Hotmail hacked...

[Steve]

My Hotmail account was hacked today for the first ever time. It sent an email to all my contacts...apparently I am a foreign company selling mobile phones and PDAs n suchlike

Obviously I changed my password immediately...and reported it to MS...but now I worry:

a) How they got my password
b) What other information they may have got!

What would you suggest my next steps should be?

[Roy5051]

Open a Yahoo account?

[Fen]

Open a googlemail account

[Steve]

Are you guys saying that Hotmail accounts are unsafe or that my hacked account is unsafe (even though I have changed password)?

[Muffin]

Since I moved to PlusNet from Tiscali (!) I have had a Hotmail account for the first time and I find it excellent. I haven't been hacked but your hacking is certainly worrying. Do you have a decent firewall? I use Comodo (free)and NatWest do something called 'Rapport' which allegedly protects me from all kinds of nasties.

Hotmail would seem to have their act together and I am surprised they are vulnerable to hackers.

[Tooslow]

Steve,
might it be this? http://tinyurl.com/y8fvdv2 Do the date / symptoms agree with what you saw? If so then maybe your account wasn't hacked.

I've used a Hotmail account with no problem for 5 years or more. it's no more open to hacking then any other. Just make sure you have a good password.

JH

[beejaybee]

Ummm ... a miscreant can send mail appearing to come from "xxx@hotmail.com" (or anywhere else for that matter) without going anywhere near the hotmail servers, let alone cracking the password.

Case not proved.

[Fen]

Are you guys saying that Hotmail accounts are unsafe or that my hacked account is unsafe (even though I have changed password)?

Nope, just don't like hotmail

[Steve]

Ummm ... a miscreant can send mail appearing to come from "xxx@hotmail.com" (or anywhere else for that matter) without going anywhere near the hotmail servers, let alone cracking the password.

Case not proved.

But an email was sent to my entire contacts list...how would they have my contacts if they hadn't hacked the account?

[Steve]

Steve,
might it be this? http://tinyurl.com/y8fvdv2 Do the date / symptoms agree with what you saw? If so then maybe your account wasn't hacked.

I've used a Hotmail account with no problem for 5 years or more. it's no more open to hacking then any other. Just make sure you have a good password.

JH

Doesn't sound like this could be the case.

On an unrelated matter...you realise using tinyurl is pointless on a forum like this where you can give the URL a title like "Link"...I only mention it because I am always wary of clicking on links where I cannot see where it's going to take me.

[Fen]

Ummm ... a miscreant can send mail appearing to come from "xxx@hotmail.com" (or anywhere else for that matter) without going anywhere near the hotmail servers, let alone cracking the password.

Case not proved.

But an email was sent to my entire contacts list...how would they have my contacts if they hadn't hacked the account?

you opened any dodgy emails?

Quite easy to write a macro, put it in an email and then when the person opens the email it automatically sends out a spam email to everyone in your address book.

[Steve]

Ummm ... a miscreant can send mail appearing to come from "xxx@hotmail.com" (or anywhere else for that matter) without going anywhere near the hotmail servers, let alone cracking the password.

Case not proved.

But an email was sent to my entire contacts list...how would they have my contacts if they hadn't hacked the account?

you opened any dodgy emails?

Quite easy to write a macro, put it in an email and then when the person opens the email it automatically sends out a spam email to everyone in your address book.

I tend not to open any emails from addresses I don't recognise. Guess I'll never know for sure.

[AndyTake2]

Sending emails that look like they come from any address is relatively easy - we used to do it as part of the computer security course for CompTIA security+ at college - sending emails which look like they come from the tutor saying we'd all passed and could go home etc.

Getting hold of your address book is a bit different.
If you have sent emails to groups before, then it could be obtained that way, otherwise you really do need to scan your system, assuming your list is on your computer.

if you can get a hold of a copy of the email, you can check the details in the header - they will usually contain the route the email took to get to the recipient.
Send a mail to the same recipient telling them it is a test and ask them to forward it to you again, and compare the information - if it is the same then it is something nasty on your machine.
If it is different, then you can send the info to hotmail to see if they can start a trace.

I hate scum like this - it causes headaches for a lot of people and they should be made to carry the message by hand along the same route as the cables- including the section under the sea (I will provide the concrete wellies )

Oh, and as for Google - I trust them less than anyone else on the planet - seriously.
THey are an advertising company, who look after their own and it wouldn't surprise me to see any of your info online if you go with them.

Put it this way. THe only time my credit cards have been used fraudulently (or an attempt made) is using details used through google checkout. The info I gave including email address was never used on any other transaction, so there's only one place the leak could have come from.

[ermintrude]

mmm dont know. Off topic, but several few friends twitter accounts were hacked last night with the same tweet about better sex and longer or summat, and my credit card cloned all at once, so everythings feeling a bit unsecure at the mo

[Tooslow]

Steve,
"you realise using tinyurl is pointless on a forum like this where you can give the URL a title like "Link".

I hadn't realised. Other forums that I lurk in, oops - frequent, encourage use of Tinyurl. Something to do with traffic going the site I think. Thanks for the tip, I'll investigate. I do agree with the point about "where the dickens is this going to take me?".

JH

[nspur]

Quite easy to write a macro, put it in an email and then when the person opens the email it automatically sends out a spam email to everyone in your address book.

Probably only if your email client is Outlook Express or something that uses the Windows Address Book, or Windows or indeed anything Microsoft. I use Opera Mail under Ubuntu with accounts from ICUK and have never had a problem.

[Ephemeral]

There was always this http://news.bbc.co.uk/1/hi/8291268.stm - so you could have been compromised.

But don't know how likely that is

[Adesw]

Sending emails that look like they come from any address is relatively easy - we used to do it as part of the computer security course for CompTIA security+ at college - sending emails which look like they come from the tutor saying we'd all passed and could go home etc.

.

Reminds me of highschool! lol.

Once we'd worked out the port numbers etc to the schools email server, and managed a workaround to the schools block on dos we were more than on our way with dodgy emails n telnet.