PDA

View Full Version : OT computer-related question


dddd
03-12-2020, 03:20 PM
Today I received in an email that looked like a most-useful assemblage of current facts regarding coronavirus Q&A, things I had actually been wondering about. I've posted it below because while I don't know it's author it was exactly about the questions I have been hearing everybody asking. It is a short few paragraphs.
EDIT: I see that copy and paste doesn't actually replicate the text, not sure what that means.

My question pertains to the email file's .docx suffix, usually a red flag for me that would keep me from clicking on the link.
The appearance of the "link" that I clicked on would appear to be a Word document image showing a page with a folded corner and with the blue "W" that looks like MSoft.
Moving the cursor over this colored image changed the appearance to a box with the word "preview" something that I thought made it safe vs. actually opening or downloading a file.

What I did was left-click so as to "preview" the document, which then appeared in the little scroll window.



I later called the sender who apparently was sent an email through a known friend, but she couldn't tell me who the author was or about the file source (assuming I even asked the right questions).

Did I possibly expose my computer to any rogue malware or viruses by "previewing" this text (clicking on the "preview box" while using my Firefox browser to view my web-based-email page)?
I can say that other known safe emails I receive seem to have the same preview box for viewing any attachments.
I never really thought about whether "preview" meant anything other than "open" the file!
This is in Yahoo mail btw, so maybe someone here knows what "preview" implies(?).

I can imagine rogue hackers taking advantage of the coronavirus panic so as to plant malware on a large scale, so urging everyone to be wary right now. I would hate to see a computer virus spread that might be worse than even the coronavirus spread!

Thanks for reading.

"    
     
  !"#$  % &
  #  #
' (    
   "# # 

( &   
)% #*  +,(-&'./0
 1    
' 20    
3 4   + 
  ($   
   $ 
5    
  
(65+789899+:90609&+7+98,(7:)
'(   
;   
< & ## = ;>;?
( )
@( A #' #  
# 
(   '; & 
 & 4 # 

>+# >&';  
?-    3
B2 3   &' 
#&  &#  
 
.C  8   

' $ & D
0)C65+6)
'(  $  <@
; #    
 # >
<2   #
@   4C $($ 
  "

schwa86
03-12-2020, 04:06 PM
I can’t speak to your specific situation, but I work at a major hospital and we were warned by our ISD folks that there are a number of malware/phishing activities going on using Covid-19 as a hook.

ORMojo
03-12-2020, 07:09 PM
Did I possibly expose my computer to any rogue malware or viruses by "previewing" this text (clicking on the "preview box" while using my Firefox browser to view my web-based-email page)?

Short answer: Absolutely yes.

There is a reason Microsoft includes this security warning before using a preview filter for the first time: “You should only preview files from a trustworthy source”. That’s just a precaution by Microsoft, really wording from MS Legal, disclaiming themselves from liability.

Your risk is likely very low, but, again, the direct answer to your question is that the "Preview" function does not provide 100% protection against infection.

dddd
03-12-2020, 08:08 PM
Thanks, and what I suspected.

My understanding is that opening or "previewing" email messages has long been considered completely safe.
So I have to wonder why Yahoo Mail uses the term "preview" as what is occurring when one opens an attachment like this one. I might have expected that to somewhat limit what occurs when a quick look or "review" is all that one wants to do.

ORMojo
03-12-2020, 08:15 PM
A "Previewer" is simply another application. One you (usually) don't launch in the normal way, but none-the-less a full-blown application. What is happening when you use a Previewer to, for example, preview a Word document, is that instead of using Word to open the document/attachment, the Previewer application is in fact opening the document. It has to "open" it in order to preview the contents for you.

While this is a much safer/lower-risk approach if you really must "preview" the contents of an attachment from an unknown source, it is still an approach that can theoretically be taken advantage of by a malicious actor..

ORMojo
03-12-2020, 08:47 PM
As I just posted in the coronavirus thread, coincidentally this just came in from our IS Manager: "The region saw a substantial increase today in phishing messages related to the coronavirus. Please help us to protect data security by NOT clicking on links and attachments in messages that look unusual, as they may contain malicious code. Specifically today there were two scams to be on the lookout for: One is a fake notice regarding “John’s Hopkins” and a coronavirus outbreak map, and the other is a fake update message from “ESRI”. Also be on the lookout for robo calls related to current events, as we have also seen an increase in those." (My company also runs the regional telephone consortium.)

martl
03-13-2020, 01:29 AM
Never *ever* click on anything you got by mail from someone you don't know and have no reason to expect mail. Do not forward it to anybody. Simple rule.

dddd
03-13-2020, 03:13 PM
Never *ever* click on anything you got by mail from someone you don't know and have no reason to expect mail. Do not forward it to anybody. Simple rule.

Yes, what I already knew but without understanding how Yahoo online mail pages actually work.
I was glad ORMojo was able to explain that it was another application actually opening the link in the message, but I am still troubled that "preview" was something that I could not define.

I actually received the email message from a trusted source, who was forwarding the link that she got from a trusted source.
But the trusted sources could be from your church and the ostensibly "useful" link could still be from who-knows-where.

I'm pretty lame when it comes to IT stuff, so I did feel a certain bit of relief on Wednesday when the rider who's new and fully-charged Di2 gruppo stopped working abruptly wasn't me. Luckily, while he was stuck in the lowest gear, he was at that point only 2-1/2 miles from the bike shop where he had just had his new-and-already-Calfee-repaired bike reassembled earlier in the week.