Chad Edmonds

Virus Hoaxes

Overview

Internet hoaxes and chain letters are e-mail messages written with one purpose; to be sent to everyone you know. The messages they contain are usually untrue. A few of the sympathy messages do describe a real situation but that situation was resolved years ago so the message is not valid and has not been valid for many years. Hoax messages try to get you to pass them on to everyone you know using several different methods of social engineering. Most of the hoax messages play on your need to help other people. Virus hoaxes are more than mere annoyances, as they may lead some users to routinely ignore all virus warning messages, leaving them vulnerable to a genuine, destructive virus

The Risk and Cost of Hoaxes

The cost and risk associated with hoaxes may not seem to be that high, and is not when you consider the cost of handling one hoax on one machine However, if you consider everyone that receives a hoax, that small cost gets multiplied into some pretty significant costs
The biggest risk for hoax messages is their ability to multiply
Most people send on the hoax messages to everyone in their address books but consider if they only sent them on to 10 people
The first person (the first generation) sends it to 10, each member of that group of 10 (the second generation) sends it to 10 others or 100 messages and so on

How to Recognize a Hoax

The first thing you should notice about a warning is the request to "send this to everyone you know" or some variant of that statement
This should raise a red flag that the warning is probably a hoax. No real warning message from a credible source will tell you to send this to everyone you know
There are several factors that make a successful hoax
The first factor is the use of technical sounding language

For example, the Good Times hoax says that "...if the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop which can severely damage the processor...". The first time you read this, it sounds like it might be something real. With a little research, you find that there is no such thing as an nth-complexity infinite binary loop and that processors are designed to run loops for weeks at a time without damage http://hoaxbusters.ciac.org/HBHoaxInfo.html#what

The second factor that makes a successful hoax is credibility by association

Credibility by association refers to who is sending the message
For example, If the janitor at a large technological organization sends a warning to someone outside of that organization, people on the outside tend to believe the warning because the company should know about those things. Even though the person sending the warning may not have a clue what he is talking about, the prestige of the company backs the warning, making it appear real. If a manager at the company sends the warning, the message is doubly backed by the company's and the manager's reputations
Usually the source says the virus is bad or has them worried

You have to be careful verifying the person as the apparent author may be a real person who has nothing to do with the hoax
If thousands of people start sending them mail asking if the message is real, that essentially constitutes an unintentional denial of service attack on that person
Check the person's web site or the person's company web site to see if the hoax has been responded to there
Another factor of a virus hoax is it warns you not to read or download the supposed virus, and preaches salvation by deletion
Also the virus hoax describes the virus as having horrific destructive powers and often the ability to send itself by e-mail
A virus hoax also usually has lots of words in all caps and loads of exclamation marks
These factors make it difficult to claim a warning is a hoax so you must do your homework to see if the claims are real and if the person sending out the warning is a real person and is someone who would know what they are talking about

Handling Hoaxes

You have to engage the thought process and actively apply what you know about the anatomy of hoaxes
Do exactly the opposite of what the hoaxes say you should do
Do not forward the false warning to others
Do send a message to the person who sent you the hoax message
Tell him or her it's a hoax and not to send it out to others
You may also want to point that person to various web sites, so he or she can also understand the nature of virus hoaxes
You can also tell someone to check out anti-virus web sites such as Norton or McAfee to whenever they receive a suspicious virus warning
Always remain vigilant
Never open an email attachment unless you know what it is--even if it comes from someone you know and trust.

Virus Hoax Test

If the answer is yes to any of these questions then the warning is a hoax
Does it tell you to warn everyone about the virus
Does it say that the virus infects by you reading an email with the virus name in the subject line
Does it say that the virus will erase or damage your hard drive
Does it cite the FCC as the warning source (The FCC does not ever issue virus warnings)

Helpful Tips to Protect Yourself

However, virus hoaxes notwithstanding, it is true that files attached to an e-mail message could be hazardous

The safest thing to do with files attached to e-mail is to delete the e-mail, and tell the sender you have done so, and why
Watch where you get your downloads
Be wary of anything that seems too good to be true
Most important, keep a backup of essential files that you create.