Another round of Xtra\Yahoo spam?

Forums › Spark New Zealand › Another round of Xtra\Yahoo spam?

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11

47 posts

Geek
+1 received by user: 4

Reply # 965664 12-Jan-2014 19:41

One person supports this post

This time around today. Is the most that I have received at any time in all of the recent issues.

For me my little peeve, and only being effect by 10 odd obvious spam, which means nothing to me.

It's the way Telecom publicly deals with it. I know there has to be the corporate responsibility about keeping confidence in the service. Playing down the severity of it. But there is a fine line between disclosure and just putting out a load of rubbish our to your customer base and not really informing them, which is not taking real responsibility for the issue.

Like reporting the Symptom of the issue which IMHO does not really inspire people in any way to take action.

http://help.telecom.co.nz/app/answers/detail/a_id/26203#h_tab_4

"Alert: Due to a recent increase in spam and phishing emails remember do not click any links in suspicious emails."

I'd like to see the Truth on the page.

"Alert: Due to the Telecom Yahoo system being compromised by Hackers, Please Urgently change your email address"

I am getting lists of my customers email contacts in CCs, which is proprietary information for many of them, which I am sure competitors would love to get there hands on.

Advise

"please immediately mark it as spam and/or junk." how does this help me after the fact, in my case to blacklist my business contacts for future business dealings. ?

"We are aware that some people have received suspicious looking emails from Yahoo! Xtra accounts"
LOL I am sure that Telecom is "Aware" of a lot more than that.

The Front page Headline Reads

Reset Your Xtra Yahoo Password.

A/ If I was an uneducated Xtra user would that inspire me to take any action? Or even suggest there was a issue?
B/ Does it effect me ? Is there any thing wrong? It Just looks like another random headline. What are the issues.
C/ "If your email account has been recently affected by email issues"

Talk about over talking it down, that is really all I am saying. I appreciate Telecom has almost zero to do with this problem they have been lumped with. But if I was a client I would want to know, with a little more Clarity as to what was going on, rather trying to read between the lines of "corporate speak" then have to go off searching the web and looking for Forums like this for the extent of the issue.

michaelmurfy

6549 posts

Uber Geek
+1 received by user: 2961

Moderator

Trusted

Subscriber

Reply # 965670 12-Jan-2014 19:49

One person supports this post

Allanhall:
I am getting lists of my customers email contacts in CCs, which is proprietary information for many of them, which I am sure competitors would love to get there hands on.

If by that sentence you mean you're also using ISP email for your business you had this coming to you. A domain name + Office 365 is a cheap investment for a business.

Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router Guide | Electric Kiwi | Community UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial

Shock

534 posts

Ultimate Geek
+1 received by user: 30

Trusted

Reply # 965720 12-Jan-2014 21:05

Parents are getting hammered by spam from friends & contacts who have been comprimised. Luckily they have not themselves had the issue impact their account.

Telecom any indication of what is being done to sure up the security of your email system or is this another case of "Not us but Yahoo"? I understand in the comments from Peter & Co this is complicated but from the end customer perspective this has happened multiple times and so far resolution each time has proven ineffective.

Connecting to UFB? Go with Bigpipe and use this link for free credit!

Oblivian

2019 posts

Uber Geek
+1 received by user: 168

Reply # 965730 12-Jan-2014 21:35

One person supports this post

I suspect the current hit will be hard to stop short of looking at the from field and stopping all @xtra.co.nz

The mails appear they are originating offshore on presumably thousands of compromised servers (or open relays) and masquerading themselves as being from xtra accounts. All the while using the known sender/contact addresses stolen in what appears to be the previous hacks/sweeps

Certainly no note in the news I've seen saying theres been another breach, other than the NZ related news and earlier about the advert malware injections. Seems to be more abusive use of the data harvested previously

mattwnz

13114 posts

Uber Geek
+1 received by user: 1535

Reply # 965739 12-Jan-2014 21:46

michaelmurfy:
Allanhall:
I am getting lists of my customers email contacts in CCs, which is proprietary information for many of them, which I am sure competitors would love to get there hands on.

If by that sentence you mean you're also using ISP email for your business you had this coming to you. A domain name + Office 365 is a cheap investment for a business.

No, I think they are referring to the emails that are being received from xtra address have all the email addresses in the CC field. So they are referring to other people who use and xtra email address for business use. Not sure how about privacy, as I am sure may of those people in the address book would be happy that their address is being disclosed, and that they have dealt with that business in the past. Some of those arrangements may have been confidential.

