Hotmail/Yahoo Spam... How?

[Vini]

Last week my girlfriend's Hotmail address book got hit by spammers, her sent items had the messages that were sent which led me to believe her account had been compromised...

Today, a couple of colleagues have had the same, one with Yahoo, another with Hotmail.

Is there a hole in the Yahoo/Hotmail platform, or have the accounts been hacked?

How does this kind of 'spam' work.................... I'm fully aware of spoofing etc (which this is not - is it?), so this one has me stumped.

[peterb]

Weak passwords and a brute force attack? Or compromise of a computer used to log in (an internet cafe or wifi spot if the link wasn't encrypted?)

[Vini]

It feels more "automated" / "bot" driven... Of course, I've had all users change their passwords/questions etc, but it appears to be driven by the receipt of an email...

IE. the email comes in (remains unread), scours the address book, forwards itself onto the address book...

(this is all what I'm being told by the user(s) - and appreciate it's possibly not the case but if true, it's a tricky one for my bonce!)

[kalniel]

Credential stealing then automated log in/spamming. Lots of different ways the credentials are stolen - phishing, server/database hacking, other server/website hacked and stolen credentials attempted on common mail companies etc (often via the forgot password functions).

Most of the major mail companies have been hacked at some point - best to treat the password as essentially throwaway and always use a unique one for the mail client and keep changing it.

[Vini]

Credential stealing then automated log in/spamming. Lots of different ways the credentials are stolen - phishing, server/database hacking, other server/website hacked and stolen credentials attempted on common mail companies etc.

Most of the major mail companies have been hacked at some point.

The above is my take on "how its done" ... but again, the users are adamant they've not been phished, clicked dodgy links and in one case, the email address of one person who's been "hacked" doesn't even give out the information/email address......

The fact that the spam messages are in the outbox/sent items, to me insinuates someone/something has had access & been in!

[kalniel]

The above is my take on "how its done" ... but again, the users are adamant they've not been phished, clicked dodgy links and in one case, the email address of one person who's been "hacked" doesn't even give out the information/email address......

That's fine, but doesn't do anything to stop someone hacking the mail server database. But chances are they will have been phished without knowing it. I defy most people to see the difference between a yahoo front end and an exact copy spoof front end or one with an iframe overlay - they STILL don't insist on secure connections.

http://crave.cnet.co.uk/software/pas...line-49303832/

And it even happened to me I think - I had an account compromised for an online game and everything stolen - and I'm even someone paranoid enough to run no-script all the time. That or their server was hacked, which they deny.

[Vini]

so again, back to my theory;

-credentials are "gained" (phished/keylogger/somehow!)
-credentials go into a nice big bucket with other users credentials which may sit dormant for a while
-credentials are entered into a nice computer capable of "attempting to access many accounts at once"
-once in, a 'script' runs and sends this 'spam' to the entire address book
-process continues

(obviously in vague-st possible terms!)


So changing the password & questions, is the best procedure to attempt to combat this....

[Ferral]

I have been getting it for a while now also with my Yahoo account. Bizarre thing for me is that I get job emails continuously sent to me. There is nothing in the sent box but it shows the sender as my email address to myself. Dont know how and why its happening, it just is. Guessing someone has gotten hold of my email address.

Its really bizarre.

My GMail account got hacked a few month back from someone in China, shortly after I stopped playing WoW as that also got hacked whilst changing phones and had yet to get the authenticator installed.

I think the GMail account getting hacked had something to do with an app I downloaded for my Android device. Not 100% sure though.

My hotmail account has been fine however.

Recently changed GMail account password and I am going to change my Yahoo one in about 10 mins time to see if I can combat it.