Hotmail account got broken into

[cynsaligia]

a hotmail account i rarely use anymore got broken into. everyone in my contacts list (oh, about 200 poor sods) received emails titled "ebay 7" with the following text:

Heya,how are you doing recently ? I would like to introduce you a very good company which i knew.Their website is http://www.mydosell.com .They can offer you all kinds of electronical products which you need like laptops ,gps ,TV LCD,cell phones,ps3,MP3/4,motorcycles etc........Please take some time to have a check ,there must be somethings you 'd like to purchase 7.
Their contact email: mydosell@vip.188.com . MSN: mydosell@hotmail.com .
Hope you have a good mood in shopping from their company !7
Regards
7

i found out about it bcs eric got one of these funky emails. immediately, i went to change my password & other information on the account, and i also notified hotmail of the unauthorized access. since the account is rarely used, i even went as far as deleting every single contact in the address book. (i figure scorching the earth on this one isn't over the top.) whoever it was that broke into my account also changed the settings so that anyone misfortunate enough to email me received a "vacation notice" with the above text.

i googled "mydosell" and found this lovely tidbit from theinternetpatrol.com:

It’s one of the newest spam tactics - spam vacation messages. Here’s how it works: spammers sign up for mailing lists, never intending to read them. Instead they put themselves on permanent vacation status, create one of those infernal “I’m on vacation” messages full of their spam message, and let the vacation program do their spamming for them. If they’re lucky, the mailing list is one where the vacation message goes back to the entire mailing list. So far we’ve seen spam vacation messages hawking mydosell.com, wholesaler-electronic.com, qigefa.com, and easevshop.com.

sucks donkey butt dingleberry on a stick.

my own fault, bcs the hotmail account--like i said, now rarely used--had an old password that wasn't as strong as passwords should be.

that said, if you don't already use a seemingly random set of numbers and letters in your passwords, you should change them now. using word-based passwords makes it easy for you to remember but also easy for unscrupulous folk to figure it out. a slate article suggested using acronyms you can easily remember, like "mcing435" which could stand for "My Car Is Neon Green with "435" being leetspeak for "yes."

let my mishap be your lesson.

[Nords]

Re: hotmail account got broken into

a hotmail account i rarely use anymore got broken into. everyone in my contacts list (oh, about 200 poor sods) received emails titled "ebay 7" with the following text:

This happened to me about six months ago and has been going on with Hotmail users for at least a couple years. In my case I opened an innocuous-looking junk e-mail that executed its virus attack on Hotmail's server as soon as I clicked to open it-- no attachments or links or anything else.

I don't think it's a password attack-- it's a virus on Hotmail's servers. Even Mac users are having the problem with their Hotmail accounts. After that first transmission it ends when users turn off their vacation response. I also set my Hotmail account to filter all incoming e-mail to the junk folder unless it came from an address on my contact list.

Here's a typical Microsoft response:
http://windowslivehelp.com/solutions...t-hijacks.aspx

It turns out that the long-term solution is... Gmail.

[cynsaligia]

Re: hotmail account got broken into

This happened to me about six months ago and has been going on with Hotmail users for at least a couple years. In my case I opened an innocuous-looking junk e-mail that executed its virus attack on Hotmail's server as soon as I clicked to open it-- no attachments or links or anything else.

I don't think it's a password attack-- it's a virus on Hotmail's servers. Even Mac users are having the problem with their Hotmail accounts. After that first transmission it ends when users turn off their vacation response. I also set my Hotmail account to filter all incoming e-mail to the junk folder unless it came from an address on my contact list.

Here's a typical Microsoft response:
http://windowslivehelp.com/solutions...t-hijacks.aspx

It turns out that the long-term solution is... Gmail.

lol. truer words were never spoken. a friend of mine suffered a similar fate and ran to gmail as well. prior to this happening to me, and mostly bcs i got an iphone earlier this year, i transitioned to gmail & ymail. i didn't even bother having eric add the hotmail account to my phone.

it may not be a password attack but the good advice re password construction remains good advice, yes?

[scrivener]

Re: hotmail account got broken into

My understanding is that the first thing the password-hacking bots do when they finally gain access is change the password so you can't get access to your own email. I think Nords is right and it wasn't a password hack but something on Hotmail's end.

[Vanguard]

Re: hotmail account got broken into

Thank you for the thorough warning. I'm never going to open a spam letter for entertainment purposes again!

I had some friends who lost their hotmail accounts. The accounts spam nonstop.

[cynsaligia]

Re: hotmail account got broken into

always glad to help, vanguard, even if the reason for my being helpful is bcs of my discomfiture.

once i changed my password & removed the vacation autoreply last night, the spam emails immediately stopped being sent. i'm sending emails from another account to my contacts telling them to block/delete that hotmail addy from their contacts list.

eric (my in-house tech/mechanic/chef/bug killer/perfect man) is now running a scan on my mac to be safe. he remains convinced my problem started with a password attack since (1) i often used that account for reference with external websites & (2) it is always accessed via webmail--it's never been set up with an email client.

in the end, doesn't matter anymore how they got access--the damage is done. i find this completely embarrassing and am kicking myself for not having changed that password in oh...five years? silly, silly cyn--she who knows much better!

best lesson to learn from this is (1) make sure passwords are secure & update them now & again; and (2) consider gmail, ymail and other webmail options besides hotmail, since--as nords pointed out--they've obviously got a problem.

