Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I use Hotmail. My password was strong (upper/lower case letters, digits, and special characters. No dictionary words. It was only 8 characters, maybe that was the problem?

I only use this password for my e-mail. Nothing else.

I didn't receive or respond to any phishing emails.

I checked news sites and there is no report of Hotmail itself being hacked.

MalwareBytes and other scanners/tools I have claim my system is clean. No key loggers.

Does anyone have any thoughts on how my account could have been compromised? They immediately changed the password, recovery questions, and recovery email. Then they sent spam asking my contacts for money (to be sent via Western Union). The IP address the mail appears to originate from seems to be a Nigerian ip block.

First, I don't understand how my password could have been gotten. When I tried guessing passwords, after 5 or 6 attempts, it made me enter a capatcha before each attempt. Can people brute force Hotmail/MSN passwords?

Second, it doesn't appear that there is anything I can actually do. When I search online, all I find are tips to prevent being the victim of fraud (IE - don't send money via Western Union) but I can't find any place to report the criminal(s). Does such a place exist?

Finally, what steps can I take to prevent this in the future?

share|improve this question

migrated from superuser.com May 16 '11 at 21:19

This question came from our site for computer enthusiasts and power users.

    
As an aside, I assume you patch your computer with the latest security updates, and do the same for your browser? I just wanted to add that to the end, otherwise, everyone else has given superb guidance. –  Welshboy May 16 '11 at 23:21

4 Answers 4

Hotmail can be bruteforced. And CAPTCHA is always being improved because it's always being broken. Also, sometimes companies have vulnerabilities they don't know about or don't acknowledge, etc. Basically what I'm trying to say is, even if you are very safe on the internet (as it sounds you are), your account can still be hacked.

One thing, however, many people over look is when and where they log into their accounts. It is best not to log into email and Facebook in places like the Apple store, on a Starbucks or McDonalds network, etc, as those computers and networks are "out in the open". As we saw with Sony recently, sometimes the big company won't even encrypt sensitive data before it starts sending it through the air. NEVER log into bank accounts from a public network.

Your account can also be compromised by someone cracking the password reset questions you set. Someone can use the forgotten password link to view these questions. If they are easy to guess or ones with common answers you are leaving your account wide open.

Notify your friends that you have been hacked, using Bcc. Notify Hotmail support. And probably, you will have to make a new account.

share|improve this answer

Getting e-mail passwords is incredibly easy. If you've ever logged into your e-mail on a public network (anywhere that isn't your house) then someone could get your password. They can use a packet sniffer or check the rounter logs. (you can actually do this on your own home network just to see how it works)

In order to prevent this from happening again, you need to make sure to only use ssl to log into your e-mail and it would be a good idea to use encrytion as well, like tor or a web proxy.

share|improve this answer
    
Windows Live | Login -> HTTPS –  Hello71 May 16 '11 at 22:49
1  
Your statement "In order to prevent this from happening again, you need to make sure to only use ssl to log into your e-mail..." assumes that lack of an ssl connection was the source of the problem. There are many many other ways this exploit could have occurred. –  Matt May 18 '11 at 0:36

One of the basic mistake that a lot of people make is using the same password for all the sites that they have accounts on .
Now strong or not if you use your email-id and the same password as log-in credential for a lot of websites its a big red flag . Because not all websites encrypt your passwords when they store it (and since they make such a basic design flaw their site is generally not very secure ). When these sites get hacked the hackers have a list of email-ids and their passwords , and voila your email account gets compromised.

share|improve this answer

Although I have no idea how you can get it hacked, I can give you some suggestions on where to go from here:

  1. Setup a new email account. I highly recommend Gmail, its very easy to use, and has lots of great features to add onto it. It can also be used to identify with many websites, such as StackExchange.
  2. Anywhere that had your hotmail account as the contact email, change it to your new gmail.
  3. Inform your friends. Although we like to think most people will not fall for a scam like this, it happens!
  4. You could attempt to contact Hotmail and their Support, and try to get the account back, or have them remove it.
share|improve this answer

protected by Community Dec 1 '11 at 14:11

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?