contained links to spam sites and/or malicious Web sites.
The last point is timely, and is also relevant to the idea of exploiting trust - in this case email from a known source. I've just received an email from a family member (who shall remain name-less - for now):
- Subject: FW: Fw: Never, ever answer a cell phone while it is being RECHARGED!!
- Attachment: Mobile Phone recharge.pps (173 KB)
Hmmm - would you open this?
Firstly, I would be exceedingly wary of stuff like this - why do people need to send this sort of thing in a PowerPoint? (or at all?) Any sort of complex file-type like this (Word, excel, etc) is simply a more capable platform for evil.
Secondly, assuming from the file name that there is an eminent danger here, I would strongly urge you to validate that kind of thing; Snopes (http://www.snopes.com) is a good site for this.
For more general info see: http://en.wikipedia.org/wiki/Urban_Legends_Reference_Pages
In the specific case of the phone recharging, see: http://www.snopes.com/horrors/techno/cellcharge.asp
Lastly, I would suggest you make anyone who sends this sort of stuff out to you aware of these issues, prevention is always better than the cure. |