NWA-PCUG Newsletter Article, June 2011
E-mail Hacked? An Ounce of Prevention…
By Lee Seidman, Vice President,
Business and Professional Microcomputer Users Group, Inc. (BPMUG), CT
February 2011 issue, The Help Key
Man (at) yahoo.com (click to email author)

Recently, some unsuspecting e-mail users may have experienced dismaying and shocking notifications suggesting that his or her e-mail has been hacked and used to send spam (or worse), even if the e-mail system is web-based rather than downloaded directly to one’s computer via a local application like Microsoft Mail, Outlook, Outlook Express, MacMail, Entourage, Thunderbird, etc. (and hence, susceptible to operating system-level vulnerabilities). The primary suspect is the password used to access the account.

People tend to try to keep things simple by using the same password to access a variety of sites, but at the risk of security. People’s e-mail account password should never be used for any other account or web site. Generally, e-mail can be compared to a postcard; although the message is destined for a particular recipient, it has the potential to be read by anyone as it traverses the Internet. Additionally, if one joins a web site that requests a password to subscribe, a confirmation e-mail is often generated clearly presenting the username (often an e-mail address) and the proper password. The postcard analogy applies to that non-encrypted e-mail – it is open for anyone to read. A typical malicious-minded hacker (the “Black Hat”) who either intercepts that e-mail or accesses that web site’s consumer database would first attempt to use that password associated with that e-mail address to access the e-mail account. For example, if someone is whomever@aol.com registers to join community web site or message board site-whatever.com, generally he or she is asked to use his or her e-mail address as the user name. Site-whatever.com will ask the person to generate a password and often will send a confirmation e-mail identifying the username and password in clear text (meaning it is not obscured). The first thing a third-party (in other words, someone who is not the subscriber or a representative of the web site) may try to do is use the password contained in that e-mail to access homever@aol.com itself.

Once a hacker with bad intentions gets into the e-mail, he or she may start slowly to not get noticed, however, it does not require much effort for the “Black Hat” to change the password AND security questions (for password resets) to effectively lock the account owner out of his or her own e-mail. If nefarious activity is suspected to take place with one’s e-mail account:

* Inform those in your contact list of the circumstances, preferably by voice or an alternate e-mail account and make sure they understand not to engage the questionable content (usually seeking money in one form or another – especially via embedded hyperlinks); get as much help to act as quickly as possible as time is of the essence and everyone in that contact list is potentially at risk since they trust the e-mail is coming from you when in actuality it does not.
* Change the password to access the e-mail account (and make it complex and very difficult to guess)
* Change the security questions to change the password
* Notify the e-mail provider
* If this is a commonly used password for online financial transactions (banking, purchasing, etc.), change the password for those e-commerce sites
* Keep all correspondence between the “Black Hat” and any contacts as evidence
* If money is involved, contact local and federal authorities at the Internet Crime Complaint Center (http://www.ic3.gov/default.aspx), especially if the “Black Hat” actually defrauded someone out of money.

In general, it is a good idea to have an e-mail account for personal correspondence and a separate one for web-based subscriptions (or use a temporary/disposable e-mail address offered by the majority of providers). The key is to use distinct passwords; the online world can be a dangerous place in which to operate, but one’s own behavior usually determines the level of jeopardy one will risk in such an environment. A little forethought can prevent a whole lot of hind-sight consternation.

Click here to return to top