Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #158964 > unrolled thread

[OT] Has my e-mail account been hacked?

Back to article view | Back to linux.debian.user

Contents

  [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-12 16:50 +0200
    Re: [OT] Has my e-mail account been hacked? Florian Pelgrim <florian.pelgrim@craneworks.de> - 2015-10-12 17:00 +0200
      Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-12 23:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-13 02:00 +0200
          Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 06:40 +0200
            Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 10:20 +0200
              Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-13 17:30 +0200
                Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 20:10 +0200
                Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-13 22:10 +0200
                Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:10 +0200
              Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:00 +0200
                Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 04:20 +0200
                  Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 05:00 +0200
                    Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:20 +0200
                    Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 05:20 +0200
                    Re: [OT] Has my e-mail account been hacked? John Hasler <jhasler@newsguy.com> - 2015-10-14 05:30 +0200
                      Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 05:40 +0200
                        Re: [OT] Has my e-mail account been hacked? Timothy Hobbs <timothy@hobbs.cz> - 2015-10-14 10:40 +0200
                        Re: [OT] Has my e-mail account been hacked? Carl Fink <carl@finknetwork.com> - 2015-10-14 15:10 +0200
                  Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
                Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 04:30 +0200
                  Re: [OT] Has my e-mail account been hacked? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2015-10-14 05:30 +0200
          Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 08:40 +0200
            Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 09:10 +0200
              Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:00 +0200
                Re: [OT] Has my e-mail account been hacked? <tomas@tuxteam.de> - 2015-10-13 11:00 +0200
                  Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-13 11:10 +0200
                    Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-13 11:20 +0200
            Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 21:10 +0200
            Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 03:30 +0200
              Re: [OT] Has my e-mail account been hacked? Jimmy Johnson <field.engineer@gmail.com> - 2015-10-14 11:00 +0200
          Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-13 13:20 +0200
          Re: [OT] Has my e-mail account been hacked? stelios kteniadalis <keste82@gmail.com> - 2015-10-14 12:40 +0200
    Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-12 18:40 +0200
      Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 00:50 +0200
        Re: [OT] Has my e-mail account been hacked? Adrian O'Dell <crimsonmane@gmail.com> - 2015-10-14 01:00 +0200
        Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 01:00 +0200
          Re: [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-14 04:30 +0200
            Re: [OT] Has my e-mail account been hacked? Brian <ad44@cityscape.co.uk> - 2015-10-14 11:10 +0200
              [SOLVED] [OT] Has my e-mail account been hacked? Stephen Powell <zlinuxman@wowway.com> - 2015-10-16 01:00 +0200
        Re: [OT] Has my e-mail account been hacked? Stuart Longland <stuartl@longlandclan.id.au> - 2015-10-14 03:30 +0200
    Re: [OT] Has my e-mail account been hacked? Jochen Spieker <ml@well-adjusted.de> - 2015-10-12 22:50 +0200

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#159106

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

On 14/10/2015 12:53 PM, Stephen Powell wrote:
> No.  My id on this mail server is "zlinuxman".  I have no idea who 
> "thecoughingcanary" is.  Nor do I understand why the SMTP server
> would allow "thecoughingcanary" to send out e-mails in my name,
> unless "thecoughingcanary" is an administrator account.

Perhaps this business has an account on the mail server and they have
a configuration problem.

http://coughingcanary.com/

>> Who runs this mail service?
> 
> Wide Open West, or "Wow!" as they market themselves.
> 
> http://wowway.net/

They /may/ also use this ISP.

Also, a cable Internet connection shares a network segment with a
bunch of people potentially.  So, perhaps, just perhaps, they are on
your segment to get the creds.  More likely they are using their own
creds if the business has their own account with your ISP.

> It's basically a cable TV company.  I have a bundle of cable,
> internet, and phone service from them.  They provide free e-mail
> and a free web-hosting service to all who subscribe to their
> internet service. My connectivity is through a cable modem which
> they provide. I have my own wired ethernet router connected to it,
> and my computers connect to that.