Allanhall

47 posts

Geek
+1 received by user: 4

Reply # 965754 12-Jan-2014 22:03

michaelmurfy:
Allanhall:
I am getting lists of my customers email contacts in CCs, which is proprietary information for many of them, which I am sure competitors would love to get there hands on.

If by that sentence you mean you're also using ISP email for your business you had this coming to you. A domain name + Office 365 is a cheap investment for a business.

Certainly Not talking about me I would never tie into an ISP. EVER with an email. I run 20 different pop accounts and I do wonder why people would promote Xtras business in their business email. I am talking about my clients that have been hit by them. I am not their IT adviser in any capacity.
Still michaelmurfy to say that they "had it coming" is a bit cynical don't you think? They would expect that they would be paying top dollar for a service ( lets face it xtras not the cheapest in the market) that it would involve security of your contacts?

mattwnz yes correct.

Oblivian you could be right there Return paths spoofed . and if So I stand corrected about Xtras response, jumping to conclusions based on past actions.

Content-Type: text/html; charset="UTF-8" Return-Path: <marketing@popup-cards.sg> Content-Transfer-Encoding: quoted-printable Envelope-to: al@earthfirst.co.nz Delivery-date: Sat, 11 Jan 2014 18:36:53 -0500 Content-Disposition: inline Content-Description: HTML text Received: from [192.185.81.115] (port=39175 helo=bluedevil.websitewelcome.com) by cumin.hmdnsgroup.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.82) (envelope-from <marketing@popup-cards.sg>) id 1W286g-0006o0-HK for &**@**.co.nz; Sat, 11 Jan 2014 18:36:46 -0500 Received: from [46.172.245.37] (port=51811 helo=mycomputer) by bluedevil.websitewelcome.com with esmtpsa (UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.80) (envelope-from <marketing@popup-cards.sg>) id 1W286w-0006hQ-FZ; Sat, 11 Jan 2014 17:37:02 -0600 From: "

freitasm

BDFL - Memuneh
58754 posts

Uber Geek
+1 received by user: 10149

Administrator

Trusted

Geekzone

Subscriber

Reply # 965854 13-Jan-2014 07:55

One person supports this post

Telecom's decision to stick with Yahoo! as a mail provider after a review in 2013 was wrong and this problem happened three times since that decision.

It's time they start a serious project to protect their customers. At this rate we may soon see more than just spam being sent out but successful phishing attempts leading to loses from both sides.

Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) | Backblaze cloud backup (personal and business) | My technology disclosure

Yyrael

222 posts

Master Geek
+1 received by user: 45

Trusted

Subscriber

Reply # 966199 13-Jan-2014 14:43

One person supports this post

Shock: Parents are getting hammered by spam from friends & contacts who have been comprimised. Luckily they have not themselves had the issue impact their account.

Telecom any indication of what is being done to sure up the security of your email system or is this another case of "Not us but Yahoo"? I understand in the comments from Peter & Co this is complicated but from the end customer perspective this has happened multiple times and so far resolution each time has proven ineffective.

It's being very seriously looked into in conjunction with Yahoo! but I don't know anything further than that at this time.

Ragnor

8019 posts

Uber Geek
+1 received by user: 384

Trusted

Subscriber

Reply # 966253 13-Jan-2014 15:22

freitasm: Telecom's decision to stick with Yahoo! as a mail provider after a review in 2013 was wrong and this problem happened three times since that decision.

It's time they start a serious project to protect their customers. At this rate we may soon see more than just spam being sent out but successful phishing attempts leading to loses from both sides.

Yep long past due, mistake from the beginning.

Surely whatever they are paying Yahoo to run this could be spent on a small team of engineers to run this in house on their own existing infrastructure. Email is a solved problem there are carrier grade solutions.

1101

1135 posts

Uber Geek
+1 received by user: 231

Reply # 966594 14-Jan-2014 09:22

Ragnor: Email is a solved problem there are carrier grade solutions.

Perhaps its about time that Telecom provided an email solution for its thousands of long term customers where .........
PERSON EMAILS ARE NOT SCANNED BY BOTs FOR THE PURPOSE OF DELIVERING ADVERTISING
and NZ privacy laws are complied with .

Or at least tell Telecom customers that their personal emails are not private , then see the backlash.

But , moving all Xtra's email from yahoo to another service, what a nightmare that would be.

networkn

14496 posts

Uber Geek
+1 received by user: 3601

Trusted

Subscriber

Reply # 966600 14-Jan-2014 09:31

1101:
Ragnor: Email is a solved problem there are carrier grade solutions.

