NWA-PCUG Newsletter Article, January 2013
Why You Might be Sending Spam
By Leo Notenboom


As you probably already know there’s a lot of spam – unsolicited and unwanted email – flying around on the internet these days. Some estimates say that well over 80 to 90 percent of all email is, in fact, spam.

That’s bad enough, but when someone tells you that it looks like spam is being sent from your email address … well, then it gets personal.

The most common causes of spam being sent from your email address have nothing at all do with your computer.

In other words, while it’s possible, it’s not necessarily because your computer has a virus.

Your email account may have been hacked. Actual account theft and hacking has risen dramatically in recent months. The scenario is very simple: a hacker learns your password and logs in to your email account. Once in he starts using it to send spam. The hacker never even has to come close to your computer, and in fact often performs his activities from overseas.

The question, of course, is how did he learn your password? Unfortunately there are many ways: perhaps your password is easy to guess, perhaps your so-called “secret questions” are easy to guess, perhaps you logged in to a public computer in a library or other public location that itself was compromised with malware or a keyloggers.

Perhaps you used your computer in an open Wifi hotspot, and the connection to your mail service was not encrypted and a nearby hacker was monitoring and saw your login information.

Perhaps you responded to a phishing attempt – an attempt to fool you into providing the hacker with your email login information including your password.

Perhaps you told a friend or family member who wasn’t quite as careful about keeping it private as you are.

And, of course, there could indeed be malware on your machine. In my experience that’s significantly less likely in this case than most of the possibilities above.

There could be absolutely nothing wrong One of the most frustrating aspects of this scenario is that it’s very possible that there’s nothing wrong at all.

The issue is simply this: it’s trivially easy to make email look like it’s from someone that it is not. So called “From spoofing” is used by spammers to hide their own identity. They pick email addresses at random – often email addresses to who they are also sending spam – and use those as the fake sender of the email.

In other words you may have had absolutely nothing do to with email that lists you as the sender.

And there’s nothing you can do about it. Before you assume this is the case, though, look at who’s getting spam email “from” you.

If they are mostly people you know, then it’s very likely that your email account has been hacked and your address book or contact list is being spammed. You need to take action right away by changing your email password.

In fact, you need to more than just change the password – you need to change or verify all the information in your account that could be used to recover your password. While the hacker had access to your account he had access to that too, and could have changed it or written it down so that he can easily come back and hack your account again.

You can certainly run up-to-date anti-malware tools on your computer if you like – you should be running those regularly anyway – but as we’ve seen, in all probability your computer wasn’t involved.

Click here to return to top