# Curious About Spam

# Why am I getting spam/phishing mails?

Let's think about the person on the other side. The one who sends you
this mail. They're not doing so to annoy you or to entertain you. There
are reasons:

1. They want your data
2. They want to infect your device
3. They want your money

And they want to do this, without disclosing their real identity.

## Why do they want my data?

Real data is valuable. Have you noticed that you need accounts
everywhere? It was not always this way. Real data, from existing people
is valuable. Companies use them to combine them and profile people to
serve better ads, show you content you influences you most and sell more
stuff and shape your beliefs.

But what can bad guys do? The same and a lot more! If they have real
data, they can use it to impersonate you. They can try to reset
passwords and gain access to your accounts, they can do stuff in your
name. Or simply sell your data to others who have use for it.

## Why would they infect my device?

Infecting a device gives the attacker control over the device. In
general, there are two flavors of how this can play out: noticeable and
unnoticeable:

The attacker can...
- encrypt your files and only decrypt them after you've sent them money.
  You will certainly notice this one.
- read each keystroke on your keyboard and gain access to accounts
  you log in (or all of them, because you're using the same password,
  everywhere, right?)
- use your network connection for their own activities, like downloading
  or distributing illegal files and porn for example.
- use your computing power to mine bitcoins.
- make your computer a part of a botnet to hack other computers, send
  mails etc.
- infiltrate your home network and jump to other computers and from
  there to your work network.
- mine data about you to blackmail you later.

The possibilities are endless.

## It's all about money and/or power to make money

In the end, it's all about money. And if you're not trying to keep it
legal... well... you can do a lot:

- You can blackmail people (via ransomeware / or targeted)
- You can buy stuff in the name of other people
- You can sell other peoples (paypal) accounts
- You can sell other peoples credit card numbers
- You can provide hacking services
- You can trick people to signing up for something they didn't want

And you can lie and fake as you like...

# But... how?

And this is the right question: Let's keep in mind, the attacker wants
to stay anonymous. But they also want something from you. And this data
needs to somehow get to them. Let's look at what can happen:

## Infecting your device via attachment

Ever heard to not open attachments from untrusted sources? You sure did.
But why? Attackers know how your computer works. Most likely better than
you do. And they are using this to their advantage.

### Attachment: funny\_cats.jpg

Maybe you were told that every file has a file extension that shows the
system how to open it? Well, at the same time, Microsoft decided that
file extension are a burden and they started hiding them.

Let's say I'm sending you an email with the attachment
"funny\_cats.exe". Would you open it? Probably not, because ".exe" looks
suspicious. What about "funny\_cats.jpg"? Hell yeah - everyone loves
funny cat pictures!

What about "funny\_cats.jpg.exe"? No?

What if Windows decides to hide the extension and shows you
"funny\_cats.jpg" instead? Boom, you just opened "funny\_cats.jpg.exe"
without realizing it. And usually the virus-program shows you a funny
cat picture, so you don't wonder why nothing is happening. But
additionally, a backdoor is installed that connects to some
other (probably hacked) computer the attacker controls already.
Congratulations, you're now part of a bot-net.

### Attachment: invoice.pdf

Of course we can do the double-extension trick described above with
other file types. But it may also happen that a double extension is
not used - instead bugs in the opening program are used. This commonly
happens with pdf, because the pdf file format is opened with the same
program on almost every computer. If this pdf program has a bug that
allows the attacker to gain control... well, expect e-mail
containing this kind of pdf documents.

This is bad, because there's not really a way to look at it in a safe
way. So, don't open it. And keep up with security updates!

## Your account needs to be verified!!!!

This is a classic opening for phishing. Here the attacker wants your
data. Usually there is a link in the email that opens a website which
wants you to enter some data. The general advice here is: Don't do it.
If you get an email like this don't use the link in the e-mail, but
open a browser and manually open the website of the institution the
email claims to be. Log in there and check if your account is fine. If
you really need to do something, you'll be notified after you logged on
there.

But watch out for more clues in the email. Most of the time, the link
doesn't actually go to the right website. It will open up a website that
_looks_ like the original, but is not. Click right on the link, copy the
link address, and paste it into notepad to really look at it.

```
    https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
    '---'   '-' '----' '-' '------------' '------'  '------'
      |      |    |     |    |              |         |
      |      |    |     |    |     Identifying "unique" information
      |      |    |     | Some path (not super relevant)
      |      |    | Top Level Domain (watch out!)
      |      | Domain (watch out!)
      | Subdomain (not super relevant here)
Protocol (should be https)

```

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
^^^^^
```
Anything important nowadays should communicate over the http*s*
protocol. This means the the communication is encrypted. If the link is
only a http link, don't enter any information into the website. Every
computer between you and the target website can read the data.

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
        ^^^
```
This is the subdomain. It can change and look weird. Multiple
subdomains can exist. So you might be presented with something like
`https://foo.bar.baz.mybank.com`, which is nothing to worry about
if `mybank.com` is correct. But: `https://www.mybank.foo.com` *is*
something to worry about, when the usual account is on "mybank.com".

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
            ^^^^^^
```
This is the so called domain. This one is tight to the top level domain
below. Nothing must be between the domain and the top level domain. And
both must be absolutely correct, otherwise you'll not reach the website
you think you reach.

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
                   ^^^
```
This is the top level domain and the anchor point. You can identify it,
because it has a dot to the left and the first / to the right: ".com/".
The top level domain forms a union with the domain. So you can be sure
that everything with ".mybank.com/" will actually go to your bank
account. The following examples will *not* go to your bank account:
- `mybank.co.com`: The domain and the top level domain must follow each
  other directly
- `mybank.com.uk`: The top level domain here is .uk, not .com.
- `myaccount.com/mybank.com`: "mybank.com" is behin the first / and
  therefore not part of the domain
  at all. You're connecting to domain "myaccount" with top level domain
  ".com". This is not mybank.com.
- `mybank.account.com`: Same as the first example

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
                       ^^^^^^^^^^^^^^^^^^^^^^^
```
This is part of the URL path. This can be anything. It's generally
nothing to worry about if it passes a sanity check. If the URL is
"shoes/men/checkout" - then why would this exist on website of your
credit institute...


