Wife's facebook and email accounts hacked...how? (Long)

[pinkoos]

Hi,

So we get a phone call early this morning (around 6:30) from one of my wife's friends saying that someone using my wife's facebook account is chatting with him, telling him that my wife and I are in London and were mugged at gunpoint and that we need him (my wife's friend) to send money via Western Union, etc.

My wife's friend realized this was a scam and that's why he called us to let us know that her facebook account appeared compromised.

My wife changed her facebook password immediately and then we googled a bit and found out that this is a very common scam. See here for just one example of many many posts online about this:

http://joewessels.net/2009/07/08/watch-o...chat-scam/

My wife also happened to check her email at the same time this morning and she had received an email from a family friend saying that he was stuck in London, got mugged, etc., etc. I checked my email and I received the same email from the same friend. We thought it was quite coincidental that we got this email at the same time this facebook chat scam was ongoing with my wife's friend.

So, I had my wife check her sent items folder in her fastmail email account and there was an email sent from her account around the same time this morning, addressed to "undisclosed recipients," CC'd to several gmail addresses (of the scammer I assume) and having a subject of, "TESSSTTTT" and some gibberish for the body, "dada;lkdfkd."

Anyway, this really alarmed me. It appears that someone not only hacked into my wife's facebook account (worrisome) but also into her email account (very worrisome).

Unfortunately, my wife uses the same password for almost all of her online accounts (including one of our bank accounts, which I've already changed). So, I'm just trying to figure out how this happened. It appears someone was able to figure out her facebook password, find out her email address from her facebook profile and then maybe try logging into her email account with the same password and got lucky b/c the passwords were the same. Do you think this is the most likely scenario?

Or, I've heard of viruses being able to send out emails from one's email account without actually knowing the password. In this instance, I'm guessing the virus gains access through the Outlook address book or something like that? My wife does use Outlook on her home Dell and keeps it open all day long.

Another thought is a key logger on her computer sending her keystrokes surreptitiously to the scammer/hacker.

All this just seems too coincidental for one morning (ie, facebook hacked, email hacked and email received with similar London mugging story).

What we've done so far is: change her facebook password, change her fastmail password (to something different) and change the one banking account password that was the same.

Does anybody have any thoughts on what happened? Obviously, this has gotten us both a bit worked up!

Thanks.

EDIT: Forgot to mention that the password she was using is NOT easy to figure out, has letters and numbers, etc. So, it's not something someone can just guess out of the blue. Also, she hasn't used any public omputers lately. She was at her sister's house in California for the past 5 weeks, so her sister's computers were the only other computers she's used to access facebook and fastmail that she can remember.

[dmann]

What a nightmare! I can't offer much help but FB does have pretty explicit instructions on how to report hacking to them. Go in and check it out.

The other suggestion I have is to get her a gmail account to use for things like FB, internet forums like this one and any contests or sweepstakes she may enter. Do NOT use this account for any "real" email from family, friends, banks, credit cards, etc.

Good luck-
DM

[finn]

Had the same thing happen to a few friends,(ie:mugged in London...), and my yahoo account was hacked. Since changing my passwords have not had any other occurrences.

[JoeH]

If her password was related in any way to family, friends, birth dates, pets and the like, the person probably figured it out from posted information. The other possibilities you mention could be the route used, but are less likely. They take more work, most persons going to break into accounts go for the easy ones first.

I and others could go into long discussions about good passwords, but I will try to keep it short. First, the same password should not be used for most of your accounts. Second, you should never use any personally related words or dates as passwords or part of passwords. That includes foreign language words, the persons trying to hack into accounts know those too. Third, they should not be short, 8 or 9 characters as a minimum. A mix of alphabet, numerical and punctuation characters is best. To make it easier to remember, it can be based on a phrase - not easily related back to the person - and use the first letter of each word and substitute numbers and special characters in places.

P.S. "The quick brown fox ..." is not a good phrase to base a password on, lots of people have used it.

[Lux Interior]

Bosco

[cbelt3]

The odds that your passwords were simply stolen from a crack attack on an admin someplace are higher than the odds that your passwords were broken by a brute force attack. However, both of them happen.

Change your overall passwords. NOW.

My best suggestion for passwords is to use what I call a 'modal' password. Eight letters and numbers. Four of them are the same for all my passwords (over 500 of them now..) and four are different, but relate somehow to the site or system. It's related to the Public / Private key system my great uncle helped develop.

Sample:

Site is macresource
Private key is s4v#
Public key is urce
password is then s4v#urce

Site is appleswitcher
Private key is s4v#
Public key is cher
password is then s4v#cher

[pinkoos]

Thanks for all of the replies so far.

Cbelt3: quick question - what's the distinction between a crack attack and brute force attack?

[cbelt3]

brute force = 'dictionary' attack on your password. For example, trying "Administrator" / "administrator", then rapidly running through the dictionary.

Crack attack = attacking the actual file system of the provider or company to break out your user id and password, or better yet to steal a system admin's account, because then you essentially OWN the entire system and can create and change users to satisfy yourself.

[pinkoos]

Okay, thanks for the clarification. So, I'm guessing you mean that facebook was hacked and access to usernames and passwords was obtained.

Then, someone turned around and used the same password to get into her fastmail account?

[Mike Sellers]

I don't think Facebook is nearly as secure as people think. Ever read those disclaimers every time someone invites you to participate in a poll or game? You give them access to your info AND your friends' info. I won't do it though I guess I'm vulnerable because everyone else does. I've already gotten spammed through a Facebook message.