Cyber Security, Data Breach, Education, HIPAA / HITECH Enforcement, News Events, Tip of the Week, Trends & Technology

Email scams and Cyber campaigns

Part of what RISC provides during our regular education sessions is awareness of phishing emails which may lead to sites that collect sensitive information such as login credentials or passwords, and may contain attachments to infect your computer systems. Cybersecurity is defined as the “protection of information and systems that connect to the Internet. It is in fact protecting your personal information or any form of digital asset stored in your computer or in any digital memory device. It includes detection and response to a variety of cyber (online) attacks” according to the Office of the National Coordinator for HealthIT Information Technology (n.d.).

Protect your privacy

Just last week, the United States Computer Emergency Readiness Team (US-CERT, 2014a) published “Ebola Phishing Scams and Malware Campaigns” as a cautionary statement to the public.

“Users are encouraged to use caution when encountering these types of email messages and take the following preventative measures to protect themselves:

Use antivirus software

According to How To Geek (2013), even though Microsoft Outlook fixed their vulnerability with regards to using JavaScript for emails which contained security problems, it is prudent to use best practices to stay safe while viewing your email attachments.

Software updates are important

Here are some Email Safety Tips gathered from experts:

  1. Keep Your Mail Client, Web Browser, and Operating System Updated: Software updates are important, as the bad guys regularly find holes and try to exploit them. Software updates close some of these holes and help protect you. Many operating systems offer automatic updates. If this option is available, you should enable it. If you are running an outdated browser and email client, you could be compromised. (If you have Java installed, you should it or at least disable the browser plugin to protect yourself, too.)
  2. Use Antivirus Software: On Windows, antivirus software is an important layer of protection. It can help protect you from both mistakes and software bugs that allow malware to run without your permission. If you are using a corporate email system, have a discussion with your Information Technology (I.T.) Department about all the levels of required antivirus; Gateway, Email Server, and Client.
  3. Be wary of unsolicited attachments, even from people you know – Just because an email message looks like it came from your mom, grandma, or boss doesn’t mean that it did. Many viruses can easily “spoof” the return address, making it look like the message came from someone else. If you can, check with the person who supposedly sent the message to make sure it’s legitimate before opening any attachments. This includes email messages that appear to be from your ISP or software vendor and claim to include patches or anti-virus software. ISPs and software vendors do not send patches or software in email as attachments.
  4.  Don’t Run Dangerous Attachments: If you get a PDF file from someone, it might be safe to open if your .PDF reader and antivirus software are both completely up to date. However, if you suddenly get an email with a .exe file or another potentially dangerous type of file you aren’t expecting – even if it’s from someone you know – you probably shouldn’t run the attachment. Exercise extreme caution with email attachments – they are still a common source of infection.
  5. Be Careful of Links: Clicking on links provided within the body of an email message is not a good idea. Rather than clicking on a link, which can actually be hyperlinked to something entirely different, open a new tab of your browser and type the address in. When you receive an email that has your bank’s web address in it and it displays as a hyperlink, it could easily map to a scam or virus-laden site.
  6. Trust your instincts – If an email or email attachment seems suspicious, don’t open it, even if your anti-virus software indicates that the message is clean. Attackers are constantly releasing new viruses, and the anti-virus software might not have the signature. Additionally, 0-day, (Zero Day) attacks are attacks that do not have patches developed or deployed yet, and your antivirus will not recognize them as a threat. At the very least, contact the person who supposedly sent the message to make sure it’s legitimate before you open the attachment. However, especially in the case of forwards, even messages sent by a legitimate sender might contain a virus. If something about the email or the attachment makes you uncomfortable, there may be a good reason. Don’t let your curiosity put your computer at risk.
  7.  When sending email with sensitive information, remember to encrypt it. Some email applications allow you the option of sending encrypted or not encrypted. When in doubt, encrypt. If you don’t have an email encryption solution, use an alternate secure method and contact I.T. to add this to their budget requests.
  8. Do business with reputable companies.
  9. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (

Additional important security tips from the US-CERT (2014b) is knowing how attackers use certain social skills to obtain information such as social engineering and phishing attack.

What is a social engineering attack?

