Email Hackers: How do they do it?

[Tubajug]

My email got hacked last night. It was one of those things where a bunch of my contacts get an email from me with some spam website in it (I apologize to anyone on here with whom I have communicated via email if you got one).

I'm not much of a tech guy, so I'm wondering how this happens? My password (I like to think) is very secure. It's an odd word in a foreign language with random numbers as well. My activity on my email showed that "I" had logged in from Hungary and Malaysia at 3:37 this morning.

Can anyone shed light on how this stuff happens?

[Tubajug]

Do you keep your email open all the time?

Probably more than I should. I've changed that already.

Do you use a firewall?

Yes

Do you have your email password stored in a document on your computer?

No

Is there a worm/trojan/virus on your computer that has installed a keylogger program?

Not to my knowledge. It's probably the first one. Thanks.

[Dan Schultz]

Yeah... I got an email from you with a link which I did not open. I suspect this happens when you 'click' on something you shouldn't have. Had I 'clicked' on it... the link would have probably raided my email list and resent the message. I doubt seriously if your email has been totally 'hacked'. I'm getting the same type of messages from several folks on this board... the one before yours being from Ken Herrick.

Most of this stuff is just annoying at the worst.

[Uncle Buck]

1. Do you use that same password for anything else other than that email account?

2. Have you received an email, facebook or twitter message, etc., that convinced you to click on a link, that took you to a page that really, really looked like your email login page, where you logged in thinking you were just going to your email account?

#2 is pretty common. Never, never, never log-in to any of your accounts via a link sent to you by email or social media. If you get an email that makes you want to log-in and check something, go to the known main website log-in yourself by typing in the URL that you already know. Even if the link looks like it is really that same URL.

Don't log-in to anything from a link. Period. Ever.

[Tubajug]

My password is similar to other things, but none are the same. I don't recall clicking on any of those types of things, or logging on anywhere but the main page, but who knows. I'll just be more careful! Thanks for the insights everyone.

Again, sorry if "I" spammed you!

[MartyNeilan]

Security questions are another way they can easily bypass your password. Make sure they are set, and something unique not something that anyone could easily figure out via google/Facebook.

[bort]

Security questions are another way they can easily bypass your password. Make sure they are set, and something unique not something that anyone could easily figure out via google/Facebook.

Just make up garbage or untrue answers (that you can remember) to your security questions. They only exist to be a string of text to verify... for example, there's no reason to *actually* use your mom's maiden name when it asks you for it.

[tbn.al]

My office is quite simple. A desk with a laptop on the keyboard drawer, a printer behind the laptop, a phone to the right and a shredder to the left on the floor. I had a sheet with login info and all my passwords printed out and hidden in a file floder in a drawer. One day I walked in and interupted my granddaughter running it through the shredder. I had it out earlier to get into a seldom used account and left it within her reach. I did not have a copy on my laptop becuase I had been cautioned not to. I am not sure it is any worse to have to reconstruct all that because I am hacked or not.
I now have my entire computer encrypted and I have multiple copies of my password file available. It's just such a hassle otherwise.

[Ken Herrick]

Hey Dan,

V E R R R Y interesting! This first came to my attention last night when i got the email from Jordan.

After 2 looks I bumped the link - EASY to do on the phone. As soon as i saw the spam I deleted the lot and notified Jordan.

MIGHT BE AN IDEA TO GET A NOTE ABOUT THIS ONTO THE MAIN FORUM.

edit after further checking:

Don't think it came from my phone as I don't have you as a contact or any correspondence etc with your address on here, Dan

[Dan Schultz]

Hey Dan,

V E R R R Y interesting! This first came to my attention last night when i got the email from Jordan.

After 2 looks I bumped the link - EASY to do on the phone. As soon as i saw the spam I deleted the lot and notified Jordan.

MIGHT BE AN IDEA TO GET A NOTE ABOUT THIS ONTO THE MAIN FORUM.

edit after further checking:

Don't think it came from my phone as I don't have you as a contact or any correspondence etc with your address on here, Dan

Ken.... I've been getting those one-line email 'links' from you for about a month now. I never open them. I don't think this is a product of anything that's happening on this forum.

[tbn.al]

Of course that (password "password") is only dangerous if it allows access to anything important.

[Uncle Buck]

I use this to store my passwords. (Once I passed 40 I just couldn't keep track of them all in my head anymore.)

https://identitysafe.norton.com/?ctb_product=Norton" target="_blank" target="_blank

Here's another idea from a high school friend of mine. I've been too lazy to actually do it, though.

http://granades.com/2011/01/14/how-to-m ... easy-step/" target="_blank" target="_blank

[Mark]

My password is "password".

It would never occur to ANYONE to try that...

My ATM PIN is 1234.