3

I received a suspicious personal email from someone whose username is the first and middle initial, and last name, of a friend. (My contact with said friend is usually via social media.) Header info indicates it originated in Vietnam and arrived via a server in Utah.

Coincidence, or change my password? I have in the past implemented weighting to identify spam, but I wonder what methodology might be used to assess this?

  • 5
    I'm not sure how you would be compromised. The most likely scenario is that your friend's account was compromised. – schroeder Nov 29 '16 at 17:28
  • 1
    Yeah, I don't know why you would need to change your password just because you got a shady email... – sxcurity Nov 29 '16 at 17:43
  • They did not have a real domain name for his email address, just the correct string left of @. I'm using this example to illustrate why I'd like a specific strategy. – user722951 Nov 29 '16 at 17:47
2

This is a simple attempt at phishing. It is not hard at all to spoof an email and make it appear as it came from whatever address you want. If you don't open the email you are fine. If you open it but do not click any links or allow to run any scripts you are fine.

How serious it depends on exactly what the email content was and what links they tried to get you to click. If you clicked a link and it looked like your bank's page, then yes call your bank and put extra security measures on your account.

How this comes about would be if one of your facebook friends has security set to allow anyone to view their friend's list, or their account was compromised. That si how they learned of your connection to the person whose address they spoofed the email. The reasons for doing this is because if you think if the email is from someone you know, you are more likely to open it and handle it as trusted.

How they got your email address is another thing to think about. If your facebook friend has their friends list set to public, that still would not reveal your email address unless you have your email address visible to everyone. If your email address is set to be visible to only friends, then one the attacker friended one of your facebook friends ( which isn't hard to do) and that made your email address visible to the attacker. I set my email to visible only to me. This is what I recommend because you cannot control the security practices of your friends or keep them from accepting friend requests from attackers.

Another possibility is they had your email address to begin with, from some other means, and perhaps your friend list is set to public, so they started with your name, then got your email, and then got your friends list so they could craft an email that looks like it is from someone you know and trust.

| improve this answer | |
0

One of the keys to make a successful attack is to know the victim (where they live, eat, etc.) and their relatives,friends, etc.

In this case, it depends a lot on whether the mail you recieved is a phising attempt or not:

  • Is it asking for any personal information (even irrelevant one)?
  • Is there any HTML?
  • Is there any link?
  • Is there any attached document?

Answering "Yes" to any of the above questions doesn't mean you are 100% under attack, maybe it's your friend the one being scanned.

What would I do?

  1. Make sure I still have access to online accounts (even the most irrelevant ones).
  2. Change every password that could be guessed via social enginering (way better not to have any of those from the very beginning)
  3. Warn my bank of this issue and agree on doing some kind of confirmation before any money transaction (phone call for example).
| improve this answer | |
  • 3
    You would warn you bank every time you recieve a suspicious email? Why on earth would that be called for? Wouldn't it be better to call the friend in question and ask if they sent the email before you call the bank? – Anders Nov 29 '16 at 20:06
  • Deppends on how much you care about your private stuff. I'm not saying you have to, it's just a suggestion, you never know what can be going on. – sysfiend Nov 30 '16 at 15:14
  • I would be calling my bank almost daily if I followed your advice. Under what scenario would recieving spam, be it personalized or not, be a sign that your credit card is compromised? – Anders Nov 30 '16 at 15:17
  • If you are sure it's not compromised, don't call them, but you can't be sure of anything untill it happens. – sysfiend Nov 30 '16 at 15:28
  • I can never be sure I am not compromised, but I can not constantly be calling my bank. My point is that recieving a strange email is not a sign that you are compromised. – Anders Nov 30 '16 at 15:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.