Monday, February 20, 2012

How do you know that your system has been compromised?

How will you know if the email your friends got from you was spoofed?

Mail is being sent from somewhere else with your address being forged onto its "From:" line

-Full name:
Look at the "From:" on the junk mail your friends received. If your e-mail system normally sends your mail showing your full name followed by your e-mail address in on its "From:" line, a spammer spoofing just your address wouldn't know your name and could not do this.

Your address book used:
-If many of your personal correspondents are simultaneously getting the same junk mail from your address, that's a pretty sure indicator that it's coming from your account, because the sender has access to your personal address book.
-Someone otherwise forging your address onto their "To:" line would not be able to target all of your friends at once, and would be very unlikely to hit any of them at all.

Launching Server
-Look at the full headers (usually hidden) on one of the junk messages as received. Among the headers are a bunch of postmarks, lines beginning "Received:". The oldest one (farthest down the list) explains how the message was first launched into the e-mail network; subsequent ones (farther up toward the top) track its travel to you. If the early ones name a server on your e-mail provider (Yahoo, Hotmail, Google, or whatever) that tends to suggest that your account was hacked.

-done by Eagle

No comments:

Post a Comment