Targeting: Malicious email may be targeted specifically at you or may be shotgunned to as many recipients as possible. The email that is sent to a wide range of recipients is generally more easily identifiable as potentially malicious. The email that specifically targets you can be extremely difficult to detect. There is a cost trade-off to the sender: it is cheap and easy to send the same email to thousands of recipients, while it is quite costly to develop the knowledge base required to specifically target a single person in a believable manner. The two types of email are referred to as UnTargeted Malicious Email (UTME) and Targeted Malicious Email (TME). UTME is sent to as many people as possible: it is, by definition, un-targeted. TME, also known as spear-phishing (a play on the term “spear-fishing”) is much more precise, targeting as few as one individual with a highly personalized attack designed to be as effective as possible. It is very expensive to develop the level of information about a single person—their work habits, their conversations, their likes and dislikes, and son on—to mount an effective TME attack, so that level of effort is typically reserved only for very high value targets. An example of the type of target that would warrant this type of effort would be someone in a high technology enterprise who has easy access to the details of marketing plans or development ideas. Getting such a person to open an attachment in an email can open the entire corporation’s network to the attackers, allowing them unfettered access to very sensitive data.

Addressing: Malicious email senders normally do not want their real identities to be discovered, so may use a variety of hiding techniques to mask the true source of the email. The visible sender identity may be forged as that of a very common name, to mimic an identity in your contacts list, or as that of a celebrity. One of the first tricks to identify potential malicious email is to look at the invisible parts of the addressing to see what it really looks like. Chapter 4 will deal with this in detail.

Content: Malicious email can contain a variety of content types that are dangerous. Some of the most innocuous malicious messaging is chain messages, typically forwarded or shared many times, which contains a distorted version of events designed to elicit an emotional response in the recipient. The purpose of these malicious emails is to affect belief structures, and these mails are called either Meme-Propaganda or Memetic Attacks. The examples provided in Chapter 2 covered a large variety of the types of content in malicious messages, although it is worth noting that the imaginations of the attackers are without bounds. In fact, they are quite amazing. One example of a malicious message alerted a recipient to a purported dead body found outside and asked that the recipient open the attachment to identify the decedent. This simply illustrates that nothing at all is off-limits.

Adam Vitale: Mr. Vitale pleaded guilty in 2008 to violating US Federal law for spamming people. He claimed to be making $40,000 per week doing this. He specialized in stock price scams, so that the insiders could profit from selling stocks whose prices had artificially inflated as a result of their activities, although was willing to engage in a variety of other scams, including advertising computer security software.¹

Two Nigerian Scammers: Mother Jones reporter Erika Eichelberger wrote of meeting two young men engaged in what they referred to as trickery, “insist[ing] that tricking someone is not the same thing as stealing” from them. These two men participate in advance-fee scams, also known at the 419 scam, and claim to be worth about $60,000 each.²