Being a "cable TV company" ... perhaps, again perhaps, they haven't
got things nice and secure themselves.

Kind Regards
AndrewM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlYdvTUACgkQqBZry7fv4vud/QEAv27pKUZyF2QRs927sTDctMis
xN6i0eDDVgZ0OeGU07oA/jg/4Fjq1rUZPK5DxirBGX2KYDzOGkkF7Wk82qYZou1X
=XSfw
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159111

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Of course ftp, clear text passwords, is also a problem; if it was
this, then every time you update files via ftp, can you then
immediately change your password when done?  Mute point if they are
using their own credentials to send mail and not your creds.

A.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlYdy0oACgkQqBZry7fv4vuTDAD/Zg2XpzoJHxfUlwvwKDloCz5u
ur0bcci0t7l8lCLdDsYA/iibcykffxcQHZwxynPPdjiQg0vLHTVvvHlqWx8ylUYb
=K8AT
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159012

On 10/12/2015 04:58 PM, Stephen Powell wrote:
> On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
>>
>> I'd check the backscatter case, as this requires no skill on the part of
>> the attacker and is the most likely case.
>> ...
>> It's worth knowing how to read the headers of emails in this
>> circumstance as it can give you vital information for knowing what is
>> going on.
>
> Unfortunately, I don't.  Attached below is one of the mail delivery
> failure notices, which includes the headers of the original message.
> But I don't understand what it all means.  Perhaps you or someone else
> out there can make some sense of it and advise me accordingly.
> Remember, I never sent the original e-mail.  I just got the delivery
> failure notice.

> X-MSMail-Priority: Normal

> X-Mailer: Microsoft Outlook Express 6.00.2800.1081 <

> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081


Looks like it was mailed from MS Windows.  Maybe mailed from a Windows 
OS with a virus.  Do you run Windows too?
-- 
Jimmy Johnson

Debian - Wheezy - KDE 4.8.4 - AMD64 - EXT4 at sda1
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#159013

[Multipart message — attachments visible in raw view] — view raw

On 13/10/15 16:36, Jimmy Johnson wrote:
> On 10/12/2015 04:58 PM, Stephen Powell wrote:
>> On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
>>>
>>> I'd check the backscatter case, as this requires no skill on the part of
>>> the attacker and is the most likely case.
>>> ...
>>> It's worth knowing how to read the headers of emails in this
>>> circumstance as it can give you vital information for knowing what is
>>> going on.
>>
>> Unfortunately, I don't.  Attached below is one of the mail delivery
>> failure notices, which includes the headers of the original message.
>> But I don't understand what it all means.  Perhaps you or someone else
>> out there can make some sense of it and advise me accordingly.
>> Remember, I never sent the original e-mail.  I just got the delivery
>> failure notice.
> 
>> X-MSMail-Priority: Normal
> 
>> X-Mailer: Microsoft Outlook Express 6.00.2800.1081 <
> 
>> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
> 
> 
> Looks like it was mailed from MS Windows.  Maybe mailed from a Windows
> OS with a virus.  Do you run Windows too?

It's a popular client to spoof too.

-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159021

On 10/13/2015 12:06 AM, Stuart Longland wrote:
> On 13/10/15 16:36, Jimmy Johnson wrote:
>> On 10/12/2015 04:58 PM, Stephen Powell wrote:
>>> On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
>>>>
>>>> I'd check the backscatter case, as this requires no skill on the part of
>>>> the attacker and is the most likely case.
>>>> ...
>>>> It's worth knowing how to read the headers of emails in this
>>>> circumstance as it can give you vital information for knowing what is
>>>> going on.
>>>
>>> Unfortunately, I don't.  Attached below is one of the mail delivery
>>> failure notices, which includes the headers of the original message.
>>> But I don't understand what it all means.  Perhaps you or someone else
>>> out there can make some sense of it and advise me accordingly.
>>> Remember, I never sent the original e-mail.  I just got the delivery
>>> failure notice.
>>
>>> X-MSMail-Priority: Normal
>>
>>> X-Mailer: Microsoft Outlook Express 6.00.2800.1081 <
>>
>>> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
>>
>>
>> Looks like it was mailed from MS Windows.  Maybe mailed from a Windows
>> OS with a virus.  Do you run Windows too?
>
> It's a popular client to spoof too.

