I don't know why it seems IMPOSSIBLE to find a blog or any security expert explaining the procedure of how this 'hack' works.

My wife is receiving emails from people she's emailed through Gmail telling her that she they are getting spam from her email address (3 people, one forwarded the email with single link spam). Some interesting features of these emails:

  • the email contains her correct email (yes I know this can be spoofed)
  • the email contains the contact's correct email

So in order for this 'hack' to happen, the spammer needs access to:

  1. Her Gmail Contacts list
  2. Her sent emails directly
  3. Facebook friend emails
  4. 1-3 for one of her Contacts
  5. 1-3 for a mutual contact of both her and her contact and the spammer just tries mass guessing

My questions are:

  1. What are the most likely steps for how this 'hack' occurs?
  2. What are other possible ways this 'hack' occurs?
  3. Are there ANY resources online which explain how this works: Wired articles, SE posts (I've searched, only a YAHOO CSRF), ANYTHING which gets in any more detail than future prevention?

I'd love to see ANYTHING with more technical detail than 'what you do next' posts. (A Google search brings back nothing.)

  • Is she accessing GMail through outlook, or any non-browser stored locally on her computer? Has she allowed her browser to store her password? Does she have any unusual toolbars or add-ons to her browser? Any of the above would allow a bot to access her login information, but anything else would probably be a targeted attack (unlikely, given how the info was used). – KnightOfNi Aug 24 '14 at 18:58
  • She very rarely uses thunderbird. I run Norton Internet security and once a month run several malware detection tools. Passwords are stored with lastpass, but like most users, she is perpetually logged into gmail. I think it's less likely it was anything on the local machine. Maybe CSRF somehow? – Joe Aug 24 '14 at 19:02
  • That's mostly fixed for Firefox (which I assume you're running, based on the fact that you're using Thunderbird), but cookie theft is a possibility if she's always logged in. – KnightOfNi Aug 24 '14 at 19:46
  • She uses chrome. Either way, you have to be more technical than 'cookie theft' to get to the bottom of how this would work in principle. – Joe Aug 24 '14 at 20:23
  • Have you checked last account activity? Has she logged into her account from other points than her computer? (work, friends, etc.) – user10008 Aug 24 '14 at 20:28
up vote 1 down vote accepted

Short answer to your first question: no one knows. Your request for the most common method for contact list harvesting is a tall order. The problem is although we have estimates of, say, the number of computers infected with viruses, or the number of data breaches, or the number of vulnerable websites, or the number of phishing emails, it's very difficult to know which source is the most common specifically for harvesting contacts for several reasons. We know that about 40% computers are infected with some sort of malware (bots, worms, viruses, trojans), but only a small percentage of these are for harvesting your contact list per se (many are for key-logging, snooping for financial info, bitcoin mining, and most likely: just sending out lots and lots of spam). On the other hand we also know that 37.3 million users (Kaspersky) experienced non-virus phishing attacks.

The problem is that our data suffers from selection bias because we only have data from antivirus programs which detect the attack, and because of this we don't know which attacks are the most successful.

As for resources: the best resources usually come from security firms which track these things the best they can. Here are several reports which describe the best we know about the statistics. But again, don't expect an answer to which source most likely takes people's (your wife's) contact list:

http://media.kaspersky.com/pdf/LK_KSB_2013_spam_EN.pdf http://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_v19_21291018.en-us.pdf

But if you're fine with the answer of 'we don't know', I can list how some of the attacks work (HAW) (in no particular order) and how to guard against them (WYCD):

  • Data breach - HAW: Facebook/Linked-in/Google or another smaller site or hacked or have a vulnerability of all sorts - WYCD: not much just make sure you use different passwords for each site
  • Direct hack - HAW: if a hacker knows enough about you, they might be able to guess your password, then they have direct access to your account - WYCD: make sure you have a secure password over 8 characters at least with no dictionary words.
  • Poorly designed website is hacked - HAW: a large number of websites have vulnerablities (XSS, SQL injection, etc). If any of these have any way to connect you to your contacts this could have happened. WYCD: Not much you can do about this
  • Bad Mobile app - HAW: a mobile app has access to your gmail contact list and is sent to a third party WYCD: don't install apps you don't trust; look at the app permissions you grant
  • Wifi snooping HAW: most wifi APs bleed all sorts of personal information to the open. WYCD: use encryption as much as possible (https not http) (gmail has this)
  • Phishing - HAW: Either through email or social networking a user is tricked into visiting fake a site has the user enter their login information or asks for this information directly over email and the account is hijacked or, as you mention, get direct access to your email through CSRF. WYCD: Install a good AV program which has a good phishing heuristic
  • Malware (Bots, Viruses, Trojans, Worms) - HAW: Although there are all sorts of viruses, a few of them do try and grab your contact list from an executable. Java vulnerabilities are very popular lately. Someone will send a java file, and a single double-click and it's installed. WYCD: only open attachments from trusted sources and make sure you have a good AV program.
  • Browser vulnerabilities - HAW: All browsers have vulnerabilities, sometimes visiting a malicious site can trick your browser to installing malware . WYCD: make sure you have a program (most AVs have it) that warns you about malicious sites - there are also browser plugins that do this. Also keep your browser up to date (and OS) with latest security fixes.

There are actually many more. But I would say these are the 'most common'. Go through the reports above to get an expert assessment of the state of software and web security.

I have helped people who have experienced exactly the same thing that you are describing and it was simply the result of an infection. A program connects to her gmail account, and searches for emails in her contacts and folders, including the deleted items folder. Then, spam is sent out.

I know that you have scanned her machine, but scans do not always catch the very new variants of malware. In the last case I worked on, I was able to trace the infection to a file the person opened that was also sent to her by one of her contacts.

  • Which virus? What is the prevalence rate? Again, I really want to know why so many people have these problems. But thank you for your input. – Joe Aug 25 '14 at 2:09
  • 1
    @Joe I am now completely confused about what you are looking for. You asked for the steps concerning how this can occur, I provide steps that I have personally seen, and you then ask for the prevalence rate of the particular strain I saw? Why do so many people have these problems? Because many people are uncareful enough to click on things that are infected. – schroeder Aug 25 '14 at 14:55
  • And how do you know this? My original question said "What are the most likely steps for how this 'hack' occurs?" Are you sure that because you know of A way (which you don't seem to have any information about), that this means this is the MOST LIKELY way? Can you name ANY virus that does this? 'Viral-inviters'/contact-scrapers, Phishing CSRF, or the FB/Google breaches seem MUCH more likely. I'm sorry, even it was all viruses, your one example of a virus that you have no information about is not enough to extrapolate to answer my question, that's not how evidence works. – Joe Aug 25 '14 at 17:15
  • @Joe I am an expert at getting people to click on things that they shouldn't. I own and run SelfPhish.com. If you want to discuss the LIKELY ways this hack can happen, then you have to come up with a very good reason why an errant clicker is NOT the likely scenario. All I have to go on is what you've told me, and I am working completely in the dark because I do not have access to the primary data. I have dealt with 3 different types of malware in 3 different incidents. Can I name them? No. But why do I need to? I can't help if all you do is dismiss suggestions. – schroeder Aug 25 '14 at 17:24
  • And I have a friend that owns 3 internet security companies, has a Ph.D in the area, and has worked in the industry for 30 years and he said that viruses are not a major source of this type of harvesting. Unless you have something more than, "Because I said so", I'm sorry, your word just wont cut it. – Joe Aug 25 '14 at 17:29

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.