Malware: how a file you open starts working against you

Rono's calls no longer work at the web host, so he writes to Miva herself. The email looks like a hundred others in her inbox: a wax supplier, new prices, a file attached. Nothing on it says Rono wrote it. Miva buys wax every month, so she opens the file.

But the file is not a list of prices. It is a program dressed as a document, with the name and the look of one. Opening it shows no list: it starts the program.

Here is the trouble. Once it runs, the computer does not judge a program by where it came from, but by who started it: Miva. So the program gets her rights. Everything Miva is allowed to do, it is allowed to do too.

And Miva can do a lot. She can open the customer list, use the passwords saved in her browser, send files anywhere. So the program does it all, quietly: it sends the list and the passwords to Rono, and fetches more of his programs.

A program like this one, made to harm whoever runs it, is called malware. One that comes in dressed as something useful has an older name, a trojan, after the wooden horse of the Greek story, with soldiers hidden inside.

Miva starts to wonder about that email, and calls her real supplier on the number she already has: they sent nothing. She wipes the laptop clean, changes every password and warns her customers. From now on, a file she did not expect waits until its sender says yes.

Rono needed Miva to open his file, as he needed the help desk to pick up the phone. Every trick so far needed a person to fall for it. So are you safe if you click nothing at all?