Guildwars Guru - Sold / Lost my Email Address to Phishiers

sre

sre

Ascalonian Squire

Join Date: Mar 2006

The Order of the Frozen Tundra (ToFT)

W/Mo

13 Mar 2013 at 14:40 - 1
I'm sad to say that guildwarsguru has either sold or lost positive control of their user data base. The very sad part is that it wasn't spam email, it was phishing for my non-existent runescape account. I'm informing the community so as to be aware of possible account thefts or other scams.

I track all of my email address that I give out. In this case [email protected] (mydomain.com is not the real domain name I use). This address was set to forward to my gmail account (again not my real gmail address being shown). Full headers below.

Code:
Delivered-To: [email protected] Received: by 10.204.226.70 with SMTP id iv6csp1577bkb; Tue, 12 Mar 2013 19:45:13 -0700 (PDT) X-Received: by 10.68.195.70 with SMTP id ic6mr41738777pbc.60.1363142712738; Tue, 12 Mar 2013 19:45:12 -0700 (PDT) Return-Path: <[email protected]> Received: from p3plsmtp12-06.prod.phx3.secureserver.net (p3plsmtp12-06.prod.phx3.secureserver.net. [173.201.192.63]) by mx.google.com with ESMTP id tx10si32836315pbc.182.2013.03.12.19.45.11; Tue, 12 Mar 2013 19:45:12 -0700 (PDT) Received-SPF: pass (google.com: domain of [email protected] designates 173.201.192.63 as permitted sender) client-ip=173.201.192.63; Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 173.201.192.63 as permitted sender) [email protected]rver.net; dkim=pass [email protected] Received: (qmail 21342 invoked from network); 13 Mar 2013 02:45:11 -0000 Delivered-To: [email protected] Received: (qmail 21339 invoked by uid 30297); 13 Mar 2013 02:45:11 -0000 Received: from unknown (HELO p3pismtp01-074.prod.phx3.secureserver.net) ([72.167.238.104]) (envelope-sender <[email protected]>) by p3plsmtp12-06.prod.phx3.secureserver.net (qmail-1.03) with SMTP for <[email protected]>; 13 Mar 2013 02:45:11 -0000 Received: from nm24-vm2.bullet.mail.sg3.yahoo.com ([106.10.151.81]) by p3pismtp01-074.prod.phx3.secureserver.net with SMTP; 12 Mar 2013 19:45:09 -0700 Received: from [106.10.166.124] by nm24.bullet.mail.sg3.yahoo.com with NNFMP; 12 Mar 2013 21:42:48 -0000 Received: from [106.10.167.176] by tm13.bullet.mail.sg3.yahoo.com with NNFMP; 12 Mar 2013 21:42:48 -0000 Received: from [127.0.0.1] by smtp149.mail.sg3.yahoo.com with NNFMP; 12 Mar 2013 21:42:48 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1363124568; bh=5YpYi0iiWoLTClwbk4o++kFr+IzUZU71vS4cbTwO7DY=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE; b=Js3xTKefvlNsc5A1nVBiSig9xZz+95DoXDEag9FUWQsux1Nza06oWQZxlMVJ28Kl5EKkQguBaUsUqxi79h+dDwgZXKKF6wpbiwoqvEZmddgGYjYgKwLw5U0ADeo2SVNd9Osn1jGiQbfQdVD+y6Q8wgEul3iT2wkQBL98dbhzyXI= X-Yahoo-Newman-Id: [email protected] X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: gksPRIYVM1kSfgdlE8BjVEr0r.Arl1YMWmQ8YDCAqBILzvp OslbnZ4G1C4JVtl7AsPbxXUBLw._Bz9.0lbVwH3FqGK_DwgOVN5yAtSf5YhL i_uerKbn1M.4pruE3Yn1tWHPSdxkFYPN6213AUq1sYPKdE7GYXNLTT463fa0 xtU4D8NEUA0MYTJUAvCJbZuJAD.OAEeKd1LBh8yBhBLl0SKGFFs_zEZPXZPC .DSEHKEMZSfpHi6evGxFIkbhSR45uJ0R2NkXQ0fQ5IZA5ou_hSpTuNdtTCVy 6.Eo4l5yAChdDnWwCi7SmQ5HFjFJGHdRdRBY2UC6820zwK9JAjnSbBAwyTTs _gaobydDbBkwukg3Je8bl.5sFYU0ISPimJ4Jf2Z_NrYupx2XgJj1N6M0bP72 mhw3sZJltZvhhGXndk8rJAe4awpi4k.ElJPxrwo5xwOMc2sLQhwc6iJCeHMU .i5I2siyRyRQZnto7bjnS0YjZVeErMazB6kbTXtyHhIEnQHWKWFYy3jXSbcw o97pCbtzVA_vg8mS2Lri9QYIBnJA21UY_COIveoKCLUT8YR0sTJHTZJcAhmc TpBiM3og.svjwaDDLLz8d1ujXDD8aLCrEHX7r8o0vRMXK8LdbA0S4Qa1WtZx wco6yFm0PmIs8WblZBCp3C0wI79NwKahPtkwozLYo3tf0qcTRGA-- X-Yahoo-SMTP: 1xt760qswBCVMXTol_7ZRF8ZOuXieZOljMXN7P4- Received: from ulofyb ([email protected] with login) by smtp149.mail.sg3.yahoo.com with SMTP; 12 Mar 2013 14:42:48 -0700 PDT Message-ID: <[email protected]> From: "RuneScape" <[email protected]> To: <[email protected]> Subject: RuneScape Account-Notice Date: Wed, 13 Mar 2013 05:42:56 +0800 MIME-Version: 1.0

