"Here You Have" ...
... a user IQ test
If you've not been unlucky enough to run into it and/or see the news of the last 24 - 48 hours, there's a nasty little e-mail worm making the rounds, normally with a subject line of "Here You Have" or something similar. Attached there-in is a .scr file and/or .pdf attachment that includes some nasty payload objects that will load your system up with a keylogger and other unwanted items.
I bring up the issue because as the issue ignited it reared its ugly head at my place of work as more than a few people in my area fell victim to this latest example of social engineering. Apparently all of them forgot a few basics about having and using an e-mail account:
First, is the e-mail from someone I know?
Second, was I expecting communication from this individual?
Third, NEVER RUN FILES THAT SOMEONE ELSE SENDS YOU VIA E-MAIL, NO MATTER HOW WELL YOU KNOW THEM. If you really trust the individual and have communicated through other means such that you know they sent you something, then you might chance it, but you are still far better off to go find whatever it is for yourself -- from a reliable source -- and then run a copy that you obtained through proper channels.
Thank the powers that be that most of our users (at my job) are locked down such that they can't install software on their systems. They can try, but they don't have the rights necessary to do it. In the past I used to complain about that a bit as most of the users in my area are smart enough and reliable enough to be trusted with such rights, until, well, until they prove otherwise, which some of their brethren did yesterday.
So, as PCWorld (among others) noted, if you are too much a goofball not to fall for such things, you've proven your own incompetence in dealing with social engineering attacks and flunked one of the simplest IQ tests. Congratulations, we'll be by later to confiscate your computer and help you pack up your office if need be ![]()