Widespread Email Compromise at Yahoo/Xtra

Forums › Spark New Zealand (including Skinny and BigPipe) › Widespread Email Compromise at Yahoo/Xtra

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 13

19282 posts

Uber Geek
+1 received by user: 2526
Inactive user

#759089 10-Feb-2013 18:04

I got a email to my Gmail just after 2:45PM from my flatmate and they were sitting in the lounge talking to me at the time, There PC was off

mattwnz

20520 posts

Uber Geek
+1 received by user: 4798

#759094 10-Feb-2013 18:12

Strange that it is only xtra / yahoo people sending out spam and malware emails. I suspect a lot of people have clicked on the links in the email too, as it is from people they know.

freitasm

BDFL - Memuneh
80671 posts

Uber Geek
+1 received by user: 41121

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#759098 10-Feb-2013 18:14

johnr: I got a email to my Gmail just after 2:45PM from my flatmate and they were sitting in the lounge talking to me at the time, There PC was off

So, "Kristina" posted a similar comment on the NBR - is that because you flat with her?

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

freitasm

BDFL - Memuneh
80671 posts

Uber Geek
+1 received by user: 41121

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#759105 10-Feb-2013 18:25

mattwnz: Strange that it is only xtra / yahoo people sending out spam and malware emails

Nothing strange. Read previous post - a XSS vulnerability existed and someone exploited that. Apparently visiting a certain blog in a Yahoo! online property while logged in would lead to these folks collecting credentials that could then be used to access webmail and send messages.

They just automated that and things spread like this in no time.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Shock

534 posts

Ultimate Geek
+1 received by user: 31

Trusted

#759106 10-Feb-2013 18:29

What a debacle this has turned into then ! Nothing quite like dealing with panicked parents who are getting a constant stream of spam emails from trusted people thinking they all have viruses etc. Joy!

It is about time Telecom pulled the plug on this whole Yahoo setup.

Connecting to UFB? Go with Bigpipe and use this link for free credit!

networkn

Networkn
32876 posts

Uber Geek
+1 received by user: 15478

ID Verified

Trusted

Lifetime subscriber

#759108 10-Feb-2013 18:32

Shock: What a debacle this has turned into then ! Nothing quite like dealing with panicked parents who are getting a constant stream of spam emails from trusted people thinking they all have viruses etc. Joy!

It is about time Telecom pulled the plug on this whole Yahoo setup.

This!

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

ORaven

4 posts

Wannabe Geek

#759186 10-Feb-2013 20:48

I changed my password yesterday, but am still getting Daemon mail failures, but investigation says that still receiving them is to do with the destination mail servers.
eg. I received about 5 this afternoon, all roughly 24 hours after my ones yesterday, and the responses each being "Mail server for "xxx" unreachable for too long".
It seems nothing new has been sent out, but just delayed failure of deliveries as each was still 'sent' at the same time as yesterday's.

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#759195 10-Feb-2013 21:10

If anyone is getting any more recent spam messages (i'm looking at you JohnR

) not necessarily the bounce back messages which may just be a hangover from mail systems re-trying.

I would be very interested to get copies of the emails and they MUST include the full headers of the emails.

If you're not sure what I am talking about Full Headers then that's ok others have forwarded the spam emails to our team mailbox, but if you do know what I am talking about then please include the full headers from the email and send us an email ort @ telecom.co.nz

It's still being actively investigated, and it seems from the threads I have seen that some mail servers are still affected.

johnr

19282 posts

Uber Geek
+1 received by user: 2526
Inactive user

#759207 10-Feb-2013 21:19

freitasm:
johnr: I got a email to my Gmail just after 2:45PM from my flatmate and they were sitting in the lounge talking to me at the time, There PC was off

So, "Kristina" posted a similar comment on the NBR - is that because you flat with her?

Nope her name is Pauline

networkn

Networkn
32876 posts

Uber Geek
+1 received by user: 15478

ID Verified

Trusted

Lifetime subscriber

#759234 10-Feb-2013 22:50

I'm still having these issues. I got 5 in the last few hours. I'll forward a couple on.

igorportugal

82 posts

Master Geek
+1 received by user: 3

Trusted

#759237 10-Feb-2013 22:57

Is that what it is... keep getting spam from my friends.

Should I be worried about my yahoo account being compromised?

I only connect to yahoo via a proper email IMAP client, rather than on line, so if the compromise assumes you are logged in, I should be ok, but how do I tell for sure?

CTO
Vadacom Limited

HP

Shop now for HP laptops and other devices (affiliate link).

quickymart

14950 posts

Uber Geek
+1 received by user: 13978

ID Verified

#759270 11-Feb-2013 05:40

http://www.nzherald.co.nz/technology/news/article.cfm?c_id=5&objectid=10864612

sleemanj

1515 posts

Uber Geek
+1 received by user: 317

#759272 11-Feb-2013 05:56

Just got woken up with one to my critical support "get the heck up, server probably on fire" type address. Gee Thanks Telecom.

Two others at the same time to another address.

Received: from nm1.tnz.bullet.mail.aue.yahoo.com ([124.108.96.28]:46711)
by omicron.elinuxservers.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.77)
(envelope-from )
id 1U4Zkf-0004p6-AV
for ******t@gogo.co.nz; Sun, 10 Feb 2013 08:27:49 -0800
Received: from [124.108.96.26] by nm1.tnz.bullet.mail.aue.yahoo.com with NNFMP; 10 Feb 2013 16:26:57 -0000
Received: from [124.108.96.24] by tm1.tnz.bullet.mail.aue.yahoo.com with NNFMP; 10 Feb 2013 16:26:51 -0000
Received: from [127.0.0.1] by omp1001.tnz.mail.aue.yahoo.com with NNFMP; 10 Feb 2013 16:26:50 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 979150.30048.bm@omp1001.tnz.mail.aue.yahoo.com
Received: (qmail 47564 invoked by uid 1000); 10 Feb 2013 16:26:50 -0000
Received: from 124.108.96.89 by rel108.mail.aue.yahoo.com with SMTP; Sun, 10 Feb 2013 08:26:50 -0800
Received: (qmail 1443 invoked by uid 60001); 10 Feb 2013 16:26:50 -0000\
Received: from [109.61.123.140] by web96006.mail.aue.yahoo.com via HTTP; Mon, 11 Feb 2013 05:26:50 NZDT

---
James Sleeman
I sell lots of stuff for electronic enthusiasts...

Lias

5655 posts

Uber Geek
+1 received by user: 3978

ID Verified

Trusted

Lifetime subscriber

#759315 11-Feb-2013 09:11

Interestingly enough, I haven't been a Telecom customer during the "yahoo/Xtra" years, nor used my yahoo account in forever (or at all really.. I used it on the day I created it for one particular purpose and it's not been used since), and mine was compromised.

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup. Opinions are my own and not the views of my employer.

MackinNZ

450 posts

Ultimate Geek
+1 received by user: 119

Lifetime subscriber

#759322 11-Feb-2013 09:22

I've had a number of customers call me this morning having received spam e-mail from Xtra addresses. The time-stamp on the spam messages is as recent as 8:00 am today.

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 13