```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
                                      ^^^^^^^^
```
The path often has generated elements of random character or numbers.
This is sometimes part of the website functionality, but also often used
for tracking. If you're suspicious but still want to try the URL, change
these random numbers a bit. These tracking IDs are often used to track
who clicked on a link. So simply by opening the link, you may valide
your data and proof to the sender that the email has reached you.

```
https://www.mybank.com/account/verify/d8sL3jDk/?id=23456
                                               ^^^^^^^^^
```
Same as above. After the ?, there are key=value pairs of data. You
may find any kind of information there. This data is send right at
the moment when you click on the link. Watch out for identifying
data like IDs, hashes (random stuff), emails etc. So if you read
`?confirm=<your@mail.com>` you know what's going to happen, right?

# The whole email is one big image (with link)

Sometimes an email looks good. But technically it's one big image. And
no matter where you click on the email, a link is opened.

This is usually easy to spot if you click and drag and the whole email
moves with the cursor. Or the cursor is this "hand" symbol that usually
only appears over links, but here it's there all the time - even over
non-link text or free space between lines.

This is a 100% indication that it's spam or phishing. Having the whole
email layout baked into a picture prevents content scanners from
"reading" the email and blocking it based on used words. Because they
read text, not images. Doing so, shows that the email author wants to
do evil and evade counter measures.

# Psychological tricks

## This is urgent!

Your you'll loose your account / your chance to win / this awesome sale.

People are less careful when confronted with urgency. So spam senders
often try to make you do something *now* to prevent you from thinking
about your actions.

## Many correct URLs and Information

Better spam mails show a lot of correct information to gain trust. They
may include images from the your actual bank website. They may link to
the impressum and show correct phone numbers for customer support etc...

All this is there to gain your trust. Really look at the link they want
you to click on. And don't be fooled if the link is written out in the
email. In an HTML type email, the display text and the actual link can
be different. In code, this looks like:
```
<a href="https://i.am.stealing.your.data.example.com/id/12345">mybank.com/account/verify</a>
```
Your email program is displaying "mybank.com/account/verify",
but if you click on it, your browser will open
"https://i.am.stealing.your.data.com/id/12345".

This is why you should right click on the link and copy it and paste it
to notepad before opening it in the browser. And if you clicked on it
already, check the browser bar.

## You won 50 Million Dollar

No you didn't. But they surely you need to pay some small fee so they
can send you the money.

## I need someone to trust with the Millions I inherited...

Same as above. Proof that you're real by sending them money. Or they ask
for personal information via email right away.

## Buy drugs / weapons / other stuff

That's just the regular kind of spam. They want you to open their
website. Sometimes the email shows what they're selling. But sometimes
you get an email about your bank account and the link sends you to a
shoe shop.

It's weird, but appearently it works. Especially here, watch out for
identifying information in the link. They are pretty much interested
in who clicked on the link to curate their customer database.

# Email Body

Especially phishing mail try to show up in a style of a website. And it's
rarely perfect (sometimes it is!). So misalinged images, Text in weird
places, bad language and slightly off colors or fonts are indicators
that this was not created by the companies brand team.

Also, often spammers only know your email address. If you're greeted in
an anonymous fashion, like "Hello Email Receipient" or "Dear Friend",
this indicates that they don't know your name. Which is unlikely for a
company that you're a customer of.

Some spammers put your email in: "Hello you\@yourmail.com", doesn't count
as a personal greeting.

If you receive an invoice from a company you're actually a customer of,
maybe compare the email style to the last one you got. If the PDF is
named by your actual customer id is probably legit, even if the rest of
the mail checks some spam boxes.

# Check the Header

## From Address

Don't believe what your email programm is showing you. Emails are easy
to fake. Just because an email appears to be sent from "Customer Support
Mybank", doesn't mean it actually came from there. Even the address
"noreply\@mybank.com", which would pass the domain and top level domain
check can be faked. So, the From address may look good, but that's no
indication that it's not spam. However, if the From Address looks wrong,
it's a clear indication for spam. I mean - why would your bank send you
an email that comes from a differnt domain? That's unlikely.

## To Address

Sometimes the "To" Address is wrong. This is a indicator for spam. If
an email is sent out to many people, this often happens as blind copy
(BCC). Then you see either nothing, or "undisclosed receipients" or an
unknown Email Address in the "To" header.

There are more header fields that could be checked. But most email
programs are not showing them. And they are much more complicated to
explain.

# There is no one size fits all approach...

While an email is either spam or not, it's sometimes not easy to find
out what is what. Often it's obvious, but other times it's not. Spammers
are getting better. Phishing websites are becoming more professional.

There is more that could be checked. There are more headers and there
are SSL certificates at play, which can be checked and compared. But these
are advanced techniques I'm explaining in the ebook below.

So we leave it at that. If you have understood the concepts explained here,
you should be fairly safe and also be able to explore spam mails in a safe
way.

# Download my ebook about spam for free

This and much more information about spam, phishing and digital self
defence can be found in my new ebook, which will soon be available for
39€ on Amazon. But for my dear blog readers, I can offer 200 copies for
free. So download your copy today! (3 copies left)

[https://home.codevoid.de/ebooks/promotion/about_spam.pdf](https://i.am.stealing.your.data.example.com/id/12345)

**Be safe and thanks for reading!**

