Hacking E-mails

[mammoharram]

Hi all,

I just received an e-mail from one of my friends which contain a link for a website, the website is for selling some products with cheep prices,

And I was talking to this friend telling him about the e-mail he had send. He said "It's a fake one I didn't send any e-mails such that", He also received this e-mail from his own account because his e-mail is already added to his contacts.

I mean that someone hacked his e-mail account and sent this e-mail to all of his contacts,

Now I'd like to know:

1- How this one can hack an e-mail? How he can know the password or crack the account?

2- And How to protect my self from such hack?

[Tripredacus]

Your topic title is misleading really. I originally thought you were up to no good...

Anyways, I am going to guess that your friend uses an email client and its (another "wild" guess) Outlook or Outlook Express. There are many trojans (part of Botnets mostly nowadays) that can access these email programs and send emails from them. I suppose it is possible with other clients like Thunderbird (from Mozilla) but Outlook is definately *known* for these type things.

Now if your friend uses web-based email like Gmail or Yahoo or Live/Hotmail, this is definately a question for that service provider.

An unfortunate "option" you can actually do in Outlook (and Thunderbird) is to specify the account you are sending from. So for example, I could send an email from Outlook but it would appear to come from somewhere else. And this can be used further if you specify another SMTP server, but this is a major reason why most ISPs do not allow relaying emails. Anyways, full email headers usually reveal this type of scam.

EDIT: I wanted to add that some people will research email addresses that are posted online and fake those by changing the "Sent From" name in their email programs. I had similar things happen to me when I had used email accounts on my own website, I would get spam emails from my own contact address. It was pretty weird.

[iamtheky]

Another scenario is:

If you use webmail, and then use that same username and password to sign up for other less secure or compromised internet services. Many a dirty script will run a database of credentials attempting to gain access to common email, social, and banking services.

Edited August 1, 2010 by iamtheky

[mammoharram]

TO Tripredacus: hahahahahah sorry for the title. But it's for attracting people to see what is this

Yes it's a web-based email, it's not an outlook or something like it.

thanks a lot for the information you gave to me

To iamtheky: May be it's a real reason .... but this means that it's Random. you mean that Hackers find the victim randomly not looking for specific email. Thank you too

Friends: I searched a lot in the internet and I found many ways to hack an email ... most of them are fake like "you have to send an email to the yahoo server for example and the email body containing victim email, your email and your password. actually i don't know is it fake or not but this is what I think. another ways is by using some programs to monitor the victim PC but you need to be on the victim real PC .... so my mind stopped working while thinking how they can do this stuff remotely.

I have another question ... what is Ethical Hacker?

thanks in advance

[iamtheky]

http://www.eccouncil.org/certification/certified_ethical_hacker.aspx

[mammoharram]

Great website

Thanks a lot

Edited August 3, 2010 by mammoharram