A few days ago I received a spammy email that appeared to be from someone I’ve known for a long time.  I was pretty sure that it wasn’t from the individual but maybe a coincidence since he has a common name; that is, until I looked at the email address the message was sent from; it was his Hotmail address.  I also found this same message in another of my email accounts.

I contacted him about the messages and he had no idea how they were being sent.  Looking that the email headers, one can see that the email was not spoofed as it actually originated on the Hotmail service.  The headers also show that originating IP address is in Asia.  Someone (or an automated process on a server) in Asia logged into my friend’s Hotmail account and sent emails to his contacts and who knows who else.

What Probably Happened

In October, it was reported that the passwords of tens of thousands of users of the Windows Live Hotmail email service were leaked online.  Microsoft confirmed that these passwords were obtained as a result of a phishing scheme.  If this is the case, any email service could be a target of such attacks.  In addition to sites that might pretend to be related to Hotmail to get a user to enter their login credentials, there are an unlimited number of seemingly innocuous websites that ask for email credentials many times social networking sites in order to see if the user’s friends are already using their service.  In fact, services like Twitter, MySpace, FaceBook, and LinkedIn have done this very thing to get more users on their sites.  Another factor is trojans that hide on a user’s computer with the sole purpose of stealing passwords.

Spam Isn’t the Real Issue

What many people fail to realize is that when you give away the password to your email account you are essentially giving away the keys to the kingdom.  Many users have financial and other personal information stored in their email accounts.  New websites pop up everyday and there is no way to know how reputable those sites are.  Even when the company is reputable, what happens to the data it has collected if it folds?

You Have to Protect Your Data

The weakest link in information security is always the users themselves.  Users have to be more vigilant in protecting their information.  There is only so much service providers can do if users give out their passwords themselves.

To resolve my friend’s immediate problem, I recommended that he change his Hotmail password and scan his computer for trojans.  The real solution, however, is to prevent disclosure of his password – accidental or otherwise.  It is also a good idea to change the password periodically.

You might also be interested in:

• Phishers Target State Department Credit Union
• Facebook Security Snare
• CheckFree: A Case of Phishing, Pharming and Drive-Bys