I'm just saying that there is a possible bot running and the chances are 
it's running in a windows environment, maybe even in a v-box, just a 
thought.
-- 
Jimmy Johnson

Debian Sid - KDE Plasma 5.4.1 - AMD64 - EXT4 at sda15
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#159023

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Oct 13, 2015 at 01:54:53AM -0700, Jimmy Johnson wrote:

[...]

> >It's a popular client to spoof too.
> 
> I'm just saying that there is a possible bot running and the chances
> are it's running in a windows environment, maybe even in a v-box,
> just a thought.

If I were the bot programmer, this would be the first thing I'd try to spoof.

- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlYcv0wACgkQBcgs9XrR2kb4ogCdEa2ZPeSckS/ivhi4ae+K7fw5
mC8An1r/JBEhWv5b37oyEv2cVc9w7Nqp
=YHj5
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159025

[Multipart message — attachments visible in raw view] — view raw

On 13/10/15 18:22, tomas@tuxteam.de wrote:
> On Tue, Oct 13, 2015 at 01:54:53AM -0700, Jimmy Johnson wrote:
> 
> [...]
> 
>>> It's a popular client to spoof too.
> 
>> I'm just saying that there is a possible bot running and the chances
>> are it's running in a windows environment, maybe even in a v-box,
>> just a thought.
> 
> If I were the bot programmer, this would be the first thing I'd try to spoof.

Depending on the bot programmer, they probably send an email to
themselves using Outlook Express then view the message source and paste
that into their code.

-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.

[toc] | [prev] | [next] | [standalone]

#159027

On 10/13/2015 02:02 AM, Stuart Longland wrote:
> On 13/10/15 18:22, tomas@tuxteam.de wrote:
>> On Tue, Oct 13, 2015 at 01:54:53AM -0700, Jimmy Johnson wrote:
>>
>> [...]
>>
>>>> It's a popular client to spoof too.
>>
>>> I'm just saying that there is a possible bot running and the chances
>>> are it's running in a windows environment, maybe even in a v-box,
>>> just a thought.
>>
>> If I were the bot programmer, this would be the first thing I'd try to spoof.
>
> Depending on the bot programmer, they probably send an email to
> themselves using Outlook Express then view the message source and paste
> that into their code.

Stuart actually the owned computer sends the emails, it's all done in 
the background, the box needs to be scanned with a bootable cd so the 
virus can't write back to it. This is the one I used to use before I 
retired https://www.f-secure.com/en/web/labs_global/rescue-cd
-- 
Jimmy Johnson

Debian Sid - KDE Plasma 5.4.1 - AMD64 - EXT4 at sda15
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#159067

On Mon 12 Oct 2015 at 23:36:46 -0700, Jimmy Johnson wrote:

> >X-MSMail-Priority: Normal
> 
> >X-Mailer: Microsoft Outlook Express 6.00.2800.1081 <
> 
> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
> 
> 
> Looks like it was mailed from MS Windows.  Maybe mailed from a Windows OS
> with a virus.  Do you run Windows too?

I like the virus touch. It's aways good to make people sit up and take
interest. Makes everything more believable.

The three headers you quote are in the body of the email. You can put
anything you want there. Even forgeries.

[toc] | [prev] | [next] | [standalone]

#159099

On Tue, 13 Oct 2015 02:36:46 -0400 (EDT), Jimmy Johnson wrote:
> 
> Looks like it was mailed from MS Windows.  Maybe mailed from a Windows 
> OS with a virus.  Do you run Windows too?