In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization’s network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

What is a phishing attack?

Phishing is a form of social engineering. Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

Phishing attacks may also appear to come from other types of organizations, such as charities. Attackers often take advantage of current events and certain times of the year, such as

  • natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)
  • epidemics and health scares (e.g., H1N1)
  • economic concerns (e.g., IRS scams)
  • major political elections
  • holidays

Protecting your identity

The goal is not to become the victim. It is important to protect your privacy. Be suspicious of unsolicited phone calls, visits or email messages if others are asking questions about employees or colleagues. Always verify the source directly. It is not good practice to provide personal or financial information via email unless it was through a verified source and encrypted route. Take the extra step to install and maintain anti-virus software, firewalls, and email filters to reduce spam.

Install a firewall

Be aware and keep abreast of technology. Lastly, be vigilant for signs of identity theft and consider reporting the attack to the police or file a report with the Federal Trade Commission ( For more information on Identity Theft, please visit

Know signs of identity theft







Cybersecurity. (n.d.). Office of the National coordinator for Health Information Technology. Retrieved from

How To Geek. (2013). Why opening an email is safe. Retrieved from

US-CERT. (2014a). Ebola phishing scams and Malware campaigns. Retrieved from

US-CERT. (2014b). Avoiding social engineering and phishing attacks. Retrieved from







Data Breach, Education, Tip of the Week, Trends & Technology

Part Four of the Practical Security Series: First Hand Story

The following is a first-hand story from one of our business partners. I thought it was worth sharing as we often feel that certain “types” of software programs and utilities are safe because of their nature or purpose. Let the Downloader Beware!

 Proactive PC User

This is a personal experience with the home office PC of a partner of ours. It taught her a lesson to take the same precaution with her own personal computer at home as she does at work. The story refers to a computer virus and having to deal with this unfortunate occurrence. Her home PC was running slower than usual. There were pop-ops; she could not load certain websites; and there were many more operational issues. It took this person two days to figure out what they had done differently. Then she remembered downloading a free eReader application. All of a sudden, she went into panic mode and started reacting instead of being proactive. The “cybercriminals who publish and distribute malware devote significant effort to convincing or tricking Internet users into clicking links that lead to malware, or that download malicious attachments or applications”(Microsoft, 2013, p. 3).

 What is a computer virus?

They are unwanted, sometimes destructive software programs that often times have the ability to spread from one computer to another. Their objective is interfering with the computer’s intended operation. Viruses often have the ability to corrupt, delete, or copy and send “home” important information on your computer.

Important Terminology

  • Adware -Advertising-supported software that plays, displays, or downloads advertising content on your computer. Adware may or may not be destructive, and may or may not jeopardize sensitive or regulated data.
  • Companion Virus – Replicate by exploiting the precedence hierarchy according to which the operating system executes program files based on their filename extensions. A good example of a companion virus is a search order to exploit the DLL files. If the malware replicated itself as a DLL application directory, it would take precedence over the DLL with the same name in the system directory.
  • Exploits – Malicious code that takes advantage of vulnerabilities specific to software. Exploits can infect, disrupt, and even take control of your computer without your knowledge. The usual focus is on the operating system, web browsers, applications, or software components installed on the computer.
  • PUAs- Potentially unwanted applications that contain a broad category of software that has a less threatening intention. It is also referred to as grayware. It still has the capabilities of potentially altering the behavior of your computer. An example would be adware, spyware, various browser toolbars, bundleware, trackware, etc.
  • Ransomware – Type of malware that is specifically designed to render files unusable until the user pays a fee to the attacker via electronic money transfer. The message will have an official look similar to the U.S. Federal Bureau of Investigation (FBI) and Scotland Yard. When the ransom has been paid, a password is then provided or access to the computer is restored. The ransom is usually demanded in untraceable Internet currency.
  • Rogue security software – Common method that attackers implements to make money, also called scareware. The software makes it seem like you are at risk, or that it would be helpful to have to have a secured computer, but in reality there is no real security provided! In fact they are misleading alerts to temp users to spend their hard earned dollar. The software mimics legitimate security software with the scare tactics of non-existent threats and urging the user to pay for the full version to assist with the removal of the threats.

