What to do if your Hotmail account got hacked – the recent spate of attacks on Hotmail accounts
If your friends and contacts have received an email or IM message from your Hotmail account with wording along the lines of "I would like to introduce a good company who trades mainly in electronic products... etc" - it is highly likely that your Hotmail account has been compromised.
IF YOU ARE THE POOR SOUL THIS HAPPENED TO, THEN YOU SHOULD READ ON AND FOLLOW THE INSTRUCTIONS AT THE BOTTOM OF THIS ARTICLE.
In most cases when a spam email is sent in your name to someone else, the spammer doesn't need access to your account. All they need to do is spoof your email address - i.e. make it look like it was sent from you. That's very simple to do, and is very common.
However, the latest spate of spam from Hotmail accounts is different in that the attackers actually hack into your Hotmail account and then do some or all of the following things:
- They send a spam email to all your contacts.
- They may send a spam IM message to all your Messenger contacts
- They may delete all your Hotmail contacts
- They may set your autoresponse (the one you set when you go away) to send this spam message
- They may set your email signature to include the spam message
You know that they have hacked into the account because you can see clearly that they have sent an email from it to all your contacts, or even an instant message. They would not be able to do this if they did not have access to the account.
HOW IT HAPPENS
I don't have a definitive answer, but I do have a theory which, based on the evidence, looks likely. If your password is a common name or a word that appears in a dictionary, then your account is vulnerable, even if it has a year of birth or number attached to it.
This is how the hackers do it:
- They employ an automated script that is fed your Hotmail address and then goes to work./li>
- It feeds the entire dictionary and common passwords and names into Hotmail one by one, trying to log in.
- After several attempts Hotmail "locks" the account and present a CAPTHCA (i.e. a string of wonky letters and numbers that are supposed to stop scripts from doing exactly that, because only a human can read these letters, supposedly).
- Unfortunately the CAPTCHA method no longer stops scripts, because hackers have found ways around them. One of those ways works by using sophisticated character recognition software that can read the wonky letters. Another is to feed the letters to "CAPTHCA farms" - the letters are fed to human users, employed by the hackers to read and enter CAPTCHAS, and they are often paid by the number of CAPTCHAs they enter (for example 1 cent per entry). This becomes viable financially if the spam is part of a bigger scam. The scale of the deception means it makes more money, especially because people are much more likely to trust spam messages sent by their friends. This achieves greater returns for the hackers and means they can attack many accounts, bypassing email security systems.
- Sometimes the scripts do their work over days, and sometimes weeks, to escape being caught by Hotmail's attack detection systems.
There are of course other ways for hackers to achieve this kind of attack, such as spyware on your computer, or you being deceived by a rogue website. My instructions below would help you tackle these as well.
WHAT SHOULD I DO IF MY HOTMAIL ACCOUNT GOT HACKED?
Go through the following steps, one by one:
1. Before you do anything else, change your Hotmail account password to something very safe. Not a dictionary word or name, or even a word and numbers. Use symbols such as $ and & in your password, and make it long. I know it is difficult to remember, but if you don't want to be hacked, you'll have to start using strong passwords.
2. Now check that your autoresponse and email signature on Hotmail do not have any spam text added to them, as this would go out to your contacts automatically.
3. Then check that your computer does not have spyware or viruses, by following the instructions here.
4. From now on keep your passwords safe, and be extra careful when using public computers (such as those in Internet cafes). If in doubt - change your passwords.
5. You may want to alert Hotmail support to the problem. It seems to be happening all over the place, and the more they know about it, the better it is for their efforts to address it.
And please note: if for some strange foolish reason you decide to go to the site advertised by the spammers, and you are even more foolish and decide to buy something on it, don’t be surprised if it never arrives. This is a well known scam, and you will never get your goods, you muppet.
Imitating a costomer to promote your business will be a criminal offence from Monday, 26 May 08 (as may be affiliate marketing)
The new regulations that come in to force on Monday (The Consumer Protection from Unfair Trading Regulations 2008) have far reaching implications.
Some test cases will follow no doubt, but one clear implication is for the pretty widespread practice of a company or its staff writing up a good review for the company's own product on a reviews site - while pretending to be real customers (e.g. on Amazon or Trip Advisor).
We know customers are cynical when they read lots of positive reviews for a product, all using the same grammar and language. We know books on Amazon that seem to include fake reviews from their own authors, in order to push sales up. Users are also increasingly sceptical about hotel reviews if they gush too much or have a slight negative that usually turns out to be a positive, supposedly to make you trust them ('the only negative thing about this hotel is that perhaps its staff is too attentive, and you end up worrying that they love it so much they never go home').
PR companies using blogs to build up a 'buzz' for a product will also need to study the new regulations carefully, as will bloggers in their employ (also known as 'floggers').
Another implication, suggested by Mike Young in his blog, is that affiliate marketing emails where the affiliate praises the product in the hope of gaining a commission will also fall under the same legislation.
Of course there will need to be some high profile examples to really deter companies and individuals and bring the message home. It also remains to be seen how co-operative review sites will be with investigations that seek to establish the truth of an allegation. Without their logs of server activity (user details, IP address and timestamp etc.), it would often be difficult to nail an offender, and simply suspecting someone is reviewing their own product is not just cause to seize information. I suppose this means that if Mike Young is correct about affiliate marketing, that's where the first scythe will fall - low hanging fruit for the authorities.
The regulations also introduce quite a number of other protections, some of which are covered here.