Sunday, April 5, 2015

Check the Extension

Over the weekend, I received an email "reminding me" about my court appearance that is supposed to take place on April 10th.  It stated:

Notice to Appear,

This is to inform you to appear in the Court on the April 10 for your case hearing.
Please, prepare all the documents relating to the case and bring them to Court on the specified date.
Note: The case will be heard by the judge in your absence if you do not come.

You can find the Court Notice is in the attachment.

Regards,
Cody Howard,
Court Secretary.

First, courts will not use email to contact you.  Email is an extremely insecure mechanism for transmitting court appearance information.  However, even if this email convinced me that I had a court appearance I did not remember, there was one more clue that this email was fake.  The file name of the attached "court notice" did not end with any common document format; it ended with ".exe".

The file extension (the portion of a file name that comes after the period) is an important part of the file.  It is the file extension that tells Windows what to do with the file when you try to open it.  When you open a Word document, Windows sees the extension (.doc or .docx), looks it up in a table it keeps, and determines that it needs to open it using Word.  Your file wouldn't make much sense if Windows tried to open it up in iTunes or Flash.

Knowing the common file formats can help you determine if an attachment makes sense.  Even if you are expecting an attachment from someone, if the file extension does not make sense with what you expect to receive, you have reason to be concerned whether or not this is the file you were expecting.

Here are some file extensions that can be very dangerous.  Do not open these types of files until you have verified the source:

.exe - This is the most dangerous file extension.  This is the file format used by programs and installers.  If you get a .exe file in an email, do not open it unless you know that the sender wanted to send it to you.  Opening a .exe file could install malware on your computer.

.url - This is a file that redirects you to a particular website address.  However, unless you look at the file's settings, you are blindly opening this file and seeing where it takes you.  It could be a legitimate link, but it could also take you to a malicious site.

.reg - This is a Windows registry file.  Opening it will make modifications to your registry, something that should only be done by advanced users.  If you receive a ".reg" file, it is almost certainly something that you don't want on your system.

The following file formats have many legitimate purposes for sharing but can also be used for malicious purposes:

.doc, .xls, or .ppt - These are Microsoft Office document files from Office 2003 or earlier.  Earlier versions of Office did not distinguish documents that contain macros.  Macros can contain malicious code that could harm your computer.

.docm, .xlsm, or .pptm - These are Microsoft Office document files from Office 2007 or later.  Beginning with Office 2007, Office distinguishes files that contain macros from files that do not contain them.  The "m" at the end designates that these files contain macros.  Similar file extensions that end with an "x" (such as ".docx") indicate that there are no macros.  While these may not be completely safe, they are much safer than files that contain macros.

.bmp, .gif, .jpg, .jpeg, or .tif - These are all picture formats.  While the majority of these pictures are safe from malware, there are occasionally vulnerabilities in these formats that can be exploited to harm your computer.

There are too many other types of file formats to list here.  Most are usually harmless, but problems in how your computer sees certain types of files can result in vulnerabilities that an attacker could exploit.  As a general rule, if you receive an attachment you are not expecting (even if it comes from someone you know), check with the sender to make sure it is safe before you open it.

No comments:

Post a Comment