« Drowning in Denial | Main | One Airplane I Wouldn't Want to Be On »

January 15, 2007

Looking through my backlog of email stopped at my server today, I came across this gem:

Subject: Your New ICQ Password
From: ICQ Password Assistance

Hello,

As a part of our general efforts to improve the ICQ service, we are currently upgrading our password assistance system.

The new system is based on a question & answer format.
This means that each time you would like to get a new ICQ password you will be asked to provide the answers to two questions that you have chosen.
Once you have set your questions & answers, you will be able to get a new password using the password assistance system.

To set your questions & answers, simply click this link and open keygen:
http://www.[removed_for_your_safety].com/keygen.exe

Your confirmation code is:
58FED9627787180D743DBC30B6EE31AB70FDBFED7AB80DA5A0A25A6C357929F9778123D455=
E60A76600112165620B46EEC22CB2B6C885729599F1521B60EEF227DFD25B84047A2063D9C=
CF01DACD5A735FE5A53F52F74C490FE4F84AF6F4E029
The ICQ Password Assistance System.

The only reason this caught my eye is that I've had an ICQ account for eons, although I use it very rarely. (ICQ, for those unaware, is a live chat protocol, for which you need an ICQ program on your computer to conduct live typewritten chat with a friend, family member, etc.)

That a system accessible via a username/password combination would offer additional "protection" against password theft is nothing new. My bank recently implemented a system like this for online transactions. I could see a lot of ICQ users thinking this thing is legitimate. I mean, look at that huge confirmation code!

But what stinks to high heaven about this email request is the fact that you are asked to download and open an executable file (keygen.exe)—not to mention that the domain name of the URL has nothing whatsoever to do with ICQ (it has some Scandinavian names within it).

It turns out that the file, if run on an unprotected Windows PC, would start loading all kinds of spyware and other junk on your computer. Your computer would be, in today's gamer lexicon, pwned (translation: "owned"). Say goodbye to many things on your computer you hold dear (passwords, addresses of all email correspondents, etc.); say hello to many things you probably don't want (popup porno ads, behind-the-scenes spam spewing, etc.).

While many anti-virus programs would have caught this (if they had been updated within a few days of my receipt of this message), some very popular ones don't recognize the file at all. That's why we can't rely exclusively on technology to prevent problems. Awareness and a healthy dose of paranoia are essential tools in the fight.