Printable View
I think someone has hacked into my
email account on Earthlink, stolen my password
(which I have since changed) and has been reading my old emails.
Is there anyway to trace when and where my email account has been accessed, and to Identify who is doing it?
Thanks for any help provided.
Dave
You will probly need a supena in order to make earthlink release the log files associated with your account. If their policy is diffrent (which they do vary from isp to isp), they might release the log files as to which ip addresses logged into the mail box and you can start tracing back from there.
Maybe you could start by telling us a story as to why you think someone has hacked your earthlink account.
Good question zenger...
is it someone you know....????
I guess you can always contact eartlink.....I think they will just tell you to change your password....not sure
MLF
I do not know if it is someone I know, but that is a possibility.
I will not be able to determine that until I can identify the IP address and location for the person checking my mail.
The reason I am suspicious is that I have opened my email on several occasions to find that messages that I had not previously read were appearing with the "unhighlighted" shade indicating the message had already been read.
On other occasions, I have opened my email and found messages that I had previously read, were now showing that they were "unread".
So ...is this a web based email...???.
or is it downloaded into outlook express or something??
Cause if it is OE.....anyone have physical access to your computer???
If it is web based ........ have you used someone elses machine to check your email????
Is your computer clean of malware and patched with software and OS updates???
MLF
morganlefay:
I have used other computers as well as public "open wifi" services to check my email on a regular basis.
I am pretty sure the attempts would be web based as no one else has access to my laptop.
Thanks for your input.
David
:eek:Quote:
I have used other computers as well as public "open wifi" services
try and save your mails to a folder on your PC
I know they will allow you to save em local if you PAY
but try and C+P em to a .doc ?
that way if someone IS getting in
they only see the new stuff
make your P/W stronger
use a passphrase
ie - thi5i5mypasswordandyouwontgue55it
try not to use the same places to access mail / web
does it only happen at certain times / certain places ?
consider OE :eek:
I use outlook [someone has to :p]
but I can still access my mail as a web based system by logging into my ISP's website
do you have enemies / weird friends / a stalker
can you be certain about the physical access to laptop ?
foxyloxley:
Good advice!
I will download and save my emails offline.
I do not think I have enemies / weird friends / a stalker
lurking around, but I guess you can not be sure until you find one.
My emails do contain confidential information that might be of interest to opposing attorneys so I am very much interested in tracking down who ever may be "peeking" at my mail.
Thanks for your input.
David
I doubt you will have any luck getting Earthlink or an ISP to release any IP records. However, there are always simpler methods you could take into your own hands...
Why not spread a little honey in your mailbox and wait. Post messages that would be of interest to anyone reading your mail; with links pointing back to a machine you control with a sniffer logging connections.
David, one thing to keep in mind is with most mail server if you set outlook to sae a copy of the message on the server, (people really do this) once it downloads the mail it will mark it as read on the server. If you dont set it to save a copy, once it downloads the mail it will be removed from the most servers. Just a little info so your not caught off guard.
Most likely you have a roomate or girlfreind that knows your password. If you use wifi hotspots to check your mail, be sure no one is looking over your shoulder to see what the password is. Weak passwords (like my boss 1234 thats the same as my luggage) will get you into big trouble. Hell it could even be the FBI (NOT). Your best bet is to ditch the email account and get a new one. Dont use the same password for everything, this too can get you into trouble.
I did read about a email program that would allow you to dl all your web mail to outlook, just dont remember the name. Works with MSN, yahoo, aim, and others.
Hi David,
This sounds a little strange to me?
I am not aware of any mechanism that would cause that to happen, unless it is some sort of problem with the e-mail system.Quote:
I have opened my email and found messages that I had previously read, were now showing that they were "unread".
Logically, if I could read your e-mail and reset it to "unread" you would never even know. I would be inclined to ask the e-mail provider what they think.
:)
Nihil, it is possible. But its not done by the computer, but by a user. Maybe the "hacker" thought that those were instresting but he didn't have the time. I know it sounds weird and unlogical. I'm just providing some back ground info.Quote:
Hi David,
This sounds a little strange to me?
quote:
I have opened my email and found messages that I had previously read, were now showing that they were "unread".
I am not aware of any mechanism that would cause that to happen, unless it is some sort of problem with the e-mail system.
