Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts.

I changed the password, then saw (via rejected emails sent to my Yahoo account) that mail had gone out again with my email in the "FROM" field, to all my contacts.

However, in neither case did the account show to be accessed (verified in the Yahoo web client), nor did the account have anything in the sent folder of the account.

So I looked at the headers, and the last "Received" marker before the FROM looked suspicious, leading me to believe that my account is no longer able to be accessed, but with my full contact list, the spammers can now impersonate me and send out mail to my contacts.

Two of the headers' "Received" markers are shown below:

The "FROM" marker in each is my Yahoo account, caveatrob@yahoo.com

Received: (qmail 9004 invoked by uid 0); 27 Feb 2014 06:16:28 -0000
X-TCPREMOTEIP: 1.53.225.12
X-Authenticated-UID: brian@monahanlaw.com
Received: from unknown (HELO monahanlaw.com) (brian@monahanlaw.com@1.53.225.12)
  by 0 with ESMTPA; 27 Feb 2014 06:16:27 -0000
From: "Rob Lastname" <caveatrob@yahoo.com**>

This is the second:

Received: from [188.253.180.46] (helo=mst-music.ch) by box6.rapidenet.ca with
 esmtpa (Exim 4.80.1)   (envelope-from <caveatrob@yahoo.com>)   id
 1WIvxj-0003Jw-Rn; Thu, 27 Feb 2014 03:05:00 -0500
From: Rob Lastname <caveatrob@yahoo.com>
share|improve this question
    
Your question is not too clear, but you are absolutely correct that it is possible - and even easy - to fake a "from" e-mail address. There are even online services you can use to do it for about $20, if you're too lazy to do it yourself. What, specifically, do you want to know? –  KnightOfNi Feb 27 at 21:15
    
I'd like to know if it's safe to assume: 1. The account is no longer compromised with the password change, 2. The initial hack gave the attacker my address book, so 3. Any mail sent out today is not being sent by my Yahoo account, but via other servers via spoof, so 4. My account is secure, and 5. My address book is forever exposed, so the spammer can continue to send mail to my contacts. 6. There's not much I can do to recover. –  Caveatrob Feb 27 at 21:37
    
Sometimes emails can take a while to be rejected. Just wait, if it keeps happening you should investigate the IP and headers to see if they match Yahoo SMTP settings (send an email to a fake address and wait for the rejected reply to compare). Worst scenario he has a session open (cookie hax) and will use it until it expires (in an automated fashion ofc). Best case, no SPF for yahoo and he sends the emails on your behalf from somewhere else, to check this, edit your Name (From: "Rob TheReal Lastname") and check if it appears in future rejected reports –  Aki Feb 27 at 23:49

1 Answer 1

up vote 2 down vote accepted

I will answer this question in accordance with your numbered questions in the comment.

1: Impossible to know without access to your computer, if at all.

2: The attacker did HAVE access to your address book, but it is once again impossible to know if he made a copy of it on his machine.

3: Logically, if an e-mail exists, someone or something sent it. If it wasn't you, it was someone else. As @mr.spuratic pointed out, you can verify for certain that a e-mail WAS sent from within yahoo, but you can't prove that it wasn't.

4: Impossible to know without access to your computer and account.

5: See 2.

6: Make sure the attacker can't get your password again (do an AV scan, use HTTPS Everywhere, etc.)

Hope this helps you out.

share|improve this answer
    
Yahoo tend to use DKIM (though they don't definitively state all email does, and publishing DKIM policy is still somewhat messy). If the DKIM signature checks out, then you can be certain it originated within Yahoo, if there is no DKIM-Signature: header then it's a good indicator it did not. –  mr.spuratic Feb 28 at 10:03
    
@mr.spuratic Thanks, I actually didn't know that. Still, an absence of a definite policy, in my mind, means there is no way to be certain, just convinced. –  KnightOfNi Feb 28 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.