Bob Young on Nostr: A friend asked (paraphrased slightly), “Bob, here's a serious question. What would ...

A friend asked (paraphrased slightly), “Bob, here's a serious question. What would you gauge danger-wise on malware attacks based on potentially malicious websites one might be fooled to click on? I ask because I've had people ask me about getting spam emails saying that they’re compromised due to visiting a website, even if they have an antivirus product or Internet security suite installed. It sounds like a standard social engineering/ransomware scam...but with all the zero-day exploits in the news, it makes one wonder.”

MY ANSWER
That’s a great question, thanks for asking! First, I know from your technical background that you understand these things, but I’m going to start with a vocabulary section for the sake of others who might read this. Then I’ll get to the answer.

Zero-day vulnerability – This is a vulnerability that has just been discovered. The cybercriminal may publish information about the vulnerability to other criminals, but the software manufacturer has had no time to write corrected code.

Exploit – An exploit is when a cybercriminal takes action on a vulnerability. Vulnerabilities can exist without being exploited. This is more common than you might think, because some vulnerabilities depend on a complex set of pre-existing conditions that aren’t easy for the cybercriminal to reproduce.

Zero-day exploit – A zero-day exploit is an action against a zero-day vulnerability.

Known Exploited Vulnerabilities (KEVs) – The Known Exploited Vulnerabilities Catalog is maintained and published by CISA. I’m not going to put the link here. You can find it with any search engine.

Common Vulnerabilities and Exposures (CVEs) – The CVE List contains all known vulnerabilities (strictly speaking, but we’ll ignore the exceptions). This list is longer than the KEV Catalog. The definitive CVE List is at cve(dot)org.

Now that the vocabulary lesson is out of the way, we’ll get to the answer you were asking for.

1) Zero-day vulnerabilities do exist. Some zero-day exploits can be stopped by antimalware solutions, if the exploit is behavior-based, pattern-based, or otherwise recognizable. But, most of the time, zero-day exploits slide right through the defenses.

2) The spammer does not – indeed, cannot – know if your computer has been compromised. The only person who knows is the actual cybercriminal who ran the exploit.

3) The cybercriminal who ran the exploit usually doesn’t want you to know your machine has been compromised. They won’t send you an email!

4) In the case of ransomware, the cybercriminal’s message usually (always?) appears on screen. It’s not an email.

5) Summary: Yes, your computer can be infected without your antimalware product detecting it. But the cybercriminal is unlikely to email you. The email “informing” you of malware is almost certainly a social engineering attack, unrelated to anything.

#CallMeIfYouNeedMe #FIFONetworks

#AskBob