 | By Fred Langa Ever wonder if someone’s mining your ISP’s mail server for addresses? Here’s one way to test for malfeasance at your mail server — and I’ll show you several other ways to keep your e-mail address out of the wrong hands. |
No good deed goes unpunished
You’ve heard the saying, “No good deed goes unpunished.” That’s the situation reader Fred Stone found himself in when he started to get phishing e-mails after helping set up a friend’s PC:
- “While helping a friend get active with his new ISP and get Thunderbird configured, I created an e-mail address for testing in his account. This address has been used to send or receive maybe 12 messages. Today, I received a phishing message. Since this address should be unknown and has only been sent to about 5 of my various e-mail addresses, the question is how does this get in the hands of phishers? Are folks sitting there monitoring all the Net traffic, culling addresses?”
Because you’re a Windows Secrets reader, your own system is probably well protected against spyware and other malicious software. But your friend’s PC may not be.
Although e-mail harvesting via malware is less common than it once was, it can still plague unprotected PCs, especially the systems of less sophisticated users. Once address-harvesting malware gets onto a system, it can quietly monitor the e-mail addresses in an address book and in the In and Out boxes, periodically sending the gathered addresses to a phisher or cracker. Similarly, any of several kinds of keystroke-capture malware could also be collecting data off your friend’s PC and periodically phoning home to the malware’s creator.
You no doubt already know of the many excellent tools (both free and paid) that can protect a PC from spyware and similar nasties. But you might want to help your friend check to make sure his PC is clean, and help him install protective software to prevent any future infections. For specific product recommendations, see the WSN Security Baseline.
You said the suspect e-mail account was used only to send a few test messages, so this following item may not apply. But, for completeness, I should also mention that a very common means of address harvesting has nothing to do with e-mail per se. It’s the disclosure of your e-mail address on chat rooms, message boards, auction sites, or other Web pages; or by placing an order online with a less-than-scrupulous business.
Related posts:
