Hijacked e-mail

CB

First off. I want to apologize to anyone who may have received a spam message from my old Nexlia e-mail address.

Then. I want to understand how this happened. I haven't actively used that address in a few years, but it's still set-up, as it always was from the very beginning, as a simple forward to my gmail address (which I don't give out, all of my e-mail addresses just forward to that one address).

This morning it seems that many people who had previously sent mail to that old address in years past (I don't know quite how wide-spread it went) got an e-mail this morning from that address telling them to try some new weight-loss plan. This is the first time that this has happened.

It seems clear that it was not my gmail account which was hacked for two reasons: First, my gmail account is no longer set-up to send from that address. Second, whenever I would send e-mail from that address in the past, it would always show up to others as "From: [Nexlia address] on behalf of [gmail username]", and this morning's e-mail appears to be simply from the Nexlia address by itself.

The thing is: As far as I know (Zanthian is the one in charge of the Nexlia server, so I don't know exactly how it's set-up), it's not possible to send anything directly from that address because it is only a forward, it's not set-up to use any sort of client, not even webmail. So, it's not like someone somehow got my password for that address and is now using it to send mail, right? I mean, I couldn't even do that if I wanted to, so how could a spammer do it?

Does that mean that he's just using a client which allows him to spoof the "From" field on the e-mail? If so, is there anything I can do to stop it? Will deleting that old e-mail forward, (from which I do still, very rarely, receive legitimate e-mail) even do anything to stop it from happening again? And if they do have such a program, why bother even using a real address? and how did they get an address list for it? Again: I wouldn't even know where to go to get an address list for that address. It shouldn't even have one....

Ugh. This whole thing makes me feel old... Like I once knew everything there was to know about SMTP, but somehow I've forgotten something important, or something changed while I wasn't looking because as far as I understand it, this shouldn't be possible for someone to do. :/

Kwitko

Sounds like a spoof of the "From" field, which is relatively easy to do. To discern where the email actually came from, you'd have to post the entire email header.

CB

I'm not sure how to see more of the header in gmail. All I get is 'from 'to' 'date' 'subject'. However, I'm not really that concerned about where it came from.

I understand that spoofing is not tough. What I'm most confused about is where the spammer got a list of e-mail addresses to send the message to.

Kwitko

They use random ones until they find one that works.

Ryder

What CB is saying is that he is concerned that the email the spammer sent went to his friends. How did they get the emails of CB's friends and send it from CB's account.

Kwitko

They didn't send it from CB's account. Things like this happen all the time. Spammers harvest emails. If CB would post the headers from the email I can decode them.

CB

Just harvesting my address is not enough to get my address book, especially since that address had no address book. I mean, is there some way for them to get a list of all the people who have sent e-mail to an address? Is that stored on a server somewhere?

I would post the header for you if I knew how to tell gmail to show it to me.

Kwitko

In the right-hand corner next to the Reply link is a dropdown menu. Click on the down arrow and select Show Original.

CB

Thanks, I've always wondered where to find that info in gmail. I never noticed that dropdown before.

Now that I can see it, it's obvious that the real sender was a throw-away hotmail account.

Still doesn't explain how they got my friends' addresses, however.

BobbyDigi

My guess is that they did not get your Address Book, Sounds like they got someone else's address book that had your address on it. This is common for spammers, they won't send from the compromised account because that would bring the compromise to the attention of the compromised. They choose one of the address in the list and send from that. (Also spoofing a from address is very easy, We used to send our buddies emails from bill@microsoft.com and george@whitehouse.gov all the time)

CB

BobbyDigi wrote:

My guess is that they did not get your Address Book, Sounds like they got someone else's address book that had your address on it.

That makes sense.

CB

So, it happened again this morning, which leads me to believe it will continue to happen if I don't do something about it.

But is there anything that even can be done from my end?

Tushon

No.

BobbyDigi

Tushon wrote:

No.

Unfortunately Tushon is correct, There really is nothing you can do about it.

The eternal battle against Spam rages on.

the_technocrat

CB wrote:

Still doesn't explain how they got my friends' addresses, however.

If you've ever been sent a BS chain email by one of your tard friends, and all the addresses are in the 'to' field, they know some kind of relationship exists there, and sending as one of those addresses to the entire list is likely to work sociologically.

This is why I want to stab one person I know in the face when I get the monthly super-long anti-Obama email with hundreds of email addresses on it.

ardichoke

Do the gene pool a favor and give in to your urges.

Tushon

ardichoke wrote:

Do the gene pool a favor and give in to your urges.

Sending out a reply email with picture of a kitten (see Exhibit A) that says, "click me, I'm Irish" then, after clicking, the picture morphs into a demon (Exhibit B) that says "I'm laying waste to your _______ folder" (with name of critical folders, starting with user data then working it's way into windows) and ends with a solemn black screen, "I didn't really delete anything and your computer is fine, but for fuck's sake, stop sending out those awful chain letters -A concerned computer".

Exhibit A


Exhibit B