email hijack security risks? (IT dudes!)

[MrBump]

Maybe we should take a leaf out of Dave Gormans book, and just say "yes!" to all the spam...  Larger manhoods, better erections, free money from a bloke in Nigeria...

What can possibly go wrong???

[Fourth Feline]

Maybe we should take a leaf out of Dave Gormans book, and just say "yes!" to all the spam...  Larger manhoods, better erections, free money from a bloke in Nigeria...

What can possibly go wrong???

Alas !

I ended up with a 'Manhood' so tumescent, that I could no longer get close enough to the sink and shave. I lost all my mates through looking unkempt - and the bloke from Nigeria never turned up anyway.

I even recently got 'Spam' from B.K.P. offering a range of '7 String pickup covers' - and 550K Pots; I mean, come on - that's not even Standard ...  :mrgreen:

[dave_mc]

glad i didn't click that link, then! :lol:

it did seem to be most of your inbox, yeah (at least i assume that's most of your inbox... it was to several people).

i have kaspersky too, but you know as much as i do about using it, it always confuses me as well... :(

have you tried contacting msn/hotmail? i think there's quite a lot of it around, a dude on another forum had a similar thing happen and he sent me a similar email.

if my email starts acting crazy ever, please let me know!

[MDV]

Well, I've spoken with my #1 tech advisor dude and he reckons its a rootkit.

I've changed passwords on all my important (i.e. financial) stuff on a different PC (well, laptop) and am using that now with the infected PC disconnected from the net and my network.

Will probably need to wipe the HD to get rid of it....sending out emails is one thing, but rootkits are capable of much more and damned near impossible to remove.

On the plus side, the potential for stuff like this is why I kept my old PC - to protect my audio PC, which is a working machine and not for $%&#ing about with or getting clogged up or infected. That (and this LT) havent been switched on in the problem time, so it should be fine. I hope.

[MDV]

glad i didn't click that link, then! :lol:

it did seem to be most of your inbox, yeah (at least i assume that's most of your inbox... it was to several people).

i have kaspersky too, but you know as much as i do about using it, it always confuses me as well... :(

have you tried contacting msn/hotmail? i think there's quite a lot of it around, a dude on another forum had a similar thing happen and he sent me a similar email.

if my email starts acting crazy ever, please let me know!

I suppose theres some sollace in it being so common. Mum was quite confused as to why I'd sent her a link to a viagra site, but said she got the same one from an ex guitarist too.

Hopefully its just an irritation - it hijacks your email and sends this link to as many people as possible, cascading through address books, looking (a little) more trustworthy because its from someone you know, and doesnt try and do anything worse than that. Certain my bank account and paypal have shown no change through the day, and the computer is otherwise behaving normally.

[Andrew W]

One other thing to question, is your email client a piece of software on your machine (Thunderbird etc.) or do you use an online email service like Hotmail?  If it's the latter you're at risk from Javascript exploits.  I think all the major webmail services (Gmail, Hotmail and Yahoo!) all rely on Javascript to do their thing and Javascript is notoriously hackable.  Often you don't even have to click on a link in a maliciously crafted mail, the mere fact of it hitting your account and looking at it can be enough to execute code which is generally the thieving of your address book and subsequent spam.  Unfortunately if you rely on webmail there's not much you can do - you have to allow Javascript to get the website to work and Javascript is very bad from a security stand point.

[MDV]

Its yahoo, and I'm aware of some of the problems with java (its the only thing that comes up in kaspersky vulnerability scans, at least!), but didnt know it made email hacking that easy.

In your estimation then, do I have malware on that machine (malwarebytes free version now also says its clean, btw) or has some tw@t hacked my address, but my PC and other info are fine?

[MDV]

Oh, and will do dave.

This is a pain; at least if some scan could point at something and go 'there it is!' I'd know there was a problem on my machine, with complete certainty - as it is I'm tempted to go with the password changes, the tightening of security on that machine and carry on like its fine, which might well be the worst thing I can do.

[Johnny Mac]

One other thing to question, is your email client a piece of software on your machine (Thunderbird etc.) or do you use an online email service like Hotmail?  If it's the latter you're at risk from Javascript exploits.  I think all the major webmail services (Gmail, Hotmail and Yahoo!) all rely on Javascript to do their thing and Javascript is notoriously hackable.  Often you don't even have to click on a link in a maliciously crafted mail, the mere fact of it hitting your account and looking at it can be enough to execute code which is generally the thieving of your address book and subsequent spam.  Unfortunately if you rely on webmail there's not much you can do - you have to allow Javascript to get the website to work and Javascript is very bad from a security stand point.

This sounds like the culprit!

[shobet]

Its yahoo, and I'm aware of some of the problems with java (its the only thing that comes up in kaspersky vulnerability scans, at least!), but didnt know it made email hacking that easy.

In your estimation then, do I have malware on that machine (malwarebytes free version now also says its clean, btw) or has some tw@t hacked my address, but my PC and other info are fine?

Java and Javascript are completely different languages. While the syntax may look the same, they work in entirely different ways.

[MDV]

Its yahoo, and I'm aware of some of the problems with java (its the only thing that comes up in kaspersky vulnerability scans, at least!), but didnt know it made email hacking that easy.

In your estimation then, do I have malware on that machine (malwarebytes free version now also says its clean, btw) or has some tw@t hacked my address, but my PC and other info are fine?

Java and Javascript are completely different languages. While the syntax may look the same, they work in entirely different ways.

Errrrr, ok, fine, but if you know the answer to the question, could you answer it, pretty please?

[Afghan Dave]

It's Java that is being exploited.

[MDV]

It's Java that is being exploited.

You sure? My machine itself and other logins under threat?

Password changed, all fixed?

[MDV]

Oh, I reinstalled java if that makes any difference.

[Afghan Dave]

I have my firewall set to warn me if anything is trying to play with Java on my PC...

I choose to block it and stop it dead and have not had an issue since.

And I hang out in some pretty seedy infected areas on this Big Ol' t'internet  :?