Picture this scenario. A friend asks you why you sent her a badly-spelled e-mail inviting her to buy medicines in Canada, or why you sent an attachment that her antivirus detected as a threat. You know you didn't send any such thing. How did it happen? Did a hacker invade your e-mail account? What should you do to protect yourself?
In the past month several friends and colleagues have come to me worrying that their accounts may have been hacked. Apparently this sort of problem is on the rise. The good news is that these symptoms don't necessarily mean your account was hacked. The bad news is that recovering from an actual hack can be tough.
Somebody Else Got Hacked
Strangely enough, the actual source of the problem might have almost nothing to do with you. A successful virus attack on one of your correspondents could cause precisely the symptoms described. Here's how it happens.
An e-mail virus arrives in someone's Inbox as an executable attachment or a link. If it manages to launch without getting caught by the antivirus it quickly goes to work replicating itself. First, it harvests all the addresses from the Contacts list. It may also flip through e-mail messages or documents to find more addresses. When it has collected everything it can, it silently mails itself to each harvested address. The virus doesn't use an e-mail client for this, so the messages definitely won't appear in the "sent items" folder.
Of course, a goodly portion of these collected addresses will be inactive or otherwise invalid. The virus's activity could generate a flood of "undeliverable mail" warnings back to the victim's e-mail account, a flood that would reveal the virus's presence.
To avoid giving away its presence, the virus takes advantage of the e-mail protocol's weak security. It's quite simple to tweak the header of an e-mail message so it shows any arbitrary address as the sender. The virus code simply picks one of the harvested addresses and "spoofs" it as the sender address.
So, your cousin Mel has an e-mail virus. You're in Mel's address book. The virus chose your address as its false sender. People receiving the message think it came from you, but in truth there's no direct connection. Unfortunately, that also means there's no easy way to identify the true source of the problem, but in this scenario you're perfectly safe.
You Got Hacked
Of course, it's possible that somebody really did hack your e-mail account, or simply guessed your password. The moment you suspect such a problem, change your e-mail password to a new strong password that the bad guys won't guess.
Web-based e-mail accounts often include a setting for a backup contact account, some way the provider can contact you if you're having trouble with the Web-based account itself. Double-check this to make sure it hasn't been changed to some other account; if it has, you know for sure that you've been pwned.
Review any other personal profile settings, things like address and telephone information. This would also be a good time to change your security questions and answers. Most Web-based e-mail systems won't show the answers that you saved previously, so a hacker couldn't view them. Still, it's better to take no chances.
Who Got Hacked?
Unless you have hard evidence like changes to your account profile, determining whether your account was actually hacked can be tough. The spurious messages purportedly sent from your account do contain clues, for those who can decipher them. If possible, have an expert look over the header data from such a message. An ordinary forwarded message is no good, so the friend who received the offending message will have to forward it as an attachment.
Try to pick a friend who uses a standard e-mail client like Outlook or Thunderbird, as opposed to checking mail on the Internet. To send the offending message as an attachment, your friend just needs to drag it onto the message being composed.
If you can't get expert help or if you're still not sure afterward, the safest bet is to act as if the account really was hacked.
Recovering From a Hack
If you verify that a hacker truly has compromised your e-mail account, you've got cleanup work to do. Did you use the same password on any other secure Web sites? If so, you'll need to find and change all of those. And of course you should notify your correspondents that the account was hacked and warn them to ignore strange messages they may have received.
Double-check your profile information to be sure that the answers to security questions are never revealed, not even when you're logged in with the proper password. In the rare case that the answers weren't hidden, you'll need to visit every other secure site you frequent and change any where you've used the same security question and answer. Here's the worst-case scenario. There's a possibility the hacker could change the password and security questions, effectively locking you out of the account. In that case your only recourse is to throw yourself on the mercy of the provider. Contact support, report your problem, and be prepared to prove in painful detail that you are the true and valid account owner. And start thinking about what account name you'll use in case you have to abandon the hacked account and start over.
As noted, some events completely unrelated to you can cause symptoms that look like your account was hacked. To head off the possibility of a real attack, review your e-mail accounts and change the password for any that might be guessed easily. Make sure all the passwords are different from each other, too. A password manager like LastPass 1.50 can help. If the e-mail provider lets you make up your own security questions and answers, do so rather than accepting the standard questions. And never, ever give your password to anyone. A little preparation can make your e-mail account uninviting enough that hackers will move on to the next guy, the one whose password is "password."