David, I'm assuming you changed your password. I mean you would be pretty dumb if you didn't, pardon my rudeness. Have you found evidence that showed that after the assumed password change someone "hacked" in your account again?
As to finding out his IP, you would have to check with the email provider. No other option. But as stated before, if you are not paying for it they are most likely to don't give a *****.
Just my 2 pence.
One note... If you use the "regular" POP3 protocol to receive your email, keep in mind it is a clear-text protocol. Meaning anyone can see your password.. Keep this in mind next time you use a public "open" WiFi network..
If you read your mail using a webinterface make sure you use SSL (https) instead of http.
Hi DakX , I can see where you are coming from, I was just trying to figure out the circumstances or sequence of events.
If the server was restored for some reason, that would presumably reset the flags?
If someone is reading my e-mail and they open one that has already been opened, I doubt if they would set it to "unread" as that would probably alert me to what was going on?
If they can reset them to "unread" they would do that to ones that they opened first, so as not to alert me?
Of course, they could be total idiots, or are just doing it to pull his chain?
It is the resetting of opened messages to "unread" that I am having difficulty with. Not the "how" but the "why"?
:)
Thanks everyone for the great suggestions.
After changing my password I have not identified any new unusual activity on my email account.
Neptune0z:
I am interested in your idea about spreading some "honey".
If I cease using my regular account and then set it up with the old password reset and send some emails to the old address with some interesting "misinformation" of potential interest to a hacker, how do I set up the sniffer and links you mentioned?
nihil:
My guess is whoever is peeking at my email was maybe in a rush on occasion and forgot to mark "unread" on some of the messages looked at that I had not previously opened. As to why a message would show "unread" after I had opened it , I can only assume I am dealing with a sloppy hacker that might be lured into a "honey patch" if I can set one up.
David
Well...The simplest way would probally be to just mention some links in your inbox...Maybe you could mention that FTP server that will be running next week on your home system, so you can share your photo's with your mother-inlaw...Just point the links back to your machine.
Keep in mind that you will probally have to use 2 or 3 different "misinformation statements" so you can construct an identification matrix. This way you can eliminate false positive caused by routine net traffic. Download something like Ethereal to sniff the incoming connection requests.
Yes I agree but I think that the company would have let the users know. Atleast if it concernd data that might have been changed.Quote:
Originally posted here by nihil
If the server was restored for some reason, that would presumably reset the flags?
I've been "struggling" with the same thing. Why would anyone reset it? It makes no sense.Quote:
It is the resetting of opened messages to "unread" that I am having difficulty with. Not the "how" but the "why"?
As to finding out who did it. Something like Neptune0z suggested might be good. You could just stash a document or a file somehwere on a server. Then just mail the url to yourself and wait for him/her to bite. I've heared that you can install a feature that enambles IP logging. If you combine this with a file that no-one knows about besides you and in the future a possbile hacker you can easely find out the hackers IP. This in combination with an whois of some sort ( come on guy's I know you have some sites for this :D ;) ) could atleast give you a hint in towards the hackers location/identity.
For example if you know his ISP you could find out wich of your friend, co-worker or someone you suspect uses and compare it with your results.
Again just my 2 pence.
DakX
Hi DakX , and thanks for your response.
I was also having great difficulty in understanding the "why" bit, as you know.
David probably gave us the answer with his suggestion that the guy might have been in a hurry, or not really known what he was doing?
I always fall into the trap of assuming that a "hacker" knows what he is doing. I forget that there are so many skiddie tools and sites around, that this is not always true :o
Good point! I can only talk about commercial transaction applications here, but this is what I have personally seen:Quote:
Yes I agree but I think that the company would have let the users know. Atleast if it concernd data that might have been changed.
1. System has a database (ledger) which is updated by "transactions".
2. The transaction records are "journalled" (stored in batches or units)
3. The system crashes.
4. You restore the system back to a prior date, which resets the flags/indicators
5. You re-apply the "journalled" transactions, and everything is back to normal.
Problem is that the flags/indicators have not been reset :eek: so you do a payments run, and all the accounts that you flagged to pay since the restore point are ignored, because that is not a "transaction" and is not included in your journals.
I have absolutely no experience of e-mail systems, but I can imagine them working this way?
:)