Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

John Doe told me the following story:

I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site of a company in my area of work opened. It didn't seem terribly interesting, so I closed it.

A few days later, I started to get mails from old friends saying "Hi, nice to hear from you" and yesterday, I got a mail from myself. Mail that I've never sent.

Since Mr. Doe is not a computer specialist what should he do next?

I suggested:

  1. Get the latest virus scanner, maybe even a bootable CD like STD and check for viruses/trojans
  2. Backup his private data
  3. Get in contact with the company - their web site might have been compromised
  4. Change the web mail password just in case
  5. Contact the webmail provider and let them know about the security breach
  6. Install Firefox instead of the default Web browser

Was that good advice? Anything I'm missing?

share|improve this question
    
Is there a "post-attack" tag or something? –  Aaron Digulla May 15 '11 at 19:35
    
There was a question recently that was similar: 'How to deal with a person who gets easily fooled by internet and mail scams' - I'm biased, but I thought the answer was pretty good :) –  Bob Watson Feb 11 '13 at 10:46
add comment

4 Answers

up vote 9 down vote accepted

For a "paranoid dial turned to 11" approach, I suggest:

On the system:

  • Backup all essential data.
  • Rebuild.
  • Install resident antivirus/anti-malware/firewall protection.
  • Install secure browser of choice, or update existing browser to latest version.
  • Install secure browsing and OS plugins and configurations of choice.
  • Make sure the OS and all applications are kept up-to-date.

For all user accounts, do the following, recusively.*

  • Change the password of the compromised webmail account.
  • Change the passwords of any accounts which use the same password as his webmail account.
  • Change the passwords of any accounts associated with the webmail account.

*(Example: GMail account was compromised. Facebook and Hotmail accounts use the same password. Change Facebook and Hotmail passwords. LinkedIn account is associated with Hotmail account. Change LinkedIn password.)

Also, contact the owner of the account that sent the e-mail to you, and let them know what's happened.

This is a very high-level view of the recovery process. In the end, it is up to you to determine to what depth certain protective measures need to be applied, based on whatever value you place on the data and/or accounts that may have been compromised.

share|improve this answer
    
You don't mention contacting the sysadmins of the involved systems. Is it futile to contact, say, GMail/Yahoo/Xyz about the incident? –  Aaron Digulla May 15 '11 at 20:53
1  
Generally, I wouldn't expect they can really do much for you. If it is a corporate account, you might want to forward the message to the security department so they can add it to the spam filter or put out an alert. Perhaps someone else might chime in with a better idea for the freemail providers. –  Iszi May 15 '11 at 20:58
    
I don't think there's much reason to contact the freemail providers, this doesnt sound like their service was compromised - it sounds a lot more like someone has their OS infected. Most likely some form of Outlook Express plugin... –  AviD May 16 '11 at 9:35
    
@AviD - I agree that the freemail providers' service would not likely be the breaking point here. However, many providers have spam/phishing filters in place and I imagine (though I've yet to research) there's probably a means by which users can submit samples to be added to the filter. –  Iszi May 16 '11 at 13:09
1  
"Change the passwords of any accounts which use the same password as his webmail account." Yes, but don't make the mistake to give them all a same password again. That behaviour has to be rooted out. –  Jan Doggen Feb 11 '13 at 14:37
show 1 more comment

The most likely explanation given this layman's description is that the “mail from the good friend” contained a link to a site that exploited a bug in his browser to install some malware.

If this is not a targeted attack, there's a good chance that the malware is a well-known one that standard anti-virus software can find and clean up. The malware may have then either read your friend's address book locally, or piggy-backed onto a connection to the mail server to read his address book there. If you're not too paranoid and you manage to identify the malware, perform the clean-up. If the malware is known to collect passwords, check all passwords and accounts that may have been breached, as Iszi explains.

If this may be a targeted attack (likely if Mr Doe is a bank manager or political activist, not very likely for some random Mr Doe), then you can't make any assumptions. Even if an antivirus finds a malware it recognizes, this could be a non-standard malware masquerading as a well-known one (but then why would it announce its presence at all?).

The fact that the malware was on a company that's related to Mr Doe isn't necessarily an indication of a targeted attack. It could simply be the malware's way of spreading, trying to reach people through channels they're more likely to trust.

Check the site of the company where you think the malware is coming from. (Don't use a vulnerable browser, of course, or only in a VM with restricted connectivity.) If you find a suspicious page, do report it.

There's not much the webmail provider can do, except let Mr Doe reset his password. It's unlikely that the webmail's security was at fault − the compromise happened on the client machine.

Another thing you don't mention is to check where the mail with the link came from. If it did come from the good friend, then the good friend's also been infected with the malware. Don't expect Mr Doe to be able to tell a spoofed email or even to understand the concept.

To prevent recurrence, at a minimum, install an up-to-date anti-virus (assuming Mr Doe is running Windows), and use an up-to-date version of Firefox or Chrome to browse the web.

share|improve this answer
add comment

Adding to Iszi's answer:

  • Do first account password change from an un-compromised machine.
  • Also change any password mnemonics or self-verification answers
  • review sent email - if the hacker is messy, you may see your own sent mail that you didn't send. Send update to anyone in address list or anyone in address list that you have reason to believe "you" sent infected mail to to let them know of the issue.
share|improve this answer
add comment

There are many fake email programs available where these kind of activities are perfomred sometimes you see that you rcved an email from your acc. Or sometimes you see an email telling to share the account details. The safety measures for these are if your acc provides advance spam protection enable it also check if you email service provider has 2fa services.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.