How To Spot Unsafe Email Attachments
Unsafe Attachment in Emails
Email remains a prominent attack vector for hackers, cybercriminals, snoopers, and other online miscreants. As such, it’s vital that you know how to spot an unsafe email attachment.
If you’re not sure where to start, keep reading. We’re going to explain several red flags that’ll help you identify potentially dangerous files in your inbox.
1. Dangerous File Extensions
Unfortunately, there are several file extensions that could potentially run code on your computer and thus install malware.
As you’d expect, hackers don’t make them easy to spot. Often, dangerous file extensions are concealed in ZIP files and RAR archives. If you see either of those extensions in an attachment that doesn’t come from a recognized contact, you should treat it with suspicion.
The most dangerous file extension is EXE. They are Windows executable files that are particularly hazardous due to their ability to disable your antivirus app.
Other frequently used extensions to watch out for include:
- JAR: They can take advantage of Java runtime insecurities.
- BAT: Contains a list of commands that run in MS-DOS.
- PSC1: A PowerShell script with commands.
- VB and VBS: A Visual Basic script with embedded code.
- MSI: Another type of Windows installer.
- CMD: Similar to BAT files.
- REG: Windows registry files.
- WSF: A Windows Script File that permits mixed scripting languages.
You also need to keep an eye on Microsoft Office files with macros (such as DOCM, XLSM, and PPTM). Macros can be harmful but are also commonplace especially in business documents. You’ll have to exercise your own judgment.
2. Encrypted Archive Files
As we just alluded to, archive files (such as ZIP, RAR, and 7Z) can conceal malware.
The problem is especially acute for encrypted archive files i.e., those that require a password in order to extract their contents. Because they are encrypted, your email provider’s native antivirus scanner cannot see what they contain, and thus can’t flag it as malware.
The counterargument is that encrypted archive files are an excellent way to send sensitive data to a recipient; they are widely used for that purpose. Again, you’ll have to exercise your own judgment and make a decision about whether the file is safe.
3. Who Sent the Email?
It goes without saying that an email from a nonsensical address is almost certainly something you shouldn’t open. Instead, immediately flag it as spam and remove it from your inbox.
That part is easy, but the situation can quickly become more complex.
Malicious actors are experts in making email addresses look like they are from an official source when in practice, they are phishing attacks. For instance, perhaps your bank’s email address is [email protected]; a hacker might send an email from [email protected] instead. That’s easy to overlook when you’re scanning through your inbox in a hurry.
In theory, you can spot spoofed emails by investigating the email’s source code, but it’s way beyond the abilities of most users. If you’re not expecting an email from the sender and the attached file ticks some of the other boxes we’re discussing, it’s probably malware.
Finally, remember that an attachment could be malicious even if you know the sender and the email is not spoofed. If the sender’s own machine is infected, it could send emails to their contact list without their knowledge.
4. Strange Filenames
In the same way that you should treat random email addresses with extreme distrust, so too should you be wary of attachments with filenames composed of random strings of characters.
People don’t save documents with a 20-character alphanumeric code as its name, and your computer would never prompt you to do so.
5. Study the Contents of the Email
The text of the email can offer some clues about whether the message and thus any attachment is trustworthy.
Bots write many of the spam emails, spoofed emails, and phishing emails that you receive. They often have lousy formatting and spelling errors.
There are other little giveaways, too. For example, perhaps an email that’s purportedly from your best friend refers to you by your full name rather than your nickname. Or maybe it uses formal language and another syntax that you know the person in question would never use.
