SPAM EMAIL Re; CCC AGM

[Canonballer]

All,

This is just to let you know that I received an email a couple of days ago, with "Croydon Camera Club AGM" as the subject and from a sender called "News". I'm not normally taken in by Spam messages but unfortunately, I absentmindedly opened it on my smartphone and clicked on the link it contained, which I expected to point to AGM papers, but nothing happened. I later looked at this message on my PC and was able to view the "real" sender which turned out to be a scumbag called <b00348836@studentmail.uws.ac.uk>.

I think that my anti-virus software may have actually disabled the link, so maybe no harm has been done. Nevertheless, I thought I ought to warn everyone to look out for this spam, if they've not already received it.

Best wishes to all.

[davidb]

This was a copy of an email from 2016 sent out by our-then Hon Secretary. I also received a copy (on my desktop) and immediately junked it without response. If I'd know that it was received more widely I'd have posted a warning.

[Mike Farley]

Thanks for the warning, Dave.

David B's post provides a clue as to how this could have occurred, albeit it does explain how the e-mail came to be in the possession of a spammer. Understandably. I have just checked my own e-mail, including the Spam folder, and have not found anything similar. E-mail dates from the earliest days of the Internet and the protocols used are inherently insecure. Unfortunately, that does mean that a breach could have occurred at any point. Spammers can be inventive in finding ways to exploit weaknesses. If there was another mechanism for easy and cost effective communicatuion with members, our club would use it.

It is worth confirming the club's approach to e-mail. Members' details are held securely and only made available to a few club officials on a need to know basis. Communications are sent with recipients blind copied so that no one can see anyone else's e-mail address. At the start of the lockdown period, a few members wanted to be able to communicate with each other. With permission, their e-mail addresses were made visible in communications for a while. When it became apparent that this was causing confusion, I ceased this practice. Dave's e-mail was not one of those which was made visible. E-mails from the club should also have the sender's name and position prominently displayed in the text. Unless anyone has further suggestions, this seems to be as secure as we can make our communications.

This forum offers alternative methods to communicate with each other. There is a Private Mesasage facility which means that communication is contained solely within the forum and the server on which it is hosted, other than transmission over the Internet. Recipients receive only an advisory e-mail that they have a message if they have configured their preferences to allow this. It is also possible to send e-mails to other forum users. This is the only method members have of sending ad hoc messages to each other unless they have exchanged e-mail addresses. It also means that signing up to forum, which is not mandatory, is a prerequisite.

[Mike Farley]

An addendum to my previous post. I have now seen a copy of the spam e-mail and it features a hidden URL which the reader is encouraged to click on. Club e-mails do not use this type of hypelink and website addresses are always shown in full in our communications.

We do know that the e-mail account of one of our members was hacked recently and it is possible that is how the origin of the e-mail on which the spam one was based.