No, I don't.  There is no computer connected to my home network that
even has Windows installed.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159134

On 10/13/2015 06:24 PM, Stephen Powell wrote:
> On Tue, 13 Oct 2015 02:36:46 -0400 (EDT), Jimmy Johnson wrote:
>>
>> Looks like it was mailed from MS Windows.  Maybe mailed from a Windows
>> OS with a virus.  Do you run Windows too?
>
> No, I don't.  There is no computer connected to my home network that
> even has Windows installed.

Okay.  Here's some info that may or may not be handy for you. Your ISP 
account, how to change your password and more: http://goo.gl/IiqWvm and 
some info from security expert Steve Gibson https://goo.gl/V85NOp .

Good luck Stephen.
-- 
Jimmy Johnson

Debian Stretch - Plasma 5.4.1 - AMD 64 - EXT4 at sda11
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#159032

On Mon 12 Oct 2015 at 19:58:59 -0400, Stephen Powell wrote:

> On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote:
> > 
> > I'd check the backscatter case, as this requires no skill on the part of
> > the attacker and is the most likely case.
> > ...
> > It's worth knowing how to read the headers of emails in this
> > circumstance as it can give you vital information for knowing what is
> > going on.
> 
> Unfortunately, I don't.  Attached below is one of the mail delivery
> failure notices, which includes the headers of the original message.
> But I don't understand what it all means.  Perhaps you or someone else
> out there can make some sense of it and advise me accordingly.
> Remember, I never sent the original e-mail.  I just got the delivery
> failure notice.
> 
> -----
> 
> This message was created automatically by the mail system (ecelerity).

ecelerity is a mail platform owned by Message Systems. It attempted to
send a mail to zerriells@aol.com which was rejected by AOL. It is now
informing you of the rejection. ecelerity does not run on your machine.

> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
> 
> >>> zerriells@aol.com (after RCPT TO): 550 5.1.1 <zerriells@aol.com>: Recipient address rejected: aol.com
> 
> ------ This is a copy of the headers of the original message. ------
> 
> Return-Path: <zlinuxman@wowway.com>
> X_CMAE_Category: , ,
> X-CNFS-Analysis: v=2.1 cv=eaKdB+wH c=1 sm=1 tr=0 a=FxXVyIFnAocEnA08ajU80w==:117 a=FxXVyIFnAocEnA08ajU80w==:17 a=K-v-2zaBAAAA:8 a=QP5IY3kgAAAA:8 a=ZhWb6TEzAAAA:8 a=kj9zAlcOel0A:10 a=op2l2dobe8TBvKaan4QA:9 a=qSf3gRf-E_nrW77P:21 a=Nputykdsa0hyqt36:21 a=CjuIK1q_8ugA:10
> X-CM-Score: 0
> X-Scanned-by: Cloudmark Authority Engine
> X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
> X_CMAE_Category: , ,
> X-CNFS-Analysis: 
> X-CM-Score: 
> X-Scanned-by: Cloudmark Authority Engine

Standard ecelerity stuff. It can be seen in the headers of the two mails
you have contributed to this thread. ecelerity attempted contact with
AOL using an envelope From of <zlinuxman@wowway.com>.

> Authentication-Results:  smtp02.wow.cmh.synacor.com smtp.user=thecoughingcanary; auth=pass (LOGIN)

ecelerity reckons someone from smtp02.wow.cmh.synacor.com has been
authenticated. Your mails to -user have

  Received: from [10.35.66.7] ([10.35.66.7:33229] helo=md20.wow.cmh.synacor.com)

in their headers so have been authenticated in the same way.

> Received: from [69.73.17.154] ([69.73.17.154:57886] helo=46MmPDFcgl13022)

ecelerity records receiving a mail from 69.73.17.154 on Wed 07 Oct.