Some samples of those that don’t hurt a PC, but are only an annoyance

Win32 Adware was frustrating, but with the help of SMEs, it can be removed.

Win32/adware.virtumonde virus is an adware that is designed for delivery of unsolicited advertisement and usually comes in a grouping of other malware.

Win32/AdWare.MultiPlug.N is the threat name and it is categorized under riskware. According to eset their detection it was created December 23, 2013. Prevalence map indicated the highest percentage in Asia such as Laos at 2.22 % and one of the lowest in the United States at 0.28%. The world activity peaked at 2.71% in December 23, 2013.  Now in March of 2014, a declining trend is showing to about 0.46% on an average.

Research Examples

DLL files (message will pop up relating to DLL files):

According to Microsoft, DLL is the acronym for Dynamic Link Libraries. A DLL is a library that contains code and data that can be used by more than one program at the same time. For example, in Windows operating systems, the Comdlg32 DLL performs common dialog box related functions. Each program can use the functionality that is contained in this DLL to implement an Open diaglog box. This helps promote code reuse and efficient memory usage. “The use of DLLs helps promote modularization of code, code reuse, efficient memory usage, and reduced disk space. Therefore, the operating system and the programs load faster, run faster, and take less disk space on the computer”

The following list describes some of the files that are implemented as DLLs in Windows operating systems:

  • ActiveX Controls (.ocx) files
    An example of an ActiveX control is a calendar control that lets you select a date from a calendar.
  • Control Panel (.cpl) files
    An example of a .cpl file is an item that is located in Control Panel. Each item is a specialized DLL.
  • Device driver (.drv) files
    An example of a device driver is a printer driver that controls the printing to a printer.

DLL advantages

The following list describes some of the advantages that are provided when a program uses a DLL:

  • Uses fewer resources
    When multiple programs use the same library of functions, a DLL can reduce the duplication of code that is loaded on the disk and in physical memory. This can greatly influence the performance of not just the program that is running in the foreground, but also other programs that are running on the Windows operating system.
  • Promotes modular architecture
    A DLL helps promote developing modular programs. This helps you develop large programs that require multiple language versions or a program that requires modular architecture. An example of a modular program is an accounting program that has many modules that can be dynamically loaded at run time.
  • Eases deployment and installation
    When a function within a DLL needs an update or a fix, the deployment and installation of the DLL does not require the program to be relinked with the DLL. Additionally, if multiple programs use the same DLL, the multiple programs will all benefit from the update or the fix. This issue may more frequently occur when you use a third-party DLL that is regularly updated or fixed.

DLL dependencies

When a program or a DLL uses a DLL function in another DLL, a dependency is created. Therefore, the program is no longer self-contained, and the program may experience problems if the dependency is broken. For example, the program may not run if one of the following actions occurs:

  • A dependent DLL is upgraded to a new version.
  • A dependent DLL is fixed.
  • A dependent DLL is overwritten with an earlier version.
  • A dependent DLL is removed from the computer.

Signs and Symptoms

  • Onslaught of pop-up advertisements
  • Alerts stating your PC has been compromised
  • Alerts will usually include message to help you remove the threats by downloading an additional program or purchasing something
  • You PC is running slower than normal
  • Unable to play a favorite game, or, in their words, “It was acting weird!”
  • Inability to not load certain websites

Real World Example that is beneficial to both the work environment and at home

Scenario X

Scenario X – Work

“A company in a heavily regulated industry (such as banking or health care) may restrict its employees’ use of instant messaging (IM) due to regulatory concerns. To bypass this restriction, a new employee who wishes to chat with friends while at work brings in a USB flash drive with a portable instant messaging (IM) program on it. While free, the program is supported by advertising. It turns out that a criminal bought space on the advertising network used by the program, and uses a maliciously crafted advertisement to inject malware into the new employee’s computer, which then acts as a springboard for stealing the company’s intellectual property.” (Goretsky, 2011, p. 3)

Scenario Y

Scenario Y- Home

“Potentially unwanted applications are not limited to the office. Imagine the following scenario: A child using a family computer downloads a “utility” program in order to add additional features to his or her instant messaging program or Minecraft account. The child clicks through the program’s installation process, ignoring the end user license agreement (EULA), and thus doesn’t realize that installing the program will also install adware that monitors user behavior and displays targeted advertising, and that replaces standard search recommendations with paid search results. The adware may then go on to redirect search results to sites from which additional malicious software can be deployed” (Goretsky, 2011, p. 3).

