IIRC, Yahoo! took over for most of the Bells. My Pacbell.net account is
now managed by Yahoo!, and I had a similar event happen last year, as
well as a friend of mine who had her account with another Baby Bell
compromised.
Considering how much support is off-shored these days, it wouldn't
surprise me if it was an "inside job".
73, Jim KQ6EA
On 06/29/2013 08:42 AM, Phil Karn wrote:
On 06/26/2013 03:31 PM, Roy wrote:
Thanks Phil. Yes, I'm not sure how it was done but the settings are
correct in my PC. AT&T has helped me to assign a new password to my
account to shut this down. They say it appears to have been hacked on
the AT&T web mail site.
Interesting. I saw no actual evidence in the scam mail itself that
your account had been hacked.
This particular message was sent through Yahoo's webmail service.
Anyone could subscribe to the amsat-bb list and see who its
contributors are, so they would know who to send the scam spam to.
(Wait -- does Yahoo provide service for swbell.net?)
Without cryptographic authentication it's easy to forge email from
anyone; SPF helps somewhat but it's often not implemented and is
frequently ignored even when it is. In this case I perused the headers
myself and saw the IP address 41.71.175.195, which happens to be in
Nigeria (look it up!)
It's somewhat trickier to intercept the replies. In this case they did
it with a Reply-To: header to a fraudulent account
(rdwel...@yahoo.com) that'd be easy to miss if you weren't looking for
it.
I had theorized that they did this because they hadn't actually gotten
into your swbell.net account, but it's possible they did it anyway so
that they'd still get any replies from victims after your account had
been secured or shut down. It would take a little longer to get
rdwel...@yahoo.com shut down since it's at a different service provider.
_______________________________________________
Sent via AMSAT-BB@amsat.org. Opinions expressed are those of the author.
Not an AMSAT-NA member? Join now to support the amateur satellite
program!
Subscription settings: http://amsat.org/mailman/listinfo/amsat-bb
_______________________________________________
Sent via AMSAT-BB@amsat.org. Opinions expressed are those of the author.
Not an AMSAT-NA member? Join now to support the amateur satellite program!
Subscription settings: http://amsat.org/mailman/listinfo/amsat-bb
