Dangerous Attachments

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 28 of 43.

An attachment is a file included with an email. You might expect an invoice to be a document, but an attacker can give a harmful program a name that makes it sound like an invoice.

You can read the email and its attachment details without opening the file. For example:

seclab email m7

Look for these lines:

Subject:  Delivery note
The ZIP contains delivery-note.exe.
Attachment: delivery-note.zip

A ZIP file is a package that can contain other files. This one contains delivery-note.exe. The .exe ending means it is a Windows program, so opening it would run a program rather than just show a delivery note.

Check files inside ZIP and ISO packages too. An .html file can open a fake sign-in page. Even a file named like a PDF still needs checking: the name alone does not tell you whether the sender or the request is trustworthy.

Challenge

Easy

Ticket from Omar, finance

Three new invoice messages arrived. Two contain files that could run a program or show a fake sign-in page. The other is a real supplier invoice. Inspect the attachments, quarantine both dangerous messages before anyone opens the files, and mark them as phishing. Keep the real invoice available.

Try it yourself

Terminal

All lessons in Security Fundamentals

2Phishing

Phishing Look-Alike Domains Who Clicked The Second Wave

5Email Attacks

Reply-ToDangerous AttachmentsWhere an Email Came From The Invoice Queue Business Email Compromise Blocking a Sender Mailbox Rules The Phishing Reports

3Access Control

Groups Least Privilege Admin Rights The New Hire Leavers Shared Accounts Separation of Duties The Access Review

6Rules of the Job

Authorization No Hacking Back The Vendor's Call