Topic: Apologies to anyone.....

[BarriedaleNick]

Well we work in different industires and email password phishing is pretty rare generally speaking in my experience.  Hacking and virus compromise is much more likely than a phishing attack just to get an email password.  Yes of course it happens but a quick check through my spam logs shows that most of it comes from accounts that don't even exist. 

"If you're sensible with what you do online and who gets your e-mail address, spoofing is unlikely" - this is wrong.  Spoofers do use lists of know email addresses but randon dictionary based attacks on domains are far more common.  Once again if i check my logs I see tons of mail directed at non existant accounts.

I haven't seen a hotmail or google mail phishing email in years and I look at a lot of spam.  We see phisihing for banks, tax and all manor of things but I can't recall the last mail that asked for your email password.  Phishing for email addresses is just not that profitable.

The problem is that a lot of people change their mail password after incidents like and then it stops, but this proves nothing - it's merely reasoning after the fact.  What I tend to see is a mad rash of spam over the course of a few days and then it dies off.  Sometimes it repeats often it doesn't.

Changing your password is a good idea of course as it can do no harm but it doesn't prove that your password has been phished..

"You see the results all the time - friends sending you messages on Facebook or via e-mail that are obviously spam."  That still doesn't mean it was phished - it could just mean that account was compromised in some other way - keylogger, hack, malware and they got you address book.  Even pure guesswork of your secure questions can compromise your account and address book (or even if you are in someone else's addresses book and they are compromised)

Have a look here http://www.pcmag.com/article2/0,2817,2394195,00.asp from OCt 2011

While it does say that compromised accounts (though not specifically phished accounts) are responsible for an increasing amount of spam...

"In other words, the vast majority, or 96.8 percent, of all spam sent from Gmail during the third quarter used a spoofed email address."

[retro]

Ah.  I think you're thinking of it more from a business point of view.  Yes, if you have a domain-based e-mail, you will find that a standard (e.g. info@) account could well be a target.  However, it's still unlikely that you'll be randomly targeted - spoofers prefer to use some means of verified list.  Sure, e-mail addresses get put in all kinds of places and they can target something as simple as a web directory (yell.com perhaps) and there's not much you can do.  Still, obfuscating your address on your site can help.

If the "real" world, the majority of users nowadays use online e-mail accounts, and those that don't use the ones that come from their ISP.  Sure, random words can work with Hotmail and the like, but don't choose an obvious user name is the answer there! 

Obviously I won't for data protection reasons, but I could have taken hundreds of screenshots of compromised accounts in Hotmail, Yahoo, Gmail and AOL domains.  I have had a LOT of customers phone me up and report this screen when they log into Hotmail:



http://windows.microsoft.com/en-US/hotmail/account-temporarily-blocked-faq

It's because their account has been sending out spam, because it has been compromised. 

Trust me, in the public world, e-mail phishing and Facebook phishing is rife.  If you have a Facebook account, how many times have you seen people posting a link to a video with a tag line like - YOU WON'T BELIEVE THIS!?  Or something about some celebrity being naked or some such rubbish.  It's because they clicked on the link, and it has either given someone their account credentials, or installed an app to post from within their account.  Granted, businesses are more likely to see spoofing than phishing - but that's because they (hopefully) don't use their accounts for anything non-business related and wouldn't click on such links even if they come through (ha - yeah right, I know!)

Does it seem worthwhile taking the time to write an app to do this?  Of course not.  And yet they're out there.

[BarriedaleNick]

Compromised doesn't mean it was phished - What you have described above about Fcebook et al is not phishing.  Phisihng is merely coning a user into giving up a password and does not include hacking, malware, drive bys, keyloggers, guessing etc...

If you have some stats that point to the majority of spam coming from phished accounts then post it as I would be genuinely interested but every single thing I have read points very decisively to spoofing rather then phishing being the main sourse of spam and have seen nothing to suggest otherwise.

Other than that I'll leave this thread alone as we seem to have hijakced it a little!

[Ninnyscrops.]

Not hijacked at all! Lots of learning curves for all that perhaps read, and thank you, for your input.

I'm sure lots of us older folk have found something out to help us along our way.

Ninny

[retro]

BarriedaleNick - agreed that the apps aren't phishing per se in that they aren't creating a fake replica of a login page, but they similarly disguise themselves as something they're not to gain access to your account in some way (hence I left it at the end, but probably not separate enough to show my intention there)!  There is ALSO phishing on Facebook, sadly.  And yes, hijacking it a bit - sorry!

As for the stats, I'd be interested, too, so I'll see what I can dig up.  I can certainly give you figures of how many computers come in for repair with phished accounts vs. spoofed accounts.  Perhaps I should ask customers for permission to use a screenshot as evidence, too.  Maybe I'll start a new thread with some data soon! ;)

Ninnyscroops - hope you've sorted it out and are now the only one e-mailing from your account! :)

[Ninnyscrops.]

Yes, thankfully retro!

Ninny