Has your MSE forum email address been spammed.

Typo22

Hmmm. Another vote for spam received from Sigma Realty here, also sent to an MSE-only email address. Details emailed as requested.

pelago

I have emailed details as requested. For the benefit/interest of others, here is some of what I put in that email:

I can say that in my case at least, the only time this only-for-MSE email address has ever been entered anywhere was when I did three things a couple of years ago:

1, Typed the new email address into the configuration page of my email hosting provider.

2, Typed the email address into the registration form on the MSE forums.

3, Received the automated email from the forum which I had to confirm.

At that point I deleted the automated email, I never sent from that address, and it was never in my email client contact list.

Although one can never say never, I do not believe my PC was compromised to harvest the email address, and even if my PC was compromised, the address was very shortly-lived on my PC so there was a very small window (also, I run Linux and work in IT systems administration so practise good security). I suppose it's possible the email address was harvested during transit between MSE and my email inbox, although that was only one email and would rely on a man-in-the-middle. Also, this single email that was sent was a couple of years ago, but only now have I got this spam message to this address, so it seems unlikely the spammers harvested the address back then.

All my maintenance on my email addresses at my email hosting provider (where the address is permanently stored as a configuration item in their systems) is done by HTTPS, so shouldn't be sniffable. I suppose my email hosting provider itself could have been compromised, but I have dozens of unique email addresses registered with them and haven't received junk to any of the other addresses, which you would have thought would have happened in the case of a compromise at their end.

So it seems likely that the source of the harvesting of the address was from MSE itself.

Good luck with your investigation. Please note that I am not really trying to blame you. As I work in IT sysadmin myself, I am just trying to help you in case you have or had a data leak. From my point of view it's only one spam message, and because of my email system, I can easily delete that address and create a new one, so it's not a big deal to me, but it might be a big deal to you if a large number of your users email addresses have been harvested.

MSE_Martin

As webbys saying we're looking for anything that signifies a breach and have externals checking too. We still can't find anything but take it seriously - there is a possibility it could come from the same registrar of emails.

The numbers of reports are very limited (thankfully) and the only data we hold is email addresses (and teh forum registered ones are seperate to the big weekly email list). Still we don't like even the remotest possibility and behind the scenes are putting resource into checking there's no hole.

setmefree2

I still haven't had any msgs from Sigma Realty

moonrakerz

MSE_Martin wrote: »

The numbers of reports are very limited (thankfully) and the only data we hold is email addresses (and teh forum registered ones are seperate to the big weekly email list).

That is what does concern me slightly. I don' get any of your news letters etc, so anyone/anything monitoring e-mail traffic to me would have have a pretty lean time.
The fact that you have had only a few reports is not surprising as I should imagine the percentage of people using this "unique" addressing system is very low.

Pound

moonrakerz wrote: »

Today's effort purported to come from "Sigma Realty Group".

pelago wrote: »

The email I got today to my only-ever-given-to-MSE email address was also from an @ymail address, advertising "Sigma Realty Group", interestingly.

alanwsg wrote: »

Just started getting spam from this one. from sigma..blah..blah like tthe others.

Typo22 wrote: »

Hmmm. Another vote for spam received from Sigma Realty here, also sent to an MSE-only email address. Details emailed as requested.

At me to the growing list please. I use a traceable email system (ie. my email address is unique to this site and I've only ever typed it once to sign up on these forums). I've just received to that email address.

To: ...moneysavingexpert.com@...
From: [EMAIL="tgard@ymail.com"]tgard@ymail.com[/EMAIL]
Subject: RE: your subscription on bestjobsuk
Has some HTML with Sigma Realty Group as the title

savercol

Beginning to feel left out but got mine this morning.
As everyone else, mine is a specific address linked to a web site and not used anywhere else. I think its time to call in Jack Bauer and his CTU team. The system has been compromised.

moonrakerz

I did notice that the first post on this subject was on the 14th; on the 15th "webby" said "We've been investigating this issue over the last week or so " -
has this problem been going on for longer than it has been publicly acknowledged ?

Former_MSE_Webmaster

It's been going on for a couple for weeks now but we sometimes receive similar reports from people blaming us for spam only to find out, upon further investigation, that their e-mail adresses are publicy visible elsewhere on the web, so we don't report anything unless we have convincing data to base an opinion on.

To update you, we've had no specific indications of a security breach so far but we're still looking into it and we'll let you know if we find anything substantial.

Webby

moonrakerz

Please don't take this the wrong way, but I find it rather difficult to believe that a spammer, who needs huge numbers of addresses, to make his "business" pay, is going to trawl through sites like MSE in the hope of finding a few e-mail addresses that users of the forum have accidentally left "open".

It only becomes a viable operation if he can get large quantities of addresses quickly - such as by copying someone's data base at one go.

Only people who use "unique" addressing are aware that their unique MSE address has got into the wrong hands, all of the methods for harvesting e-mail addresses will harvest the lot, so why do I and a few others not get spam e-mails addressed to (say),britishgas@myownverycleverpersonalanitspamdomain.com but only those addressed to MSE ?

As I said previously, this has happened to me once before, and eventually the company did admit that it's system had been compromised.