To remove this annoyance

  • She upgraded her antivirus to the latest version (worth the money) to locate and remove the potential threats.
  • The installed and upgraded antivirus actually found a variant of WIN32/AdWare.MultiPlug.N application, where a message informed the User that it was cleaned by deleting or quarantined.
  • Several others were identified but not recorded, these would be available in the AV log.
  • Performed several rounds of full system scanning.
  • Reconfiguration of the anti-virus software to update itself regularly.
  • The User had to modify behavior and occasionally check that the anti-virus software was the latest version, receiving regular updates, and that they added the license validation/renewal date in their calendar alert to renew my license prior to expiration.

Where it went wrong

The User had forgotten to update her anti-virus because she was too busy at work. She figured it was only her home PC and there’s nothing she needed to keep confidential or safe from prying eyes…Wrong! There were photos of  her family, letters, their family’s home addresses and birth dates, copies of their own school work that was as yet unpublished, and more.

To Date

The User actively checks that their anti-virus is up to date. Behavior was modified to include understanding that “installing security software is the first step toward cybersecurity.” Their extensive research for the best anti-virus product they could afford for their home computer involved several steps. They (family) used several sources online such as PC Mag digital edition, 10 Best Online, and reading AV Comparative’s tests results. AV-Comparatives is an independent not-for profit organization where they test security software and determine if they live up to their promises. Thirdly they educated themselves with how to navigate the Internet with safety in mind. ESET Smart Security 7 provided the User with a training module complete with real life scenarios and tips for protecting their computer. ESET received high marks according to independent testing laboratories or an AAA rating, which is the highest possible from Dennis Technology Labs for example (Rubenking, 2013). However, ESET was not perfect either because in one test of blocking malicious URLs, ESET only blocked 41% of the over 100% URLs tried (Rubenking, 2013). Avast Internet Security 2014 received a better score which blocked 79% in the same category (Rubenking, 2013). The User enjoyed reading the 10 Best Online review because it was easy to see the comparison due to the visual details. They use the popular “5 Star Rating” (10 Best Online, 2014).

However, the bottom line is to find what is more important to you as a User and prioritize your needs.

The User expressed regret and misses playing a video game that their children had introduced to them as it, “Had simply disappeared!” It was probably due to a deleted or corrupted DLL file, or a dependent DLL was upgraded to a new version.

Interesting facts

Either way, the User reported learning their lesson to continue to implement controls similar to their work environment on their home PC. In addition, they reported protecting all of their digital devices including their smartphone, tablet, desktop computer and laptop, even when used only in the home environment.

A few free tips:

In addition, protect your personal email, only use secure and private connections, don’t submit vital information such as your social security number online, check a link’s authenticity, creating a strong password for online accounts, change your password at least every three to six months, enable strict privacy settings on my networking sites, don’t link with anyone you do not know, think twice prior to sharing information or at least limit the details such as not providing your GPS location which will tell others that you are not home and become a target for physical theft for criminals, don’t clink on links in email, even if they are from known individuals, instead re-type important URLs into a fresh browser window after ensuring Real Time Protection is enabled on your PC, and be extremely wary of joke and humor sites, online surveys, and other questionable websites.

For your own organization’s Privacy and Security Training contact RISC Management and Consulting, LLC at or visit our website 


ESET. (2014). ESET: Virus radar. Retrieved from

Microsoft.(2014). Microsoft support: What is a DLL. Retrieved from

Goretsky, A. (2011). Problematic, unloved and argumentative: What is a potentially unwanted application. Retrieved from

Rubenking, N. (2013). PC Mag: ESET Smart Security 7. Retrieved from,2817,2428165,00.asp

Ten Best Online. (2014). 10 Best antivirus software comparison for 2014. Retrieved from