It's Not a New Dinosaur; It's A New Way to Phish

It’s not a newly discovered dinosaur. It is another new trick for hackers to use. The term being used to describe it is a Stegosploit and it involves images rather than documents or websites to perform exploits.

The practice is real and is called Steganography. It’s been around for a while. Some records indicate since 1499 AD. It is a legitimate way of hiding a message inside an image or text that makes it undetectable to those who don’t know to look for it. Think invisible ink. However, it is now being used by hackers to spread malware.

The malicious code is hidden inside a picture’s pixels, but when the link associated to one of these messages is clicked, information on the victim’s machine is sent off to a cybercriminal. The victim gets a “You are hacked!” message so that there is no doubt about what just happened.

Of course the message with the link is likely to come in a phishing email message. So remember not to click on any links or attachments from senders that you don’t know. Even if you do recognize the name, use caution and if you are not completely sure that what you are about to see is harmless, don’t do it. It is best to contact the sender in a separate email message (do not reply to the original one) and make sure it was intended and is safe.

Information security can seem daunting, but the fundamentals do not change. You may find it challenging to determine if an email message is phishing for something, but most of the time there are indicators making it easier to detect.

• Watch for misspellings, incorrect grammar and punctuation, and incorrect use of the language.

• Hover over links with the mouse to see where that address really is taking you. Often times, it’s just a bunch of random characters and that is a flag it’s phishing.

• The sender’s name is missing, is a bunch of garbled characters, or is someone unfamiliar to you. Even if the name is familiar, you can expand it to see the actual address. Often times, it is spoofed just to make it look like someone you know.

• Make sure anti-malware software is installed, updated, and active and that it scans attachments upon receipt in your inbox and before you see them.

What is inside these bad images?  It is likely a picture of cute little puppies or kittens or perhaps a photo of a celebrity. You can probably get plenty of photos of these in other ways without putting your computer, mobile device, or company’s network at risk if you really just have to see them.