The State of Hacked Accounts

Most people believe that their greatest chances of being hacked or compromised are when indulging in risky endeavors online. The fact is more than half of us (62% to be exact) are unaware of how our accounts become compromised, thanks to data shown in a study done by Commtouch. Commtouch is an internet security technology vendor who analyzes and tracks spam, malware and Internet threats through internet transactions. Microsoft, back in March, along with a consortium of industry experts and the FBI took down one of the worlds largest botnets, Rustock. When Rustock was purged from it’s spamming responsibilities — globally — spam dropped about 39%. Since then spammers have rethought the use of botnets for large spam and scam tactics and seemed to have focused on compromised accounts.

With compromised accounts, spam is more difficult to block and easily avoids spam detecting software along with IP based reputation technology. Compromised accounts while offering the advantages of avoiding spam blocking technology and the veil of a trusted source also limit spammers with smaller doses of spam runs and the trouble of compromising an account. Commtouch’s data shows the increased preference for compromising accounts where spam is either sent from a zombie with a phony Gmail or Hotmail address or from a compromised Gmail or Hotmail account.

So just who is targeted? How are your accounts being compromised and are they only being used for spam? And most importantly how do you go about regaining control and preventing this from happening? Results from a public survey publicized on LinkedIn, Twitter, Facebook, and Commtouch’s Blog, taken by email users who have had their accounts hacked or credentials stolen offer some insight to these questions.

• 62% Of respondents had no idea how their accounts became compromised.
• 15% Remembered using a public access point or terminal, while the same amount blamed a Facebook link.
• 54% Of compromised accounts were used to send out spam, 12% were used in phishing scams.
• Less than a third of users noticed themselves that their accounts were compromised, with more than 50% relying on their friends to inform them.
• 65% Of compromised accounts are remedied by simply changing your password, while shockingly nearly 1/4th did nothing and believed it was a one off event.

We’ve offered tips to help combat compromised accounts here at the bitbag before but one can never say it too many times, security starts with you. It all starts with your practices and the measures you take to keep your identity and accounts safe. Commtouch offered some hints, that when combined with the tips suggested by us could help in significantly reducing the probability of your account(s) or identity being compromised.

• Passwords. No brainer here, when applicable mix cases and complexity (numbers, case consideration on letters and special characters/symbols).
• Use different passwords for different sites, if one account is compromised it limits your exposure.
• Password managers like LastPass which have proven to be reliable could help out with complexity, randomness and best of all organizing.
• Avoid using public terminals or access points unless you really need to. If you do, never check the “Remember me” option when asked to save passwords or try using Internet Explorer’s “In-Private” or Chrome’s “Incognito” browsing option both located in their browsers tools menu.
• Don’t open email attachments or click on links in emails you weren’t expecting – like UPS delivery notices, invoices from online stores, hotel bill corrections, credit card error letters, etc. Treat all unexpected attachments as malware even if they appear to be “only” PDF, or Word, or Excel.
• Don’t follow links in Facebook that accompany some random text such as “Hey check this out!!” and avoid Facebook links that promise exposing pictures of celebrities or other current events such as death videos.
• Never respond to a request for your password – no matter how official or urgent the email looks.
• If your email provider offers single-use passwords (for example Gmail), use it. With Gmail, you can either download an application to your mobile phone that generates a single-use password or have Google send a SMS to your phone with the password. Using this method, if your account is compromised, they will need to have access to your mobile phone as well.