Heads Up : Email Hacking Incident

23 replies
Hi,

I would like to share a great concern about free email addresses. I have had a bad experience several hours ago.

My HOTMAIL account was hacked despite having a fairly strong password ( with special characters, numbers and alphabets ).

The hacker then sent emails to 20 people I have been corresponding, actively. He then deleted the SENT emails from the sent box.

I'm assuming 2 things from this incident:
1. Either HOTMAIL has no lock-out system or most probably he is using a kind of tool (brute force) over a period of time so as not to lock him out while he was hacking. It seems he has been targeting me.
2. As he did not change my password and he deleted the SENT mails, he is planning to send more emails in stealth mode. He plans to destroy me quietly.

Luckily, the HOTMAIL account is not a major one, as it was set-up to correspond only to a small number of people.

My main mistake is not changing the password every month for this account.

It is very important to maintain the security of email addresses, especially the ones regularly used in Internet Marketing and Payments.

If such email accounts were hacked, it may land me in hot soup. What worries me most are the unknown negative impacts and the trouble to recover. The thing I hate most is people will report me as a spammer as well as being blocked from my payment providers.

Here's my take. Change passwords to stronger ones and do it monthly.

So IM'ers, please be aware, even if you're using your own domains.
#email #hacking #heads #incident
  • Profile picture of the author ShowSpace
    Thanks for the warning, but since you said your password was fairly safe with special characters and numbers, a brute force hacking attack is unlikely.

    Are you sure you didn't use the same password (or a very similar one) one some other website or wrote it down somewhere (digital or in the real world) where someone else might have gotten access to it?
    {{ DiscussionBoard.errors[5025192].message }}
  • Profile picture of the author Paul Myers
    azmanar,

    The spammer isn't targeting you personally. This is a very common problem with freemail systems. I've gotten a lot of this sort of spam from addresses at AOL, Yahoo, and Hotmail.

    Check your computer for keyloggers.


    Paul
    Signature
    .
    Stop by Paul's Pub - my little hangout on Facebook.

    {{ DiscussionBoard.errors[5025199].message }}
    • Profile picture of the author Bruce NewMedia
      Originally Posted by Paul Myers View Post

      azmanar,

      The spammer isn't targeting you personally. This is a very common problem with freemail systems. I've gotten a lot of this sort of spam from addresses at AOL, Yahoo, and Hotmail.

      Check your computer for keyloggers.
      Paul
      Same here. I've gotten this from Yahoo addresses. I now change my passwords regularly. It can really turn into a mess though, if you don't catch it right away. In my case, they deleted my address book.
      _____
      Bruce
      {{ DiscussionBoard.errors[5028446].message }}
      • Profile picture of the author WealthyBlogger
        I have an acquaintance who has a yahoo email account, and his account was recently breached and spam emails sent from it to those he had sent email to from that account.

        He uses the computer at a local library as he does not have his own computer or laptop.

        I suspect that these library computers are probably not all that secure and who knows what is on them?

        As well, one should be vigilant when using other computers to make sure that the username and password isn't "remembered" by the browser.
        {{ DiscussionBoard.errors[5028510].message }}
  • Profile picture of the author Robbie B
    Never had any problems like that but this is the 2nd time I've heard of this sort of hack. Scary!
    {{ DiscussionBoard.errors[5025320].message }}
  • Profile picture of the author MattVit
    Maybe he didn't hack your password. Maybe he guessed your Secret Answer, which isn't hard for family / friends / ex-family / ex-friends to do!

    How worrying... I hope everything is okay now?
    Signature

    {{ DiscussionBoard.errors[5025334].message }}
  • Profile picture of the author lisakynan
    My hotmail got hacked too, they send about 3 or 4 emails a day to each of my contacts telling them to click on links. I was just going to delete the email account. So annoying
    {{ DiscussionBoard.errors[5025642].message }}
  • Profile picture of the author Regional Warrior
    This is what a good friend on the WF had to deal with just the other day he found this...

    email account hacked!!! 85,474 porn e-mails have been sent from my domain account since 16 Aug! Not that this ever pleases me, but it's made so much worse by the fact it's on my own personal named domain
    And this was a free email account, the mind wonders why they do this:rolleyes:

    Jason
    {{ DiscussionBoard.errors[5025855].message }}
  • Actually,

    (a) He is probably not targeting you personally
    (b) You probably have malware (i.e., a keylogger/scraper/etc), installed on your system. You usually get those types of viruses from either visiting porn sites or using "cracked" software, so if you are doing either, you should stop. The other method is usually if people forward you "attachments", and you inadvertently opened one of those thinking it was from a friend. Obviously, do due dilegence when opening those.

