Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

It could be just coincidence, but in the week that my wife complains that her account has been 'hacked', I receive dodgy emails from most of the people I know who still use Yahoo accounts.

When my wife received reports from her contacts that they had received a dodgy spam email from her account, she logged in to check (she only uses the webmail interface). In her outbox, were two of the spam emails, but curiously they were marked as being sent to 'Recipients Unavailable' (or similar phrase). In my experience, whether you send emails to one person, several or a distribution list full of people, it will record this fact and allow you to view the details in your Outbox later.

When she raised this with me, I noticed that I'd had spam mails from a number of friends and family - all of whom were using Yahoo. I assume a similar thing has happened to them.

As far as we can tell, my wife's PC is clean, and she's changed the password to something else. But the fact that the recipients to these emails suggest that these emails originated from her (not-infected PC) nor from somebody/thing accessing her webmail directly, but from a third-party that either knew her credentials, or didn't need credentials.

Given that everyone I know with yahoo (that is, anyone who has one of my email addresses stored in their yahoo account) seems to be similarly affected, I assume it would be a big issue - but after googling, I've found no mention of any Yahoo problems beyond the usual ones.

Can anyone offer any insight?

share|improve this question

2 Answers 2

You have listed the three reasons, so it's good that you are aware of them... Let's go through them:

  1. Hacking

    You handled this just fine by quickly changing your password.

  2. Spoofing

    The SMTP protocol (the connection used to send mails) allows anyone to specify the address the mail originates from. So for instance, I could send a mail from any Yahoo address without knowing any password, it's possible but it's illegal...

    Most of the times, you can't do much against spam but if it's keep happening you can at least try to identify where the mails are coming from. You can do this by requesting someone who received your mail to check the mail headers and send you the data that is in there.

    This allows you to inspect the IP/host it comes from and inform their ISP about the spam.

  3. Malware explosion

    You handled this just fine by verifying the computer is clean.

share|improve this answer
    
Spoofing does seem the most likely, except that Yahoo Mail only allows SMTP access to paying customers - free customers have webmail and pop3 only. The yahoo servers shouldn't allow SMTP access from my wife... and if the emails were simply spoofed, how come they were (partially) logged in the Sent items in her account? –  CJM Oct 1 '10 at 19:55
    
Ignore Yahoo on this part, let's take two servers for example: I could send a mail that looks like it comes from Yahoo from my ISP to someone who has a mail at a random ISP... And look: The SMTP server of Yahoo isn't involved at all! I think the mails your wife sees in her out-box are bounced e-mails that return. For example, if you send a mail to me and type my name wrong then a mail will be sent to you that I am an unavailable recipient... I guess Yahoo is implemented to thus add a mail in the outbox to notify you with that, but I think it forgets to check if the original exists? –  Tom Wijsman Oct 1 '10 at 20:00
    
Anyhow, whatever happens... You can only be sure by inspecting the mail headers. –  Tom Wijsman Oct 1 '10 at 20:00
    
As for examining the headers, it is only after the event (after Mailwasher had cleared them all up) that I became curious. Since investigating, I've actually not seen any similar mails. –  CJM Oct 1 '10 at 20:03
    
You misunderstand... The emails are not bounced emails - they are outgoing emails (I do remember that much from the headers). What is more they appear as outgoing emails in Yahoo webmail - no, bounced emails are not somehow shown as outgoing emails. Furthermore, the emails purporting to be from my wife are sent to email addresses in her Yahoo address book - email addresses that are ONLY stored in her Yahoo account... which suggests hacking. But the fact that the outgoing recipients are not correctly recorded suggests spoofing... curious. –  CJM Oct 1 '10 at 20:36

I'd be tempted to say this was a coincidence. However, Yahoo! have just rolled out a major update to their client. This may point to it being hacking.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.