by Charles Miller

Regular readers of this column will have already heard my admonition to never, never, never, ever click on links in emails. I repeat this warning at every opportunity because year after year the most frequently exploited attack vector for viruses, malware, ransomware, etc. continues to be malicious links sent by email, text messages, WhatsApp, and other messaging platforms. When recipients of these malevolent communications naively click on the links, that initiates the process of permitting cybercrooks into their lives.

It came as no huge surprise when a client phoned me reporting that a message on her laptop said it was infected with a virus. She admitted she clicks on links in emails. Now she said every few minutes a warning window popped up on her screen, obscuring her work, and demanding immediate attention to remove an alleged infection. The message said her antivirus software subscription had expired and to “click here” to reactivate the protection. I have to give my client credit for knowing not to give the scammers her credit card number before calling me to ask me if that is what she should do.

I had already seen this same virus infection before and so I thought I knew what I was dealing with. Unfortunately, my previous experience caused me tunnel vision that took me down the wrong path for a bit. Following the same infection removal procedure that had worked before, I downloaded malware removal software and started a system-wide scan that ended up taking 4 hours 27 minutes to scan 505,396 files and other places infections are known to hide themselves.

Much to my consternation the scan only found some innocuous advertising spyware and another harmless tracker, unwelcome infections but nothing dangerous. The scan had failed to find the infection that was popping up the virus infection warning every few minutes. Following the checklist to remove the infection, I quickly ascertained that the infection simply was not there; yet every few minutes the scam virus warning message popped onto the screen. How could it be that there was no virus infection on the computer, yet the warnings continued to appear?

Push notifications is a feature created by Apple in 2009 to permit an app or website to “push” a short message onto the screen to convey alerts, updates, etc. Today, not only Apple but almost all computers and all smart phones include this “feature;” and it did not take long for crooks and con artists to start abusing it. This turned out to be the source of the fake virus warning messages I was seeing on the lady’s Windows laptop.

What some contemptible opportunists had done was to copy the content of a genuine virus warning message and push it out to unsuspecting consumers. That is why the virus warning looked like the one I had seen before. But there never was an actual virus. The message directed victims to a web site where they were urged to purchase a subscription to a genuinely legitimate antivirus program for their protection, and for which the people who sent the push notications apparently received a sales commission.

This is annoying to the point of being infuriating, but possibly not illegal. Laws protect the likes of slimy used car salesmen who cannot be sued for misleading sales pitches or for “fluff” (the legal term for hyperbolic promises never put in writing). Some are saying that the lowlifes who perpetrated this fake virus sales pitch scam are only using an aggressive sales technique to encourage people to buy a good antivirus program, and technically are not breaking the law.

Fortunately, push notifications are something that your computer and smart phone allow you to turn off; and you might consider doing that. So now in addition to urging that you should never, never, ever click on links in emails I need to also say you need to consider that you should never, never, ever click on links in push notifications either.

**************

Charles Miller is a freelance computer consultant with decades of IT experience and a Texan with a lifetime love for Mexico. The opinions expressed are his own. He may be contacted at 415-101-8528 or email FAQ8 (at) SMAguru.com.

Discover Lokkal:
Watch the two-minute video below.
Then, just below that, scroll down SMA's Community Wall.
Mission

Visit SMA's Social Network

Contact / Contactar