October 2011

SPECIAL REPORT: The State of Hacked Accounts

The following is an condensed overview of end-user research compiled by Commtouch to explore issues related to the theft, usage and recovery of compromised accounts. This document also includes tips for end users on how to prevent their accounts from being hacked or compromised is also included.

The complete report can be downloaded at http://www.commtouch.com/hacked-accounts-

report-Oct2011

About this Report:

Spammer are using compromised accounts (accounts who’s credentials are stolen or hacked) to send spam and malicious emails.

Background

Background Increased use of Compromised Gmail & Hotmail

Accounts in Q2 & Q3 2011 • Hotmail: 28-35% of the spam from Hotmail actually comes

from compromised or spammer Hotmail accounts • Gmail: Mostly (96-97%) from zombies that simply forge

Gmail addresses • Q3 2011 saw growth in use of Hotmail & Gmail

compromised accounts over Q2

Source: Commtouch

Introduction

Why the move by spammers to Compromised Accounts

1. Antispam solutions are becoming better at blocking

botnets (IP reputation can typically block 85-95% of spam based on IP).

2. Blocking of spam from compromised accounts is more difficult as accounts often exist within whitelisted IP address ranges (such as Hotmail or Gmail).

3. Although spammers can set up their own legitimate accounts for sending spam, email providers obstruct this phenomenon to the best of their ability.

4. Recipients are often more trusting of emails coming from a known source.

Introduction cont…

There are some issues for spammers using compromised accounts • Compromised accounts can only be used for relatively small

spam runs of a few hundred or thousand messages without being detected by the provider

• The accounts need to be compromised/hacked/stolen before they can be used.

The result • The new spammer tactic of using compromised accounts

generates smaller volumes of spam, but with better delivery rates.

Goal of the Research

The research set out to understand the following… • What accounts are targeted? • How are accounts compromised? • Are compromised accounts used for other

purposes besides spam and scams? • How do users figure out that their account has

been compromised? • How do users regain control of their accounts?

THE RESEARCH RESULTS

1. Which accounts were targeted

Participants were asked which of their account(s) were compromised Key Findings:

• Gmail, Yahoo, Hotmail & Facebook attracted 15-27% of cybercriminals attention

Analysis:

• The value of a compromised account is in the “clean” IP address, rather than the specific domain of the address.

• From this point of view, all accounts have a similar value since they are from well-known domains.

1. Which accounts were targeted

“Other” include users of AOL, Comcast and other providers

Survey Responses: • Gmail • Yahoo • Hotmail • Facebook • Other

2. How was the account compromised

Participants were asked how their accounts were compromised Key Findings:

• Majority (62%) responded they were not sure • 15% recalled using a public Internet terminal or public WiFi prior

to the hack. • None of the respondents believed they had been phished or had

been victims of a drive-by download (by following a phony link). Analysis:

• Many people typically engage in risky online behavior without realizing

• It’s not always easy to figure out how an account gets compromised and retracing steps does not always help.

• Likely many of victims simply used easy-to-guess passwords

2. How was the account compromised

Survey Responses: • I used a public computer or WiFi

network (e.g.: Internet café) • I opened a file that might have

contained a virus (e.g.: an email attachment that seemed legitimate)

• I clicked on a link in an email that was phony (e.g.: an email from UPS or DHL with information about a package for you)

• I responded to a request to provide my username and password (someone “phished” your details)

• I clicked on a link I received from a friend in Facebook

• Not sure • Other

3. What was done with the stolen accounts

Participants were asked what they believed was done with their accounts Key Findings:

• 54% said account was used to send out spam • 12% said it was used in a “friend stuck overseas” scam (that

blatantly exploits the trust element) • 23% did not know

Analysis:

• The value of a stolen account is twofold – it provides a clean IP address, and in addition there is an element of trust that comes with a message since it is (in most cases) received from a friend or acquaintance

• Of the 23% of respondents that did not know how their compromised account had been abused, it may be assumed that these were used for a mix of spam and scams

3. What was done with the stolen accounts

Survey Responses: • Used to send spam

promoting a product • Used to ask my friends

to send me money since I was “stuck in a foreign country”

• Used to send a phony message/wall post on my Facebook account

• Not sure – I was just told it was compromised

• Other

4. How were the account owners made aware of the compromise

Participants were asked how they became aware their account had been compromised Key Findings:

• In 54% of the cases the compromised account owners learned of the breach from their friends;

• 15% received an official email • 31% responded “I noticed it myself”

Analysis: • No one is as good at pointing out people’s errors as their own

friends (who also receive the spam and overseas scams) • Users probably assume that Gmail, Yahoo, Hotmail and

Facebook are keeping an eye out for hacks and other bad stuff • Some users might think that they will notice strange activity in

their account as soon as it happens

4. How were the account owners made aware of the compromise

Survey Responses: • Friends told me after

receiving a strange email or message

• Received an official email from Gmail, Yahoo, Facebook suggesting I change my password

• I noticed strange activity • Other

5. What action did account owners take to recover their accounts

Participants were asked what action they took to recover their accounts Key Findings:

• 42% solved the issue with just a password change • 23% changed their password and ran an antivirus scan • 23% did not do anything to remediate their account, and

believed this was a one off event Analysis:

• The modern equivalent of “changing the locks” (i.e., changing password) seems to be key to regaining control of an email account

5. What action did account owners take to recover their accounts

Some of those who responded “other” had broached the issue with their email provider.

Survey Responses: • Changed my password • Ran a virus check • Both of the above • Nothing – it happened once

and seems to be OK now • Other

Safety Tips to Protect Against Being Compromised

1. Use passwords that are difficult to guess – no keyboard sequences (qwerty, 1234qwer, etc.), no birthdates, no common names. Mix numbers and capital letters.

2. Use different passwords for different sites. 3. Consider using a password manager that stores all you passwords,

generates new ones, and syncs them between your different PCs, laptops, and tablets. Keep your master password complex and safe.

4. Think carefully before using a public Internet terminal. If you do need to use one, remember to uncheck the “remember me” box when you log into your email or Facebook. Also – don’t forget to log out and close the browser window when you are finished.

5. Don’t open email attachments or click on links in emails you weren’t expecting. Treat all unexpected attachments as malware even if they appear to be “only” PDF, Word or Excel.

Safety Tips to Protect Against Being Compromised cont…

6. Don’t follow links in Facebook that accompany some hysterical or generic text such as “check this out!!!!!” or “Thought you might like this!!”. Avoid Facebook links that promise some current event “scoop” such as “Osama bin Laden death video!”.

7. To date, there is no Facebook application that allows you to see who has been viewing your page – never follow any link that promises this functionality.

8. Never respond to a request for your password – even if email looks official or urgent.

9. If your email provider offers single-use passwords (for example as Gmail does), implement it. In the case of Gmail, you can either download an application to your mobile phone that generates a single-use password (a string of random numbers that changes ever few seconds), or Google will SMS your phone with the password. In this way, if someone is determined to hack into your account, they will need to have access to your mobile phone as well.

Download the complete

SPECIAL REPORT: The State of Hacked Accounts

at

http://www.commtouch.com/hacked-accounts-report-Oct2011

For more information contact: info@commtouch.com

650 864 2000 (Americas) +972 9 863 6895 (International)

Web: www.commtouch.com

Blog: http://blog.commtouch.com

Copyright© 2011 Commtouch Software Ltd. Recurrent Pattern Detection, RPD, Zero-Hour and GlobalView are trademarks, and Commtouch, Authentium, Command Antivirus and Command Anti-malware are registered trademarks, of Commtouch. U.S. Patent No. 6,330,590 is owned by Commtouch.