pkodyssey

pkodyssey

Wilds Pathfinder

Join Date: Nov 2005

In a cardboard box with Internet

The Order of the Frozen Tundra (TofT)

N/

13 Mar 2013 at 14:42 - 2
This is very discouraging to hear. Thanks for posting.

cosyfiep

cosyfiep

are we there yet?

Join Date: Dec 2005

in a land far far away

guild? I am supposed to have a guild?

Rt/

13 Mar 2013 at 15:56 - 3
ANYone can get phished....yahoo accounts are notorious for that. my last old email account got it A LOT (I had to get rid of it since the domain dsl provider would do nothing about the 'failure' notices that I was getting--in excess of 10,000k a DAY).

ANYONE can use your email addy and send stuff to people pretending to be you. So it may not be guru's issue at all. Though I would suggest contacting Kvinna about this as she is the only admin for this site (gw2 has more).

sre

sre

Ascalonian Squire

Join Date: Mar 2006

The Order of the Frozen Tundra (ToFT)

W/Mo

13 Mar 2013 at 16:09 - 4
Cosyfiep,

From your comments, it is clear I failed to clearly explain myself. I created a unique email address for my account here at Guildwars Guru (GWG). (I create unique email addressed for each website I create an account on.) The reason I do this is twofold: 1) I can track who has lost/sold my email address and 2) delete the offending email address so I don't get spammed.

What happened here is my unique email address for GWG, which I never shared or use anywhere else except here on GWG, received a phishing email. As you can see I hide my unique GWG email address so supposedly no one can email me except through GWG mail system.

Hope that clears this up for everyone.

Quote:
Originally Posted by cosyfiep View Post
ANYone can get phished....yahoo accounts are notorious for that. my last old email account got it A LOT (I had to get rid of it since the domain dsl provider would do nothing about the 'failure' notices that I was getting--in excess of 10,000k a DAY).

ANYONE can use your email addy and send stuff to people pretending to be you. So it may not be guru's issue at all. Though I would suggest contacting Kvinna about this as she is the only admin for this site (gw2 has more).

cosyfiep

cosyfiep

are we there yet?

Join Date: Dec 2005

in a land far far away

guild? I am supposed to have a guild?

Rt/

13 Mar 2013 at 16:29 - 5
ANYone can USE your email addy to phish.
You have NOT made yourself clear. It is very easy to find out what addresses are 'usable' and send stuff to others using that email.
I routinely get crap from email addresses like that (and ones I OWN and KNOW for a fact are not CAPABLE of sending emails even! read have NEVER EVER BEEN USED for sending OR receiving email). And yes, you can find out what isp sent the emails, but that does very little (poland is popular this time of year for this). There is relatively little you can do about it.

It is very very easy to send stuff to people using fictitious emails and every once in a while the phishers get lucky and stumble across really addys in the process.

guildwarsguru.net is not above being used for this purposes as its a GMAIL account and just as easy to get phished as yahoo or hotmail etc. Your problem is not guru here, but GMAIL as guru has NO email servers to send things from, its all gmail.

