Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and it's always a verified sender from their email provider. My assumption here is that something found their password and is using it to log in and send emails from their email provider.

I have always assumed my passwords are secure and that, were emails to be sent from my address, I would see them in the "sent" folder. I hadn't put much thought into that idea, so it only occurred to me today that the spambot could just delete the email from the sent folder.

How do I know if my email account's password has been compromised and is being used to send spam emails?

share|improve this question
    
Where do you have your email hosted exactly? –  Joel Feb 27 '13 at 22:21
    
@Joel, Personally, Yahoo and Gmail, though I'm hoping for some advice agnostic of the email provider. –  mowwwalker Feb 27 '13 at 22:29
    
Service providers do it a bit differently, so agnostic may not be possible. Also your assumption may or may not be true. –  Rory Alsop Feb 27 '13 at 22:32
    
@RoryAlsop, Could you elaborate on how else it might be done? I'm also curious about that. –  mowwwalker Feb 27 '13 at 22:33
    
Read security.stackexchange.com/q/4887/485 and security.stackexchange.com/q/1601/485 - do either of these answer your question? –  Rory Alsop Feb 27 '13 at 23:21

1 Answer 1

Generally speaking I don't believe there will be an easy foolproof way of detecting whether or not you've been sending out messages given the access you typically have to a web based system (be it Yahoo, Gmail etc). If you had access to the server certainly you could through logging, but not with the information given to us via these clients.

Here are some suggestions through.

  1. Keep an eye on your login IP's if your client provides the capability of doing so. This can flag an attacker logging in from a location you've never been, hence raising the possibility of being compromised.

  2. Education - ask your friends / family to alert you to any strange messages such as the ones you've recieved in the past. The majority of the time I imagine if you're getting this stuff sent out you'll get a few replies from people going "Huh?"

  3. If you really wanted to you could create a honeypot email. Go sign up for some random email and place it no where else but your contacts in your email. An attacker would almost certainly send messages to everyone in your contact list, not knowing who is legitimate and who isn't. If Mr Smith recieves an email from you, you know your account has been compromised.

  4. Prevention is the best cure, make sure you'll changing passwords regularly and avoiding using the same password at multiple sites.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.