How do I know if my email account has been hijacked?

Question

A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and it's always a verified sender from their email provider. My assumption here is that something found their password and is using it to log in and send emails from their email provider.

I have always assumed my passwords are secure and that, were emails to be sent from my address, I would see them in the "sent" folder. I hadn't put much thought into that idea, so it only occurred to me today that the spambot could just delete the email from the sent folder.

How do I know if my email account's password has been compromised and is being used to send spam emails?

Answer 1

Generally speaking I don't believe there will be an easy foolproof way of detecting whether or not you've been sending out messages given the access you typically have to a web based system (be it Yahoo, Gmail etc). If you had access to the server certainly you could through logging, but not with the information given to us via these clients.

Here are some suggestions through.

1. Keep an eye on your login IP's if your client provides the capability of doing so. This can flag an attacker logging in from a location you've never been, hence raising the possibility of being compromised.

2. Education - ask your friends / family to alert you to any strange messages such as the ones you've recieved in the past. The majority of the time I imagine if you're getting this stuff sent out you'll get a few replies from people going "Huh?"

3. If you really wanted to you could create a honeypot email. Go sign up for some random email and place it no where else but your contacts in your email. An attacker would almost certainly send messages to everyone in your contact list, not knowing who is legitimate and who isn't. If Mr Smith recieves an email from you, you know your account has been compromised.

4. Prevention is the best cure, make sure you'll changing passwords regularly and avoiding using the same password at multiple sites.