It often happens that I receive an email like this:

From: acquaintance@herbal-viagra.com

To: me@domain.com

Hi, me@domain.com --

Check this out: http://herbal-viagra.com

-- acquaintance@yahoo.com

This looks like my acquaintance has gotten his computer infected with malware that has harvested his email contacts.

Often this happens with people I'm only slightly acquainted with, and for whom I have no means of contact other than email. Is it reasonable to respond to this by emailing acquaintance@yahoo.com with a copy of the message, saying: Hey, I think your computer got infected with malware that has harvested your email contacts? Or should I:

  • not respond at all
  • blacklist email from herbal-viagra.com in my spam filter
  • Note that it is possible to do what you are describing without comprising accounts. The only hard part is obtaining a list of contacts but I bet that if I search for the name of your friends from Facebook it wouldn't be hard to find out some relevant email address. This could easily be automated scraping the information from various public websites. – Bakuriu Sep 13 '15 at 8:48
  • You have no way of knowing whose account was compromised (if any was). Bob's account might have both your and Alice's addresses and be compromised. Alice's address could then be used for a sender's address for spam addressed to you. You'd think Alice was compromised even though her address was merely harvested, and Bob is the one who got hit. Or perhaps your account was compromised. – user2338816 Sep 13 '15 at 10:47

The likely scenario is that the sender's account got compromised, not necessarily their computer. Accounts are easier to hack because attackers just need to guess a password.

Responding has a high chance of alerting the sender, so it is worth a shot. Sometimes an attacker has active control of the account and will try to delete incoming emails, but I haven't seen that often. Even if that is the case, it is still worth a shot.

Blocking the domain of the link in your spam blocker will not be effective. The email comes from a completely different domain than the link destination. On the other hand, if you want to block that domain in your DNS or web filtering software, that might help a little, but those domains tend to exist for short periods of time.

  • I'm surprised by your statement that it's easier for bad guys to guess the password to a yahoo account than it is for them to compromise a computer. Won't yahoo throttle attempts at logging in to a system using invalid passwords? Sure, some people's passwords will be "password" or "secret," but I would think that most would require thousands or millions of attempts to crack using a dictionary attack. – Ben Crowell Sep 13 '15 at 15:55
  • Obtaining passwords does not necessarily require brute-forcing an account. Phishing, social engineering, data dumps from compromised services, in addition to malware, etc. can all be used to obtain account credentials. – schroeder Sep 13 '15 at 18:06

There are several scenarios that could lead to your present situation, but you swept almost all of them away when you said:

Often this happens with people I'm only slightly acquainted with, and for whom I have no means of conatact other than email.

This statement reduces the window of causes only to three:

  1. By coincidence only people you do not know that very much have had their email accounts compromised (malware running on the machines of these contacts, password guessing, using same password everywhere, sharing the password with other trusted people, bad surfing practices such as when a website asks a user to access his contact list ...)

  2. By coincidence, only people with whom you are slightly acquainted with have their accounts spoofed (different from being compromised)

  3. Rather it is your account that's compromised, and the attacker choosed to spam using your slightly acquainted people to you.

For the late case, you surely need at least to change your password after scanning your system for spyware presence.

For the two other cases, you can contact those people by email, for sure, but it may be completely useless. Training your spam filter would be the best solution for you. It makes your life bearable but you can not get rid of that totally in the future as attackers could bypass spam filters.

  • "you MUST avoid responding to the spam": I think that the OP was requesting about forwarding the message to the genuine acquaintance (acquaintance@yahoo.com) which should be fine, and not about answering to the spam (acquaintance@herbal-viagra.com). BTW I currently see more and more people raising this issue since a few weeks and I even received such email a few days ago, I wonder what/who is behind this... – WhiteWinterWolf Sep 13 '15 at 8:09
  • @WhiteWinterWolf Yes, you are right. As for the spams coming back in the news, that has always been the case because a spammers can send millions of email per day with botnets in a totally costless manner, but then if journalists have not much things related to IT to talk about, then a chance to hear of spams may occur. – user45139 Sep 13 '15 at 8:18
  • No, I did not meant journalist, I meant relatives of mine showing me email having this very same pattern: the sender name matches an acquaintance, the email address however is unrelated, and for the email I received I can see in its headers that the email address seems to be a genuine corporate email address used to sent these spam (the mail server includes an anti-abuse header mentioning the client system was an IPad, might be true or not it but could explain a lot of things...). – WhiteWinterWolf Sep 13 '15 at 8:50
  • 1
    I think you're reading too much significance into the fact that I get this a lot from casual acquaintances. Of all the people in the world who have me in their contact list, the vast majority are casual acquaintances. This is just a long-tails phenomenon. – Ben Crowell Sep 13 '15 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.