Xtra Checks - Vacation Response Spam

Forums › Spark New Zealand › Xtra Checks - Vacation Response Spam

nunz

1241 posts

Uber Geek
+1 received by user: 253

Subscriber

Topic # 114649 26-Feb-2013 15:50

Hi all,

Had a client pop in today as they are getting messages bouncing back from people they hadn't sent emails
to.

To cut a long story short ...

Some of the hacked xtra accounts possibly had spam vacation responses set up in them. The person breaking in will set the xtra users vacation resposnse to run until sometime a few years from now and get it to send a spam message to everyone who emails the xtra user.

Worth checking if you are dealing with TCom / Xtra email users. In fact its worth checking if you deal with any web based email service who has been compromised.

For Xtra -

Log into the users account
Goto options
email options
Vacation Response.

Follow your nose. Its also worth checking to see if a malicious alias, temporary disposable internet address or similar has been created .

HTH

Shane

nunz

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 469
Inactive user

Reply # 770571 26-Feb-2013 15:53

If you go to the main Telecom home page you see the first link which informs customers to change their passwords takes you here:

http://telecom.custhelp.com/app/answers/detail/a_id/26203?pid=int452

And yes it does detail the steps to check to make sure you don't have a vacation setting turned on.

nunz

1241 posts

Uber Geek
+1 received by user: 253

Subscriber

Reply # 770672 26-Feb-2013 18:40

plambrechtsen: If you go to the main Telecom home page you see the first link which informs customers to change their passwords takes you here:

http://telecom.custhelp.com/app/answers/detail/a_id/26203?pid=int452

And yes it does detail the steps to check to make sure you don't have a vacation setting turned on.

Four things:

1 - Many clients dont use web mail so dont look at the web mail section, instead they follow the directions given and never go to the section that says confirm your web mail settings are complete.

2 - The banner on the main TCom page doesnt work unless you manage to see it as your first hit the page. It auto changes to advertising - making it difficult for people to find. We also hae taught our clients not to click on advertising - it leads to all sorts of trouble so they probably wouldnt click on a web adertising banner. it is a backwards security step for tcom to do it this way.

3 - Going through the steps given for a lot of our users ended them up with all sorts of crap about setting up profiles and putting photos up etc. Clicking on the go away link just stopped everything from working.

4 - In your advertising and advice it says change your password - most of our clients having done so never went any further as they had done what TCom told them to do. The advertising should have been more specific about what was needed to fix all the issues.

So no offence intended, why dump on someone who is helping you do what we should never have had to do in the first place?

nunz