> 	by smtp.mail.wowway.com (envelope-from <zlinuxman@wowway.com>)
> 	(ecelerity 3.6.1.42806 r(Platform:3.6.1.1)) with ESMTPA
> 	id 54/A2-15401-2D8D4165; Wed, 07 Oct 2015 04:33:28 -0400

Looks genuine and probably is.

[Message body snipped. It is of no consequence as it plays no part in
the transmission of the mail].

You could start by examining your Message Systems account with a fine
toothcomb.

[toc] | [prev] | [next] | [standalone]

#159145

Data missmatch


On Mon, 12 Oct 2015 19:58:59 -0400 (EDT)
Stephen Powell <zlinuxman@wowway.com> wrote:

> This message was created automatically by the mail system (ecelerity).
> 
> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es)
> failed:
> 
> >>> zerriells@aol.com (after RCPT TO): 550 5.1.1 <zerriells@aol.com>:

this is the rejected address but on the headers below there is another
one
From:
> "SSN"<zlinuxman@wowway.com> To: shoprecruiterss@oath.com
You received a message delivery faillure to <zerriells@aol.com> address
but on the message's header the receiver's address is
<shoprecruiterss@oath.com>.
Are both addresses unknown?
 

> >>> Recipient address rejected: aol.com  
> 
> ------ This is a copy of the headers of the original message. ------
> 
> Return-Path: <zlinuxman@wowway.com>
> X_CMAE_Category: , ,
> X-CNFS-Analysis: v=2.1 cv=eaKdB+wH c=1 sm=1 tr=0
> a=FxXVyIFnAocEnA08ajU80w==:117 a=FxXVyIFnAocEnA08ajU80w==:17
> a=K-v-2zaBAAAA:8 a=QP5IY3kgAAAA:8 a=ZhWb6TEzAAAA:8 a=kj9zAlcOel0A:10
> a=op2l2dobe8TBvKaan4QA:9 a=qSf3gRf-E_nrW77P:21 a=Nputykdsa0hyqt36:21
> a=CjuIK1q_8ugA:10 X-CM-Score: 0 X-Scanned-by: Cloudmark Authority
> Engine X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
> X_CMAE_Category: , , X-CNFS-Analysis: X-CM-Score: 
> X-Scanned-by: Cloudmark Authority Engine
there are two servers involved 
> Authentication-Results:  smtp02.wow.cmh.synacor.com

1.smtp02.wow.cmh.synacor.com
which accepts the user to login as thecoughingcanary
  is smtp02.wow.cmh.synacor.com your isp's mail server?

> smtp.user=thecoughingcanary; auth=pass (LOGIN) Received: from
> [69.73.17.154] ([69.73.17.154:57886] helo=46MmPDFcgl13022) by
> smtp.mail.wowway.com (envelope-from <zlinuxman@wowway.com>)

2.smtp.mail.wowway.com

> (ecelerity 3.6.1.42806 r(Platform:3.6.1.1)) with ESMTPA id
> 54/A2-15401-2D8D4165; Wed, 07 Oct 2015 04:33:28 -0400 Reply-To:
> <shoprecruiterss@oath.com> Message-ID:
> <54.A2.15401.2D8D4165@smtp02.wow.cmh.synacor.com> From:

smtp02.wow.cmh.synacor.com receives from
"SSN"<zlinuxman@wowway.com>  (What is SSN?.Is an https site's login
with an inernal mail form for communication?)
to send it 
To: shoprecruiterss@oath.com
but there must had been a delivery faillure to
<shoprecruiterss@oath.com>
instead of <zerriells@aol.com>

> Subject: - Welcome: Mystery Shopper's 2015 -
> Date: Wed, 7 Oct 2015 19:18:16 -0700
> MIME-Version: 1.0
> Content-Type: text/plain;
> 	charset="us-ascii"
> Content-Transfer-Encoding: 7bit
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2800.1081
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
> 
> 
> 

[toc] | [prev] | [next] | [standalone]

#158977

On Mon 12 Oct 2015 at 10:43:42 -0400, Stephen Powell wrote:

> About a week ago, I discovered hundreds of "mail delivery failure"
> messages in my inbox.  Investigation revealed that they were all for
> SPAM e-mails that I did not send.  I am guessing that this means one
> of two things:
> 
> (1) Someone discovered my password somehow, logged into my ISP
> account as me, and sent out a bunch of SPAM.

