Spam from compromised Hotmail accounts
We keep getting ongoing reports from readers about spam being sent from legitimate Hotmail accounts. Like web mail systems in general, Hotmail accounts are targeted to be able to send spam from "trusted" sources. if an e-mail is received from a friend or relative, you are much more likely to open and read it.
These accounts are compromised via many ways, most commonly these days via phishing. The question always is if it is actually a compromised account, or just someone spoofing the "From" address.
Hotmail adds some characteristic headers that can be used to identify the source as hotmail. While they may be faked of course, the allow you to narrow down the chances of the account being compromised.
You should see a "Received" header from a hotmail.com host, using Microsoft SMTSVC. If the e-mail was posted via the web interface, you should also see an "X-Oritinating-IP" header, with the IP address of the sender. Here are some sample headers from an e-mail I sent to myself via hotmail, using the web interface:
Received: from snt0-omc2-s38.snt0.hotmail.com (snt0-omc2-s38.snt0.hotmail.com [65.55.90.113])
Received: from SNT112-W36 ([65.55.90.72]) by snt0-omc2-s38.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
X-Originating-IP: [??.91.145.??]
I obfuscated the X-Originating header.
Next question we get: What to do if you find out your friends hotmail account was compromised? If your friend is "lucky", all that happened was a phishing attack. Your friend only needs to change the password (and of course, all sites he uses the same password with). Worse case: Your friend is infected with malware that stole the password. Point the friend to some decent anti-malware detection, or if you are a real good friend, help with the cleanup.
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Application Security: Securing Web Apps, APIs, and Microservices | Washington | Dec 13th - Dec 18th 2024 |
Comments
cudamail
Jun 8th 2011
1 decade ago
Michael
Jun 8th 2011
1 decade ago
JJ
Jun 8th 2011
1 decade ago
I can say all my systems had been powered off since 6-6-2011 towards the end of the day except my router and appletv(<-evil). Looking at the timestamps of the emails sent from my account it was at 436p EST today 6-8-2011. They left some of if not all the emails they sent in the sent folder in the web interface (I never use the web interface for this account).
So im still a bit weary of how/where they got the credentials, if i have a system compromise (there's allot more accounts i have then just this hotmail account that appear untouched), or they were somewhere to observe it, or they actually had some form of access to hotmail in general, and then did many things through different accounts. Or they got it from some forum from years ago that i don't even remember logging into with that account.
My hotmail account was one that sent emails with links to what the name observed as a .php file. I never use the web interface for the mail, so i thought it was odd i sent all these emails to all my listed contacts (only the ones in the web mail contacts list) not my mail client. In the process now of downloading the emails to look at the full headers n such.
Pwnied
Jun 9th 2011
1 decade ago
X-Originating-IP: [190.178.126.85]
X-Originating-IP: [87.2.78.204]
X-Originating-IP: [87.2.78.204]
X-Originating-IP: [x.x.x.x] Me alerting everyone don't click
X-Originating-IP: [190.178.126.85]
X-Originating-IP: [190.178.126.85]
X-Originating-IP: [190.178.126.85]
X-Originating-IP: [190.178.126.85]
X-Originating-IP: [87.2.78.204]
X-Originating-IP: [87.2.78.204]
only change in all the headers i see is the X-UIDL: changing and X-Originating-IP: and the to lines. content of emails varys but just weblinks mostly.
[190.178.126.85] - Allocated to LACNIC though i dont find it in their page, just ARIN referencing its theirs.
[87.2.78.204]-
inetnum: 87.0.0.0 - 87.15.255.255
netname: TELECOM-ADSL-7
descr: Telecom Italia S.p.A. TIN EASY LITE
country: IT
admin-c: BS104-RIPE
tech-c: BS104-RIPE
status: ASSIGNED PA
mnt-by: tiws-mnt
mnt-lower: tiws-mnt
mnt-routes: tiws-mnt
source: RIPE # Filtered
person: BBBEASYIP STAFF
address: MDBLAB
address: Via Val Cannuta, 250
address: I-00100 Roma
address: Italy
phone: +39 06 36881
nic-hdl: BS104-RIPE
source: RIPE # Filtered
Pwnied
Jun 9th 2011
1 decade ago