Film-Tech Forum ARCHIVE: Beware of email from Cinevizion

This is topic Beware of email from Cinevizion in forum Ground Level at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=5;t=003221

Posted by Frank Cox (Member # 6258) on 09-17-2019, 01:42 PM:

I got this email from Mike Stewart at Cinevizion yesterday morning, with the subject line of "[EXTERNAL EMAIL] scannedDocucment sent to you via pdf":

quote:
An encrypted file as been sent to you.

ScannedDoc for __signingD2019/20-pdf

Kindly get back to me if you find it difficult to view.

The email had the usual footer information with his office address and phone number and so forth, but it looks rather like a spam to me so I sent a reply asking if this is a genuine email.

I got this response this morning:

quote:
Hello,

You’re receiving this email because you replied to a suspicious email sent from Mike Stewart’s account. Unfortunately Mike Stewart’s email account was compromised yesterday and it was used to distribute a malicious phishing email with this subject line. Please delete and/or mark this email as junk. If you clicked on the link in the email, you may want to alert your IT team as well.

Regards,
Chuck Girard, CineVizion IT

Yet another reminder why it's not wise to use Microsoft Windows for reading your email (or for any other purpose, really.)

Posted by Ken Lackner (Member # 1002) on 09-17-2019, 03:53 PM:

Yet another reminder of why it's wise to exercise precaution, as you did, when receiving suspicious email.

Why, exactly, is it not wise to use Windows?

Posted by Frank Cox (Member # 6258) on 09-17-2019, 04:09 PM:

Most of those types of email rely on things like malformed PDF, XML, ActionScript and the like to compromise your computer. As the largest "soft target", exploits that run on Microsoft Windows are the most heavily used for those purposes.

Windows is also a monoculture. Everyone uses the same desktop and the same programs to do the same things, so a flaw in, for example, the default PDF viewer that "everyone uses" will affect the majority of installed systems even if the underlying operating system is not being exploited.

Windows is also a black box where nobody really knows what it does internally and it's really difficult to check under the hood for rogue processes.

And by design (a single-user desktop operating system), Microsoft Windows installations suffer from the Dancing Pigs problem. Anybody and his kid or his dog can download something from a shady website without realizing the consequences.

Ultimately, you're far better off using an operating system that isn't Microsoft Windows to check your email and, preferably, to do everything else that you want to do on a computer as well.

Posted by Randy Stankey (Member # 64) on 09-17-2019, 04:27 PM:

I don't think any business should use Windows is wise to use Windows for any kind of mission critical systems.

Windows, especially, should not be used as an embedded operating system for any type of specialized equipment. It should be specially designed for that particular device. (Or class of devices.)

We already know that viruses and other kinds of exploits can cripple business computers and allow sensitive business information to be compromised and exposed.

We have already seen attacks on embedded operating systems designed to cripple or destroy the equipment that depends on them. (e.g. Stuxnet)

In the last movie theater where I worked, we had a Christie digital projector which started having problems with its touch pad controller. Something had gone wrong with the flash memory card that held its operating system. When we began to replace the bad memory card and rebuild the operating system, I was shocked to discover that it ran on Windows.

I firmly believe that if the projector ran on something else besides Windows, the problem would not have occurred or, at least, wouldn't have been as severe.

I believe that anybody who uses Windows for mission critical work takes a distinct risk of being shut down or even put out of business when the operating system gets compromised or fails.

Such a failure could cost a business tens of thousands of dollars or even millions. Such a loss could shut your business down or even put you completely out of business for good.

I don't even want to think about what would hapen if something like that ever happens in a power plant or some other kind of critical public infrastructure!

Posted by Leo Enticknap (Member # 534) on 09-17-2019, 04:52 PM:

The problem with advising against the use of Windows altogether is that it is like advising against the use of automobiles. Boycotting Windows carries significant disadvantages and obstacles. Your business may rely on applications software, the functionality of which cannot easily (or even at all) be reproduced under another desktop OS. If it is, the learning curve needed for you and your staff to come up to speed with the alternative could be significant. And other operating systems, especially MacOS, will restrict your choice of hardware more than Windows likely will. While a lot of cybercrime involves Windows-specific malware code, not all does: phishing emails directing you to a phony website has the potential to work on any browser, for example. Therefore, you have the false sense of security risk, too: "I'm using a Mac, Ubuntu, or whatever, so the bad guys can't touch me."

There are also ways to mitigate the risks of Windows, which in many cases will not be as disruptive or as costly as moving to another operating system. Use a relatively secure browser (e.g. Firefox) in conjunction with script-blocking plugins (e.g. NoScript), an email client configured such that it does not automatically download embedded images, a decent firewall, and use common sense, and you have effective protection against most threats.

I am by no means a Microsoft fanboy: my computers all dual boot to Windows 10 and Ubuntu, and I am probably using the latter around two thirds of the time. But there is a reason why Windows is so widespread: it supports a huge range of hardware, most professional applications software is designed for it, and it works reasonably well, most of the time.

Posted by Ed Gordon (Member # 10866) on 09-17-2019, 05:03 PM:

Spammers who are spreading malware like to target the users on the most popular operating systems in order to reach the largest audience. Currently Windows and Android have the greatest market share (https://gs.statcounter.com/os-market-share).

Regardless of your operating system, you should always have a good anti-virus program that will check your email.

Never open any attachments from suspicious senders.

Never reply to any suspicious email. Never click the "Unsubscribe" link. If you do, you might just sending the hacker a confirmation that your email is real, and they will share your address with other spammers.

Never use your personal email address to do business, or sign up for email newsletters, etc. Create another email address for use with entities you do not know personally.

Never CC others when you send email. You might be distributing valid email addresses to spammers. Alway use BCC so that recipients will not see the other email addresses.

Posted by Mike Blakesley (Member # 26) on 09-17-2019, 07:54 PM:

quote: Ed Gordon
Never reply to any suspicious email. Never click the "Unsubscribe" link.

My rule of thumb is, only click Unsubscribe if I've done business with the company involved. Drives me nuts that when I buy a product online, I immediately start to get email advertising the DAMN THING I JUST BOUGHT!

Posted by Randy Stankey (Member # 64) on 09-17-2019, 07:56 PM:

I’m not trying to say that Windows should never be used.

Personally, I don’t use Windows al all and I don’t recommend it.

I have never had problems getting Mac OS or various flavors of Linux to do anything I want to do. I have had occasional difficulty with interconnectivity but I always find a workaround.

No, I don’t expect everybody to understand computers as well as I do but I do expect people to understand that there are alternatives. It frustrates me when people deny the risks of only using Windows.

I don’t necessarily have a problem with Windows being used in the office. If your box office computers go down you can use roll tickets and you can keep your books on paper but if your projectors, servers or sound equipment goes down you are dead in the water.

I don’t mean to sound like I’m yelling, “The sky is falling,” but I do believe that the risks are real and the potential consequences could be disastrous.

I just wish people would realize the risks and take steps to avoid them.

I get pissed off when people blindly deny it.

Posted by Karl Belter (Member # 10813) on 10-11-2019, 08:33 PM:

I am network architect for a large hospital chain. Ignoring windows is impossible for most business. Ignoring security software on an Apple OS is just playing lottery. Let's just say marketing people love their MAC, they refused security so we put them behind a firewall. Guess who eventually got nailed and lost everything on that machine.

I'm not trying to get into a Mac vs PC vs Linux argument. All I am saying is protect your systems no matter what you use.

Posted by Sean Weitzel (Member # 244) on 10-11-2019, 09:39 PM:

also, backups, backups, backups, backups! (and periodically do a restore to verify the backups are actually intact)