Frontier email account hacked

[lan101]

So I have a client with a small business that's had a frontier email account (yahoo) for years.

Sometimes randomly it'll just send out spam. It appears that someone else potentially has access to it. For example yesterday it send out an email to a bunch of people and said something along the lines of "Hey there I have a favor to ask of you please reply."

So it appeared that this sent from my clients email address. If you hit reply to that email it goes to a "different email" but looks similar to my clients of course.

Can anything be done about this? They've already changed the password to something super strong 2 different times. I didn't know if anything else can be done to potentially stop it from here on out?

Thank you.

 

[glennd]

So I have a client with a small business that's had a frontier email account (yahoo) for years.

Sometimes randomly it'll just send out spam. It appears that someone else potentially has access to it. For example yesterday it send out an email to a bunch of people and said something along the lines of "Hey there I have a favor to ask of you please reply."

So it appeared that this sent from my clients email address. If you hit reply to that email it goes to a "different email" but looks similar to my clients of course.

Can anything be done about this? They've already changed the password to something super strong 2 different times. I didn't know if anything else can be done to potentially stop it from here on out?

Thank you.

perhaps the problem lies in the customer's computer

 

[seashore]

Could equally just be a spoofed sender address, which happens to just about everyone at some point.

 

[YeOldeStonecat]

Yahpoop is well known for having their mail servers hacked into...multiple times.

Best thing your client can do is stop using them, many better email services out there. Oh..and this is for a business? x10!!!

 

[HCHTech]

They've already changed the password to something super strong 2 different times.

Did you check for forwarding rules? Did you also change the security questions? Any chance 2FA is available?

 

[lan101]

Yahpoop is well known for having their mail servers hacked into...multiple times.

Best thing your client can do is stop using them, many better email services out there. Oh..and this is for a business? x10!!!

Agree 100% lol. I've mentioned that...they are "slowly" migrating to a gmail which I guess is better than yahoo.

 

[lan101]

Did you check for forwarding rules? Did you also change the security questions? Any chance 2FA is available?

A while back in the webmail settings I looked at the "filters" etc. and nothing was in there. I'll have to check there again to be sure on the forwarding. Thanks.

 

[britechguy]

So it appeared that this sent from my clients email address. If you hit reply to that email it goes to a "different email" but looks similar to my clients of course.

Is this not classic spoofing? An account need not be hacked to do this.

 

[Sky-Knight]

Email has two different fields. Reply To, and Mail From.

The email client fills these in itself. Mail From can be from anywhere, and should be pretty obvious spam unless the domain lacks SPF, DKIM, and DMARC.

But even if the above all works, reply to can be anything else. So if the mail is being sent from the actual mailbox, reply to could very well be used to in effect bypass spam filters.

Since Yahoo has all of the above records, I'm left to assume a Yahoo account is being used to send this junk mail... and mind you it could be ANY Yahoo account... not just your client's...

All you can do is advise your client to change their password, enable MFA, and transition to a more professional service.

 

[YeOldeStonecat]

Yes...strongly encourage them to move away from this, and to a more professional solution.

As noted before, and you can Google this, Yahoos servers have a long history of breaches from the top end. Changing passwords doesn't matter much...they servers get hacked from above the individual mailbox level.

Also residential grade email systems like Yahoo...run IMAP. And..IMAP basically gets exploited directly regardless of having MFA enabled. I'll reword that....MFA doesn't do a thing to secure any account with IMAP. This is one of the reasons one of our standard scripts to run on our 365 clients is...disable IMAP (which is now a default thing for 365 thankfully)

Yeah, Yahoos mail servers....not only is the back door ajar, the front door is just a flimsy screen door that doesn't latch shut...just blows half open in the wind..and all the ground level windows are wide open too!

 

[nlinecomputers]

Sometimes randomly it'll just send out spam. It appears that someone else potentially has access to it. For example yesterday it send out an email to a bunch of people and said something along the lines of "Hey there I have a favor to ask of you please reply."

No one has access to the account. As @YeOldeStonecat pointed out Yahoo! Email servers have bee repeatedly hacked and address books stolen. So hackers have lists of known good emails and use them as the basis of phishing attempts, using spoofed emails. Check the headers, you’ll see the client is NOT really sending them. You can’t do anything to put the genie back in the bottle. Your client needs to get a real email service like Office 365 and a domain name of their own that will allow you to setup proper SPF,DKIM, and DMARC records. All of that allows you to validate the email sent and helps prevent fakes from being sent.

 

[Markverhyden]

Statistically speaking it's probably spoofed email addresses. The easy way is to parse the headers at the website below. But the problem is getting an email with headers. The customer has to save the email and then send it as an attachment. Just forwarding it strips aways the original headers.

Email Header Analyzer, RFC822 Parser - MxToolbox

mxtoolbox.com

 

[britechguy]

Statistically speaking it's probably spoofed email addresses.

Yup. I can't think of a single instance where I've gotten an email message that appears to be from someone I know, but that's clearly "not of their style," that wasn't a spoof.

It's far more statistically likely than your account actually being hacked and used by someone else to send stuff. I've spent years educating clients that email that appears to have originated from them is least likely to have been the result of an actual account compromise and most likely to be yet another instance of spoofing. Keep calm, do some basic checks, and carry on.