Lesson A4 covers the link hygiene - Avoiding Unwanted Infections and Scams From Email Links and Attachments

The lesson can be found by clicking HERE.

Please feel free to post your comments, recommendations or references by replying in this thread.

- Scott

Before I forget, there are a couple of common threats that people think of more in relation to social media websites than in the context of Email.

Cross-Site Scripting is a typical attack that can occur if you have multiple web pages open within a browser. If you happen to click on a link in an email message, it may open a new browser tab and if you have other web pages open already in the browser, the newly opened tab may take advantage of vulnerabilities in the site it sent you to, or in sites you already have open. It's a case of not realizing that attackers are going to try to get to your vulnerabilities indirectly.

The other related risk is through a threat called Cross-Site Request Forgery, which literally shows up as a link in an Email message or some social media content. The trick is that the hacker assumes you are already logged in to a site like online banking. They can form a link that tries to make some kind of request to the service you are already logged in to. For example, it could try to make a change in your Email address in your account settings. If it is successful, they may have what they need to do a password reset on your account without you knowing about it, which gives them complete control over your account.

So, for example, you receive an Email message from some friend saying they haven'ts spoken to you in a long time, but when they saw the article in the attached link it made them think of you. So, you click on it. But instead of going immediately to an article, it opens a page that seems to get stuck and doesn't go anywhere. In fact, the request is being made to your Twitter account settings. and your Email contact address for your Twitter account is being changed in a hidden window. You think it's just a bad link, but the attacker got what they wanted.

Some sites are aware of these risks, and have modified their sites to prevent this kind of request from happening. But it is still a common problem in some websites.