3

A day ago noticed a bunch of MAILER-DAEMON@yahoo.com emails in my Yahoo inbox. I checked my sent folder, and it appears that someone sent emails to all my contacts in my contact books with the following URL in the body (do not visit)

asalchemi.com/uqysife.php

This is an email address I do not frequently use (I check once every couple of weeks), so I went to my recent activity which shows devices and IPs that have connected in the past 30 days, but there is nothing suspicious there - they're all IPs I recognize.

I do not use a mail client, such as Outlook or Thunderbird, only Yahoo mail in the browser, and on the iPhone.

My question is... how is it that without any recent activity did the hacker send an email without triggering any recent activity?

  • 2
    It's impossible to give a precise answer but based on what you said, the entry point is probably one of your devices since it used your IP. – Julie Pelletier Aug 29 '16 at 20:59
  • Maybe an chain mail? Although they are not so common anymore – Yorick de Wid Aug 29 '16 at 22:02
  • 1
    Is external access through smtp/pop/imap allowed? Does it show up in the logs if you use the account that way? – GnP Aug 29 '16 at 22:21
  • @GnP is on the right track I think. It's probably a case where connecting to the mail server is only tracked when using the web browser / smartphone app. I don't think Yahoo tracks connections from imap/pop. – HashHazard Aug 29 '16 at 22:32
  • I use the default mail app with iPhone and iPad. I could be wrong about this, but I don't think yahoo mail allows you to stop external access through smtp/imap. – Snowball Aug 30 '16 at 14:42
2

I guess you gave permission to some App to Read contacts/Send email via Yahoo OAuth. I Mean, you singed in to some website/application using Yahoo credentials via Yahoo.

So, Just using the Access token that got created at that time you gave permissions, Its possible to send emails to all your contacts using the API of Yahoo.

In this case the App dont need to Login with your credentials. The Access token will suffice.

If this is the case, you can fix it by removing permissions to that App.

1

I checked my sent folder, and it appears that someone sent emails to all my contacts in my contact books ... I went to my recent activity which shows devices and IPs that have connected in the past 30 days, but there is nothing suspicious there - they're all IPs I recognize.

Seeing such emails in your sent folder shows they have access to your account.

  • Least likely: an unresolved vulnerability in the mail provider's system such as CSRF or XSS.

  • Possible: The 'Recent Activity' from your mail provider could be incomplete / may not cover every possible endpoint of their web application. (API, SMTP direct, IMAP, specific AJAX requests)

    If this were the case, then an attacker could remotely attack your account with just a stolen password (i.e. Phishing), and your devices may be quite clean.

  • You have malware on one of your devices.

Given a mail provider of this size, I suspect the latter to be the case.

  1. Change your password immediately. This could easily be in the attackers hands even if the attack originated from your device.

  2. Try to determine which device the attack may have originated from. I would expect that traditional computers to be a more likely attack vector than a Phone or Tablet, but either one is possible.

  3. Take appropriate countermeasures to cleanse the suspect device(s)

    • On a more containerized OS like Android, Chromebook (and probably iPhone/iPad), then you can simply remove the app.

    • If malware was installed on a classical OS (Windows or Mac), then you need to wipe the OS.

      It is possible that Anti-Virus software will have this particular malware in its database, and will be able to remove it quite conveniently.

      I would nevertheless recommend a complete wipe so you know that you have been thorough.

While some malware acts as soon as it is installed, and can easily be found in your recent Downloads; other malware sits idle for a period of time before acting out. (i.e. first collects credit card numbers, and later shows popup ads) Such built-in delays would make it more difficult to understand how you obtained the malware in the first place.

  • I use the mail app on my iPhone5S and my iPad, and my Windows computer. Based on what you're saying, it sounds like it is likely the Windows machine. Assuming that I did not type in the password on a phishing website, nor have the same username and login credentials at any other compromised site, and always use https to login to Yahoo Mail, does this imply that the malware must be collecting keystrokes? If so, how easy is it for anti virus software such as Avira or Malwarebytes etc to detect such key strokes? – Snowball Aug 30 '16 at 14:33
  • "does this imply that the malware must be collecting keystrokes?" This is quite likely, but there are other ways such as just hijacking your session after you are logged in. "How easy is it for anti virus software such as Avira or Malwarebytes etc to detect such key strokes?" As I said, Windows is a classical OS. So technically Anti-virus can do this just as well as any other program you install, since it is not sandboxed. If you choose a reputable company for the Antivirus then they probably won't do this to you. – Bryan Field Aug 30 '16 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.