[Kaonohi]

Re: hotmail account got broken into

I had a similar hack about a year ago. I had ordered a 99 cent ring-tone from ringtonetimes.net, and they enrolled me for a monthly fee of about ten dollars.
I asked them to reverse the charge, and they wouldn't, so I called my credit card and had them reverse the charge and block further charges.

Ringtonetimes (based in Taiwan) hacked into my computer, got my email list and invited everyone to join my new website at (I think) Multiply.com.
It was a weeks worth of work getting it cleared up, and a real pain, but they only got my 99 cents and bad publicity.

k

[Adri]

Re: hotmail account got broken into

I have several hotmail accounts for different purposes and none of them will let me delete emails from the inbox or the junk mail folder just now. I deleted some email earlier today. Anyone else having this problem? I don't think it's a virus because my avg ran clean and I am not having this trouble with any non-hotmail email account or any other website and I am pretty sure it's not because I was hacked because it's several hotmail accounts.

[Adri]

Re: hotmail account got broken into

and now it's back to normal. huh.

[Nords]

Re: hotmail account got broken into

it may not be a password attack but the good advice re password construction remains good advice, yes?

The password advice is good, yes, but in this case it's putting a stronger lock on the barn door-- while Hotmail's server is leaving the barn windows open and insisting that it's our fault.

once i changed my password & removed the vacation autoreply last night, the spam emails immediately stopped being sent. i'm sending emails from another account to my contacts telling them to block/delete that hotmail addy from their contacts list.

I think the virus sends out one blast from the contacts list and then only sends out vacation replies to incoming e-mails. So if you've shut off the vacation reply then it's over... until another spam e-mail somehow worms its way into Hotmail's servers. I don't know if the attack requires its e-mail to be opened or merely received by Hotmail's servers but as Vanguard says I'm a lot more paranoid about opening spam for entertainment.

I still have to download over a decade of stored e-mail to my hard drive, on something like Mozilla's Thunderbird, but when that's done then I'm deleting my Hotmail & Juno accounts. Gmail-only after that. Hotmail has burned through all their goodwill with me and Juno has gone steadily downhill the last few years.

eric (my in-house tech/mechanic/chef/bug killer/perfect man) is now running a scan on my mac to be safe. he remains convinced my problem started with a password attack since (1) i often used that account for reference with external websites & (2) it is always accessed via webmail--it's never been set up with an email client.

Never had a peep out of my antivirus software-- I think because the virus (password dictionary attack or otherwise) is on Hotmail's servers, not our computers. As usual I'd be shocked if he finds a virus on the Mac.

[missjaqi]

Re: hotmail account got broken into

Ugh! You're not the only one this has happened to. Unfortunately for one of my good friends (and me), he now randomly sends out emails inviting me to learn Chinese. Thanks for the lesson!

[cynsaligia]

Re: hotmail account got broken into

The password advice is good, yes, but in this case it's putting a stronger lock on the barn door-- while Hotmail's server is leaving the barn windows open and insisting that it's our fault.

...

Hotmail has burned through all their goodwill with me

agreed. even before this happened, hotmail made itself a source of discontent. the only reason i was holding onto it was bcs over the years, i'd used it so that certain vendors could contact me about certain deals (hello, sephora's friends & family discount days!) but whatever vendors i hadn't already switched to my gmail account prior to saturday night probably are lacking relevance to me now.

Never had a peep out of my antivirus software-- I think because the virus (password dictionary attack or otherwise) is on Hotmail's servers, not our computers. As usual I'd be shocked if he finds a virus on the Mac.

we didn't expect to find anything & of course we didn't.

[craigwatanabe]

Re: hotmail account got broken into

Once a virus has infiltrated a system (doesn't matter what OS) all the virus scanning won't pick up a thing because that virus has instructed the OS to disregard all security attempts to locate it. It's like giving the keys to the prisoners and the gun to the heads of the security guards. Make one peep and it's over.

[cynsaligia]

Re: hotmail account got broken into

Once a virus has infiltrated a system (doesn't matter what OS) all the virus scanning won't pick up a thing because that virus has instructed the OS to disregard all security attempts to locate it.

if that were true, wouldn't that practically render purveyors of antivirus software into little more than billionaire bamboozlers?

[GregLee]

Re: Hotmail account got broken into

A solution to the problem of finding strong passwords that one can remember is the Firefox extension "lastpass", which I've been using for a few months now. I'm not recommending it --- just noting its existence. It automatically generates and remembers passwords for you, as lengthy as you like, and uses digits or special characters in them, as you choose. You can keep your master file of passwords for various sites on your own system, or only remotely on the lastpass system, if you'd prefer (if you're nervous about your own system being broken into and your passwords stolen).