Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I received a suspicious personal email from someone whose username is the first and middle initial, and last name, of a friend. (My contact with said friend is usually via social media.) Header info indicates it originated in Vietnam and arrived via a server in Utah.
Coincidence, or change my password? I have in the past implemented weighting to identify spam, but I wonder what methodology might be used to assess this?
This is a simple attempt at phishing. It is not hard at all to spoof an email and make it appear as it came from whatever address you want. If you don't open the email you are fine. If you open it but do not click any links or allow to run any scripts you are fine.
How serious it depends on exactly what the email content was and what links they tried to get you to click. If you clicked a link and it looked like your bank's page, then yes call your bank and put extra security measures on your account.
How this comes about would be if one of your facebook friends has security set to allow anyone to view their friend's list, or their account was compromised. That si how they learned of your connection to the person whose address they spoofed the email. The reasons for doing this is because if you think if the email is from someone you know, you are more likely to open it and handle it as trusted.
How they got your email address is another thing to think about. If your facebook friend has their friends list set to public, that still would not reveal your email address unless you have your email address visible to everyone. If your email address is set to be visible to only friends, then one the attacker friended one of your facebook friends ( which isn't hard to do) and that made your email address visible to the attacker. I set my email to visible only to me. This is what I recommend because you cannot control the security practices of your friends or keep them from accepting friend requests from attackers.
Another possibility is they had your email address to begin with, from some other means, and perhaps your friend list is set to public, so they started with your name, then got your email, and then got your friends list so they could craft an email that looks like it is from someone you know and trust.
One of the keys to make a successful attack is to know the victim (where they live, eat, etc.) and their relatives,friends, etc.
In this case, it depends a lot on whether the mail you recieved is a phising attempt or not:
Answering "Yes" to any of the above questions doesn't mean you are 100% under attack, maybe it's your friend the one being scanned.
What would I do?