I tend to think passwords (except the very simplest or guessable ones)
are not "discovered" but handed over.

> Or
> 
> (2) Someone sent out a bunch of SPAM, spoofing my e-mail address
> as the sender, and the delivery failures came to me.
> 
> How can I tell which is the case, and if it's (2), is there anything
> I can do to defend myself against this sort of thing in the future?

Mails composed with Mutt which leave this machine have the not very
imaginative  header "X-Backscatter: 123456789" in them. If one of them
is rejected the bounce message usually has all the headers of the
original mail in its body. A bounce message  can be searched for the
presence or otherwise of the X- header and dealt with accordingly.

Maybe SpamAssassin in conjunction with Zimbra is worth a look.

[toc] | [prev] | [next] | [standalone]

#159093

On Mon, 12 Oct 2015 12:36:27 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
> 
> I tend to think passwords (except the very simplest or guessable ones)
> are not "discovered" but handed over.

1. My password is known only to me.  Even my wife doesn't know it.
2. My password is a random sequence of uppercase and lowercase letters.
   It is not a pronounceable word, and it is fairly long.
3. I use e-mail only from my home computer.
4. I use wired ethernet only
5. I never respond to the (almost daily) phishing attacks designed to
   coax my password out of me.
6. My wife and I are empty nesters.  There is no-one else at home.

In short, I have not "handed it over".
  
-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159094

On 10/13/2015 05:43 PM, Stephen Powell wrote:
> On Mon, 12 Oct 2015 12:36:27 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
>> I tend to think passwords (except the very simplest or guessable ones)
>> are not "discovered" but handed over.
> 1. My password is known only to me.  Even my wife doesn't know it.
> 2. My password is a random sequence of uppercase and lowercase letters.
>     It is not a pronounceable word, and it is fairly long.
> 3. I use e-mail only from my home computer.
> 4. I use wired ethernet only
> 5. I never respond to the (almost daily) phishing attacks designed to
>     coax my password out of me.
> 6. My wife and I are empty nesters.  There is no-one else at home.
>
> In short, I have not "handed it over".
>    
I've been reading a bit, but not all of this situation (deleted 
everything up to this point). It is possible to construct an email from 
the ground up, giving it whatever from-address you like whether real or 
imaginary. This would be consistent with the headers showing the source 
as some unexpected remote location.

[toc] | [prev] | [next] | [standalone]

#159095

On Tue 13 Oct 2015 at 18:43:24 -0400, Stephen Powell wrote:

> On Mon, 12 Oct 2015 12:36:27 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
> > 
> > I tend to think passwords (except the very simplest or guessable ones)
> > are not "discovered" but handed over.
> 
> 1. My password is known only to me.  Even my wife doesn't know it.
> 2. My password is a random sequence of uppercase and lowercase letters.
>    It is not a pronounceable word, and it is fairly long.
> 3. I use e-mail only from my home computer.
> 4. I use wired ethernet only
> 5. I never respond to the (almost daily) phishing attacks designed to
>    coax my password out of me.
> 6. My wife and I are empty nesters.  There is no-one else at home.
> 
> In short, I have not "handed it over".

The comment was a general one and directed at all our readers. However,
earlier you said "Someone discovered my password somehow". You have
just demolished that guess as having no basis as a likely cause.

[toc] | [prev] | [next] | [standalone]

#159105

On Tue, 13 Oct 2015 18:57:58 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
> 
> The comment was a general one and directed at all our readers. However,
> earlier you said "Someone discovered my password somehow". You have
> just demolished that guess as having no basis as a likely cause.