    Easiest way to stop it from happening is to 'clean' your computer. That means backing up all your files, then restoring the operating system, and then reinstalling 'clean' files.

    Then you won't need to worry about that. Chances are if he is doing it for one account, he is doing for all your accounts, and you just haven't noticed yet.

    John
    Signature
    Pick a product. Pick ANY product! -> 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
    {{ DiscussionBoard.errors[5025870].message }}
  • Profile picture of the author Fernando Veloso
    My brother in law got his Hotmail account hacked last week. Maybe this is bigger then what he think?
    Signature
    People make good money selling to the rich. But the rich got rich selling to the masses.
    {{ DiscussionBoard.errors[5025896].message }}
  • Profile picture of the author azmanar
    Hi Guys,

    Thanks for all the pointers. It seems I'm not alone.

    I like to think myself as a very careful person. However from this incident, obviously it is not good enough. Have to be more vigilant.

    Each of my accounts (emails, forums, yahoo groups, services) have different passwords. Never written on any paper. All being managed digitally by a self-made application. No one else uses my beloved laptop ... lol .. not even my wife.

    I never use public computers. Have 2 other development PCs which I never use to login emails. My laptop is the only one I use to login emails. If ever I use public networks such as hotels, I'm on an https proxy.

    And there are no virus-prone applications from Microsoft except for the OS on my laptop. Zero pirated software because I respect other people's hard work. Software I use are mostly bought from reputable sources.

    Despite all that, "keyloggers and trojans" were my first suspicion. Have 4 updated anti-viruses running together (with all the works). Had scanned and found none.

    Could be some new keyloggers yet to be identified by security software firms. Could still be a new kind of brute-force tool, which is my second suspicion.

    If ever there was any infection, it could have come from my downloads. This could be the leak.

    Still looking into this matter. It is a wake-up call for me.
    Signature
    === >>> Tomorrow Should Be Better Than Today

    {{ DiscussionBoard.errors[5025960].message }}
    • Profile picture of the author ronc0011
      Originally Posted by azmanar View Post

      Hi Guys,


      Despite all that, "keyloggers and trojans" were my first suspicion. Have 4 updated anti-viruses running together (with all the works). Had scanned and found none.



      Still looking into this matter. It is a wake-up call for me.

      You shouldn't run multiple antivirus softwares side by side on your machine because the usually step on each other causing them to not work The only exceptions to this are stand alone programs like Malwarebytes These are programs that don't run in the background but simply do a scan when you run them.Of course if ever you're unsure you can run HijackThis from TrenMicro. If there's anything on your system it will find it, period.
      {{ DiscussionBoard.errors[5028535].message }}
      • Profile picture of the author azmanar
        Originally Posted by ronc0011 View Post

        You shouldn't run multiple antivirus softwares side by side on your machine because the usually step on each other causing them to not work The only exceptions to this are stand alone programs like Malwarebytes These are programs that don't run in the background but simply do a scan when you run them.Of course if ever you're unsure you can run HijackThis from TrenMicro. If there's anything on your system it will find it, period.
        Great Tips ! Thanks. I didn't know they step on each other.

        I have MalwareBytes & TR. Run them when I start my day and when I end it.

        There are 2 anti-viruses running behind the scenes -> PREVX ( webroot ) and StopZilla. Very quick, light, no visible overhead and seems to be friendly to each other.

        What Prevx can't find, SZ will and vice versa.

        LOL ... whenever I'm not in meetings, having meals, in the washroom, traveling or sleeping, I'll be behind the screen. Hours on end.

        So I rely on those 4 apps to stay safe online, other than myself being alert on potential dangers. Maybe I should also take a peek at HijackThis, as you recommended.

        Had a terrible experience when a Malware hijacked my PC after visiting a potential site for sale on Flippa. Installed MalwareBytes & TR immediately and was able to revive and recover in 30 minutes. No need for the easy-way-out total erasure of my hdd in the hands of technicians.
        Signature
        === >>> Tomorrow Should Be Better Than Today

