How was my Yahoo email account used to send spams

Question

My yahoo email account was sending spams at about 6:42pm EDT (the spams show 3:42pm PDT) yesterday. I realized it by receiving several "Failure Notice" emails for Yahoo was unable to deliver the spam messages to some of the intended addresses.

As much as I would like to know how to prevent such thing from happening, I would like to understand how the spam emails were possibly sent from my email account? Is it possible that someone else accessed my account to use it to send spams?

1. Suppose they didn't actually log into and send emails from my account,

   • I wonder how the spams were also stored in my "Sent" folder?

   • I also checked "Recent Login Activity" of my yahoo account, but all recorded locations and IP addresses from 4:47 PM the day before yesterday till late yesterday night are my own. I wonder how it is possible that someone else accessed my account to use it to send spams?

2. Suppose they did actually log into and send spams from my account.

   I wonder how they could possibly manage it, given that I had taken the following steps before the spamming happened?

   • My original password (p+N4th@y8yUcer4pr6HeyE2ewa2Ebu!e) was really long, 32 characters with capital and little letters, numbers and other types of characters, generated by some online random password generator. Also I haven't shared my password with any other website or person. Is such a password possible to guess?

   • My OS has already been Ubuntu 12.04.

     My browser has been Firefox 13.0. There are some installed Firefox Extensions (Brief, DownloadHelper, DownThemAll!, FlashGot, Global Menu Bar integration, Google Translator, Greasemonkey, Mason, Session Manager, Ubuntu Firefox Modifications)， Plugins (Adobe Reader, DivX Web Player, Google Talk Plugin, Google Talk Plugin Video Accelerator, iTunes Application Detector, QuickTime Plug-in, Shockwave Flash, VLC Multimedia login, Windows Media Player Plug-in), and user scripts (Google Book Downloader, Google Search -Remove Redirection, Scrub Google Redirect Links).

     I also used ClamTK to scan my home partition for virus and found none.

   • I sometimes opened spam emails, but never clicked hidden or non-hidden links in it.

   • Added: I just run rkhunter on my Ubuntu. The outputs of ./rkhunter -C is here and the output of ./rkhunter -c is here. They look fine, do they?

   • Added: Also I pasted each of the following two headers into geobytes spam locator, and found the sources of the spam emails are both from the same IP 187.41.82.250 in a different country (Brazil) from mine (USA). Does it mean the spams were actually not sent from my email account?

---

Header of one spam saved in my "Sent" folder

From Tim Thu Jun 14 15:42:07 2012
X-YMail-OSG: ivy79oIVM1k8kPIPgi4nfJh2JPdWcnzc7If0UmOfBQtmnkB
 nEmfLnPHJ
Received: from [187.41.82.250] by web162602.mail.bf1.yahoo.com via HTTP; Thu, 14 Jun 2012 15:42:07 PDT
X-Mailer: YahooMailWebService/0.8.118.349524
Message-ID: <1339713727.16968.BPMail_high_noncarrier@web162602.mail.bf1.yahoo.com>
Date: Thu, 14 Jun 2012 15:42:07 -0700 (PDT)
From: Tim <[email protected]>
Subject: HI
To: [email protected]
Bcc: [email protected], [email protected], 
    [email protected], 
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Length: 71

---

Yahoo notice of failure to deliver the spam to some intended address

Sorry, we were unable to deliver your message to the following address.

<[email protected]>:
Remote host said: 550 5.1.1 <[email protected]> User unknown; rejecting [RCPT_TO]

--- Below this line is a copy of the message.

Received: from [98.139.212.148] by nm21.bullet.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
Received: from [98.139.212.214] by tm5.bullet.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
Received: from [127.0.0.1] by omp1023.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 91992 invoked by uid 60001); 14 Jun 2012 22:42:08 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1339713728; bh=3k5IzdOBwo7Jx0VjjcU11ALbzymfvrJ2SheLqHngG7s=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=mk5ksTksAaA1u+2GJaaQoJaClM5AQeOmUn4A9e3xYyJVpER/mKvPB6e5NJlZ2WG1zhOvnrMUHGgqwxMMa7lf3K9tHzGxhbLddTxfM0udgCC2Ws4d7ebgACo2lT/92A9qGxxPIXQCSAEiK8/C7P5rQ6ZAOGOv5xMHuSMY3lUzs9Y=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
  b=enSetbkOfQmTtzS221NeSMw+dVAbV6y4iFhhSye/tdOobEqExxBebaFrFsehnXbU10/kB00lr3EVDJFCcYoJT5Sp9a7bz1r9L3CezVCrqeolUUNSN4R9qjreJCxk3YxcTnm9f//PvAIPDsqadFmZyDXcT5FyUEfiwb0cyERbL90=;
X-YMail-OSG: ivy79oIVM1k8kPIPgi4nfJh2JPdWcnzc7If0UmOfBQtmnkB
nEmfLnPHJ
Received: from [187.41.82.250] by web162602.mail.bf1.yahoo.com via HTTP; Thu, 14 Jun 2012 15:42:07 PDT
X-Mailer: YahooMailWebService/0.8.118.349524
Message-ID: <1339713727.16968.BPMail_high_noncarrier@web162602.mail.bf1.yahoo.com>
Date: Thu, 14 Jun 2012 15:42:07 -0700 (PDT)
From: Tim <[email protected]>
Subject: HI
To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Answer 1

There are a variety of ways in which someone can access your account, but in your instance I would say it looks as though you've either got a keylogger or a machine, a rootkit on your machine, or a dirty computer on your network that is sniffing the traffic (potentially stripping the SSL).

The reason I say this is because your password is so long and complex it's highly unlikely that it was guessed by someone and even less likely it was brute forced. The fact the last login IP on the account was your own also indicates that the account was logged into on your network would further my suspicion of a root kit or malicious back door.

Try running rkhunter on your machine and see if anything pops up. Aside from that I would check other machines on your network for bugs as well. In the meantime though, change your password on your Yahoo account to prevent further spam.

Answer 2

Looking at the emails, the line

X-Mailer: YahooMailWebService/0.8.118.349524

sticks out as possibly important. That is it seems that they did not use a regular login into webmail but are using Yahoo's Mail Web Service API to access your account (that is you gave an third party application an OAuth token to access your account). Have you granted any applications (e.g., iOS/android app on a mobile device) or a website any sort of access to your email account?

I don't use yahoo mail regularly (have an account only for fantasy sports) and would like to check that you never see that line in your normally sent emails (e.g., when you use webmail). I'd check your Account Settings (Manage Apps and Website Connections - I think is the correct setting), and check that you haven't granted any websites/applications third-party access to your account (including the ability to send mail). (Apparently this is normal headers for sending webmail from Yahoo.)

Check that you don't have any malicious browser extensions installed on your web browser (the kind that have access to all your information and conceivably could steal login information).

Due to the high number of firefox user-scripts/plugins/extensions you are using, one of them may easily be stealing your password. Basically, a browser extension/user script that you install can do anything to any webpage if the extension has permission to load on that page. Read session cookies, see what text is typed in password fields, and even send information back to attacker-controlled servers, etc. Find your extension (~/.mozilla/firefox/[random chars].default/extensions/) and user script directory and try looking through the source code for suspicious behavior from lesser known sources. *.xpi are just zip files; open them up (and any included jar -also just a zip) and browse source. Search for things like password/passwd/yahoo in application that should have nothing to do with logging into applications.