Likely, no, but still possible.  For example, when I update my web
pages, I use my ISP's FTP server.  Suppose someone else on my ISP's subnet
has a network sniffer in promiscuous mode.  The FTP server uses ordinary
unencrypted FTP.  The userid and password are sent in clear text.  I wish
they had an FTPS server, but the last time I checked, they didn't.  I use
e-mail solely through a web-based e-mail client.  When I login, I don't
know if the password is sent in clear text over the network or not.

That being said, if my password was obtained in this manner, I don't have
much of a defense against it.  If I change my password, they can get the
new one the same way as they got the old one.

Another possibility is a malicious web site that I may have unknowingly
visited that managed to find a password in memory, a cookie, etc.  So
despite all the precautions that I have taken, it is still possible for
a password to be "discovered".

Having said that, it looks like someone else's credentials may have been
used, based on some other posts to this thread.  But I am not an expert
in these matters.  That's why I asked for help.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

#159135

On Tue 13 Oct 2015 at 22:21:08 -0400, Stephen Powell wrote:

> On Tue, 13 Oct 2015 18:57:58 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
> > 
> > The comment was a general one and directed at all our readers. However,
> > earlier you said "Someone discovered my password somehow". You have
> > just demolished that guess as having no basis as a likely cause.
> 
> Likely, no, but still possible.  For example, when I update my web
> pages, I use my ISP's FTP server.  Suppose someone else on my ISP's subnet
> has a network sniffer in promiscuous mode.  The FTP server uses ordinary
> unencrypted FTP.  The userid and password are sent in clear text.  I wish
> they had an FTPS server, but the last time I checked, they didn't.  I use
> e-mail solely through a web-based e-mail client.  When I login, I don't
> know if the password is sent in clear text over the network or not.
> 
> That being said, if my password was obtained in this manner, I don't have
> much of a defense against it.  If I change my password, they can get the
> new one the same way as they got the old one.
> 
> Another possibility is a malicious web site that I may have unknowingly
> visited that managed to find a password in memory, a cookie, etc.  So
> despite all the precautions that I have taken, it is still possible for
> a password to be "discovered".
> 
> Having said that, it looks like someone else's credentials may have been
> used, based on some other posts to this thread.  But I am not an expert
> in these matters.  That's why I asked for help.

Your mails all have

  X-Authed-Username: emxpbnV4bWFuQHdvd3dheS5jb20=

The one to aol.com has

  X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==

so did not come from your account.

Someone has access (legitimately or not) to the second account and is
sending mails with a forged envelope From. Your only recourse is to
present the evidence to the ISP and let them deal with it.

[toc] | [prev] | [next] | [standalone]

#159229 — [SOLVED] [OT] Has my e-mail account been hacked?

On Tue, 13 Oct 2015 04:15:21 -0400 (EDT), Jochen Spieker wrote:
> 
> It looks like the mail was delivered directly through
> smtp02.wow.cmh.synacor.com by a user who successfully authenticated
> using the username thecoughingcanary.

On Wed, 14 Oct 2015 05:04:55 -0400 (EDT), Brian <ad44@cityscape.co.uk> wrote:
> 
> Your mails all have
> 
>   X-Authed-Username: emxpbnV4bWFuQHdvd3dheS5jb20=
> 
> The one to aol.com has
> 
>   X-Authed-Username: dGhlY291Z2hpbmdjYW5hcnlAd293d2F5LmNvbQ==
> 
> so did not come from your account.
> 
> Someone has access (legitimately or not) to the second account and is
> sending mails with a forged envelope From. Your only recourse is to
> present the evidence to the ISP and let them deal with it.

Thank you, Jochen and Brian, that is exactly the kind of information
I was looking for.  I now know that my e-mail account has not been
hacked, just spoofed.  I will report this to my ISP.  Thanks to all
who participated in this thread.

-- 
  .''`.     Stephen Powell    <zlinuxman@wowway.com>
 : :'  :
 `. `'`
   `-

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | linux.debian.user

csiph-web