        {{ DiscussionBoard.errors[5028764].message }}
  • Profile picture of the author Brian Alaway
    The reality is that in today's always connected online digital world, anybody can be hacked at any time. There's no such thing as 100 per cent safe. Look at all the security breeches at major corporations that have compromised credit card data. And they have IT departments working to protect them. The digital world can indeed be dangerous so just fight the good fight and keep improving your security. Frequently changing passwords is one of the better security measures but it's also one that very few follow through on cause they hate the hassle. On corporate networks this can actually be enforced automatically but the resistance to this was shocking - usually by top management, the ones with the most to lose. Oh well.
    {{ DiscussionBoard.errors[5026208].message }}
  • Profile picture of the author hamzah3
    Thanks for sharing your own experience .I am a bit lazy in changing passwords but now I will be careful
    {{ DiscussionBoard.errors[5026863].message }}
  • Profile picture of the author seabird
    Banned
    my friends why don't you all reconsider changing to gmail account
    it's easy to forward all you incoming email to it and
    set sending email to be the same like you send from your site email
    i'm using it in my iphone and in my pc it's really easy also when your password taken
    gmail will send you to your mobile number message
    {{ DiscussionBoard.errors[5026891].message }}
  • Profile picture of the author Alex Kage
    I have no problem with that. My yahoo emails have gotten hacked too. Good thing I don't use them for anything important and have loads of them.
    {{ DiscussionBoard.errors[5026912].message }}
  • Profile picture of the author mojojuju
    Have you considered the possibility that your email account hasn't been hacked and that instead somebody is spoofing the "from" header of emails using your email address?
    Signature

    :)

    {{ DiscussionBoard.errors[5027764].message }}
    • Profile picture of the author azmanar
      Originally Posted by mojojuju View Post

      Have you considered the possibility that your email account hasn't been hacked and that instead somebody is spoofing the "from" header of emails using your email address?
      Hi,

      The mails were not spoofed as they were "SENT MAILS" inside the "SENT BOX" but were "DELETED" and stayed in the "TRASH BOX".

      So they were indeed sent from inside the account.
      Signature
      === >>> Tomorrow Should Be Better Than Today

      {{ DiscussionBoard.errors[5028409].message }}
  • Profile picture of the author art72
    This just happened to me last week with my Gmail account. Seems fine now that I changed my password, but it was definitely a bit alarming to see someone email their crap to my personal contacts with no real idea what was in store for those who clicked the link.

    I tracked the link down, found the affiliates links in the source code, and tracked the domain through a whois search. Amazingly the idiot who hacked my account is listed publicly on a GoDaddy server.

    Which reminds me, I need to call over there, and file a complaint, and see if I can get em shut down.

    Hackers suck!

    All that intelligence being wasted on "Blue Fart" techniques, and screwing with another's livelihood... I say we string em' up and beat em!

    All the Best,

    Art
    Signature
    Atop a tree with Buddha ain't a bad place to take rest!
    {{ DiscussionBoard.errors[5028513].message }}
  • Profile picture of the author Top Dog Marketer
    Hotmail, AOL, and yahoo are the most hacked email accounts on the planet. Seriously, if you research it there are solid statistics on this stuff.

    Grab a gmail and you'll have 10x the protection you did with hotmail.

    Good luck buddy!!
    Signature

    I'm the "Top Dog" when it comes to marketing.

    {{ DiscussionBoard.errors[5028536].message }}
  • Profile picture of the author ajparker
    There seems to have been a wave of such things in the last week or two. I've seen a couple of my contacts that have yahoo (or att/yahoo) addresses with a similar fishy email sent out. Really with hotmail/yahoo last I knew logins were passed plain text across the network. So.... the #1 easiest way someone would do this is - if someone is sitting at a wifi hotspot and pulls up their mail page the person across the room from them could be sitting at a computer collecting email addresses to play with. All it takes is the right tools. It doesn't matter if it's an open wifi or encrypted - if everyone in the room has a key to it... it doesn't make things private.

    It wouldn't have to happen on wifi - I sometimes wonder if we put too much trust in our internet service providers (or someone that works with them) to not be searching our plain text communications like that. Gmail at least forces https on mail logins so you can at least narrow down the ways you might be compromised.

    As for brute force - really with the right setup it's just a matter of time and computing power. If someone wants to get in. Many well designed firewalls will clamp down on lots of failed logins from a single ip address and I've seen some lock a username for a period of time with a failed attempt. But if your patient enough and have a distributed network of machines for your attempts... it's still do-able.

    I think the 2nd easiest way someone might have done it is by guessing answers to favorite questions - but that typically forces a password reset.

    Of course -the other thing is if a password is shared with multiple sites - and one has a database compromise... then they might know your mail address and guess that you've used the same password.

    It seems to be harder and harder to stay one step ahead...

    Avery
    {{ DiscussionBoard.errors[5028657].message }}
  • Profile picture of the author MarketTNT
    I always add one of my (other) email addresses into my contacts. That way if someone emails all my contacts, at least I'm in the loop. lol
    {{ DiscussionBoard.errors[5042727].message }}

Trending Topics