1. Internet Hoaxes
Charles Hornat
April 29, 2003

2. Agenda Defining a Hoax Types of Hoaxes PayPal Example
Microsoft Example
How to Identify Hoaxes
Resources
In this quick presentation, we will examine Internet Hoaxes and how to identify them. Two examples that recently were received will also be dissected so that you can see the steps taken to determine their validity (or lack thereof).
Copyright 2003

3. What is an Internet Hoax
An Internet Hoax is an sent to you that contains false information and intends to deceive you into doing something.
An Internet Hoax is basically an meant to deceive or threaten the user into performing a specific action. That action could be to forward an to multiple people, disclose personal or confidential information, or trick the reader into installing or deleting applications on their computer.
Copyright 2003

4. Types of Hoaxes Ex.: AOL and specific files in the OS
Malware Alerts – Viruses, Worms and Trojans
Ex.: AOL and specific files in the OS
Urban Myths – Stories
Ex.: Columbia Explosion and WTC
Give Aways – Gifts to those who comply
Ex.: Outback Steak and Applebees
Inconsequential warnings – Ill speaking of companies
Ex.: Pepsi and Dr. Pepper
Sympathy Letters and cries to help someone
Chain Letters – Tag with s
Threat Letters – Threatens you to take action
Scam Letters – Convince the reader to disclose credit card or personal info.
Ex.: PayPal, IRS and AOL
Hoaxes can be categorized into a lot of different categories. Some of the more popular ones are outlined above.
There is one additional hoax I have seen several times and each time has been a bad experience. A coworker got an recently explaining of a new virus that is causing havoc on the Internet. It instructs the user to search their computer for a file, and delete it if found. Of course the un-suspecting user opens up Internet Explorer and searches for the file. And of course the file is found. And of course they delete the file. Later on that day the computer does not operate correctly, and is constantly crashing or is too slow.
Copyright 2003

5. PayPal Example Copyright 2003 www.infosecwriters.com
This is an example of a scam letter . It is meant to convince the reader that PayPal is looking out for my best interest. The only problem is I don’t have, nor I ever used PayPal. Notice the header and their logo. Looks very official.
Copyright 2003

6. Microsoft Example Copyright 2003 www.infosecwriters.com
This is a real example that found its way into my personal account. Notice the sender and the layout. Even the copyright at the bottom is included. This is also an example of a scam hoax. The part that should tip you off on this is that Microsoft will never ever hotfixes or patches. They will give you basic information and a link to a page that has more details and includes a link to download.
Copyright 2003

7. Steps on Identifying Hoaxes
Does it ask you to send it to anyone?
Is it from a credible source?
Look at the header
Does the format include a:
Hook
Threat
Request
Most Hoax threats follow one simple pattern: Hook, Threat, and Request. The will first try to get your attention through a clever title and and start off with drama or other interesting tidbits. Then it will deliver some sort of threat For example, everyone who has deleted this has received 11 years of bad luck or something similar. Finally it makes a request. If you send it to 100 people, then the threat will not occur to you.
Second, is the from someone who is a security professional? Even if its from your mom, does she know enough to determine this to be credible?
The last two items are the most obvious. If it ask you to send it to anyone, it’s probably a hoax. Antivirus and application companies will not ask you to anything to anyone. They will do it themselves. And look at the headers to make sure they are from the source they appear to be from. We will cover the technical aspect of that later in this presentation.
Copyright 2003

8. Examining the PayPal Example
Before ever clicking on the link, you should check the destination. To do this simply hover your pointer over the link and the URL should appear in the bottom of your browser. However, this can be deceiving as well. The best way is to right click on the link, and select properties. In this example, you will find the url: Notice the sign. Anything before that is irrelevant. Everything after that is the real link. One could put anything they wanted in front of that sign. For more information on URL manipulation, go to:
Copyright 2003

9. Examining the Microsoft Example
In this particular hoax, the gives a subtle hint to possible foul play Further research will be needed to confirm the suspicions that that ID is not real.
Copyright 2003

10. Examining the Microsoft Example
The best way to tell if an is from who it claims to be is to view the header. This can be done several different ways depending on the application you are using. If you use Yahoo, then there is an option in the upper right corner titled “Full Headers”. When we selected that for this example, we found the “Return Path” to be: This doesn’t sound like an official Microsoft address does it?
If you also look at the “Received” items, they all include a *.cox.net (nothing regarding Microsoft). Even the “Message ID” is referencing *.cox.net.
Headers hold a great deal of information!!!
Copyright 2003

11. Additional Resources
Finally, you can search the Internet for further information. When you get a possible hoax, and you want to research it, simply go to google or yahoo ( or and type in the title of the or other relevant information and see what comes up. You can also reference the sites listed above for further information as well as additional steps on combating Internet Hoaxes.
Good Luck!
Copyright 2003