Perhaps its about time that Telecom provided an email solution for its thousands of long term customers where .........
PERSON EMAILS ARE NOT SCANNED BY BOTs FOR THE PURPOSE OF DELIVERING ADVERTISING
and NZ privacy laws are complied with .

Or at least tell Telecom customers that their personal emails are not private , then see the backlash.

But , moving all Xtra's email from yahoo to another service, what a nightmare that would be.

Do you remember what a nightmare it was to get it there in the first place ? :)

/me shudders

TroyRF

20 posts

Geek
+1 received by user: 24

Trusted

Spark NZ

Reply # 966852 14-Jan-2014 14:52

Hi guys,

Below is the statement we'll be issuing to media this afternoon. We know Geekzoners don't need to be told what spoofing is, but information like this is included in the mainstream release for the benefit of those who aren't aware.

We know this continues to be a topic of much discussion here, and that's fair enough. We’re frustrated too. This statement is all Telecom's able to say at this point - thanks for understanding.

UPDATE ON RECENT YAHOO XTRA INCREASE IN SPAM

Telecom and Yahoo can now confirm that an increase in spam activity experienced by some email users over the past few days is the result of email ‘spoofing’.

Spoofing involves the forged use of an email address to send email traffic (such as marketing spam). Spoofing attacks are a daily occurrence worldwide and an unfortunate hazard of email via the internet. There is no technical way for Yahoo or Telecom (or any other ISP) to prevent these spoof emails from being sent, many of which are generated from overseas servers. The actual user’s email account is not used to send “spoof” emails, but it appears as if it is.

The analysis is unable to confirm the scale and source of the issue, but it is possible that unauthorised access of customer address information sourced via attacks in 2013 may have played a role.

The links sent out via the spoofing scam are largely product advertising, which will be phishing for information (eg credit card or personal information). While this is not the case for all spam, indications are that in this case the spoofed emails do not contain ‘Trojans’ or viruses.

We continue to strongly recommend that people who receive suspicious-looking emails containing a link – whether from a known or an unknown contact - do not click on the link and immediately delete the email. All other normal email security precautions should be taken. These precautions are good practice no matter what internet service you use.

Telecom Retail CEO Chris Quin says “I am extremely unhappy that our customers continue to be the victims of cyber criminals, and understand why they are angry and frustrated by the ongoing issues.

“Yahoo! has advised us that this latest email incident is generated outside of the Yahoo! network and infrastructure, and they have limited technical options to halt the email spoofing by cyber criminals.

“We know that unfortunately spam, phishing and spoofing are a global reality for email users. Telecom continues to work with Yahoo! on security enhancements, and we’re also giving our customers information on how to protect themselves online.

“We encourage our customers to visit our online support resources such as Tech in a Sec and Telecom Help online at www.telecom.co.nz"

ENDS

freitasm

BDFL - Memuneh
58754 posts

Uber Geek
+1 received by user: 10149

Administrator

Trusted

Geekzone

Subscriber

Reply # 966859 14-Jan-2014 15:04

Troy, thanks for the update.

So I understand correctly that you (Telecom) are saying that emails are sent with spoofed addresses (possible) using the contact information harvested in the previous attack as recipients (also possible)?

Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) | Backblaze cloud backup (personal and business) | My technology disclosure

TroyRF

20 posts

Geek
+1 received by user: 24

Trusted

Spark NZ

Reply # 966867 14-Jan-2014 15:14

freitasm: Troy, thanks for the update.

So I understand correctly that you (Telecom) are saying that emails are sent with spoofed addresses (possible) using the contact information harvested in the previous attack as recipients (also possible)?

That is possible, Mauricio, however the statement encompasses all we can actually confirm to this point.

Spong

504 posts

Ultimate Geek
+1 received by user: 56

Trusted

Reply # 966869 14-Jan-2014 15:14

I don't feel that the following comment is very accurate:

"The analysis is unable to confirm the scale and source of the issue, but it is possible that unauthorised access of customer address information sourced via attacks in 2013 may have played a role."

ALL of the spam messages I've received have contained contacts in the cc field that could only have been harvested by someone having accessed personal Yahoo address books. Whether this happened in 2013 or just now is the question. It shouldn't have happened in the first place, and if Yahoo's security was up to scratch, I suspect it wouldn't have.

If it's happened recently, then it's a real worry that the problem remains still and could happen again. All these contact addresses have probably been sold to spammers so anyone having received these spam messages can expect a big increase of spam through no fault of their own. Thanks Yahoo :-(

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11