Now if someone is sending pm's from guru THAT is something we have control over....and you should contact Kvinna regarding something of that sort.

sre

sre

Ascalonian Squire

Join Date: Mar 2006

The Order of the Frozen Tundra (ToFT)

W/Mo

13 Mar 2013 at 16:57 - 6
Cosyfiep,

Quote:
Originally Posted by cosyfiep View Post
You have NOT made yourself clear.
I'm sorry you're still not understanding. Let me explain a bit more.

Quote: Originally Posted by cosyfiep View Post ANYone can USE your email addy to phish.
It is very easy to find out what addresses are 'usable' and send stuff to others using that email. GWG did not send me the phishing email; that is *not* what I'm claiming. Nor am I claiming that someone used my GWG address claiming to be me (read the headers). What I am stating is this: A third party (not GWG) sent a phishing email to the unique email address provided to GWG and GWG is the only entity that has ever been given that email address.

Quote: Originally Posted by cosyfiep View Post It is very very easy to send stuff to people using fictitious emails and every once in a while the phishers get lucky and stumble across really addys in the process. I don't believe the phisher got lucky and discovered my cryptic email address at my domain. The email address they sent the phishing address to was [email protected], where mydomain.com is a domain I own. When email is sent to guildwarsguru15376 it was forwarding on to my gmail account. The phisher has no idea what my "real" gmail account is and therefore remains safe from the phishing scams or other spam.

Quote:
Originally Posted by cosyfiep View Post
It is very easy to find out what addresses are 'usable' and send stuff to others using that email. As an network security expert, I am curious as to how you think it was easy to discover my unique email address. Remember the following:

- I never sent email from that email address
- I never shared the address with anyone except GWG
- The address was simply an alias/forward to my real gmail account
- The isn't an address book of some type with that email address in it
- The email address is constructed using a random 5 digit number

----------

Pkodyssey,

Been a bit distracted. Glad to be of public service.

Quote:
Originally Posted by pkodyssey View Post
This is very discouraging to hear. Thanks for posting.

cosyfiep

cosyfiep

are we there yet?

Join Date: Dec 2005

in a land far far away

guild? I am supposed to have a guild?

Rt/

13 Mar 2013 at 17:54 - 7
I have had the exact same thing happen (not guru related),
I OWN a domain (say 123johndoe.com). It can NOT send nor receive emails, yet somehow someone happens to be sending emails FROM that domain (which can not send nor receive), I have NEVER used it to send or receive and I have told no one about the domain; yet phishers have found it out and are using it to send spam to others (russian beauties and cialis were top favorites). We tracked the ip to poland (and one to russia). and yes, like you my email from that domain is forwarded to a real email address (so that I get the 'failure' notices)....so yeah I understand completely.

If you have a registered domain, it can be used, heck even if its not phishers can send 'email' to anyone....its just like putting a return address on an envelope--it doesnt have to be yours, and it can even be a pretend address--its just an address that is being used ANYONE can put that on there. And yeah, there are people who just sit around all day and phish, trying emails some wind up being real addresses, while others are bogus.

I have complained to my husband (IT guy) plenty of times about our domains being used to send spam--there is nothing we can do about it, he repeats to me each time. We cant send mail from those domains as there is no mail server set up with them, yet they someone manages to send emails to loads of people every day.


Quote:
 The address was simply an alias/forward to my real gmail account your GMAIL account knows that address, THAT is how it got found out

sre

sre

Ascalonian Squire

Join Date: Mar 2006

The Order of the Frozen Tundra (ToFT)

W/Mo

13 Mar 2013 at 18:02 - 8
Quote:
Originally Posted by cosyfiep View Post
your GMAIL account knows that address, THAT is how it got found out Are you saying that that the gmail servers were compromised? Isn't far more likely that GWG was compromised or even more likely that someone who used to work for GWG left and took the address book with them to sell?

cosyfiep

cosyfiep

are we there yet?

Join Date: Dec 2005

in a land far far away

guild? I am supposed to have a guild?

Rt/

13 Mar 2013 at 18:14 - 9
no, that is not what I am saying, what I am saying is that ANY traffic that goes thru a PUBLIC email system can be found out --yahoo, hotmail, gmail, etc. Hackers and phishers are much much more likely to strike at BIG email providers than a single website like guru.

Yahoo a while back (november if I remember correctly) had a problem with loads of people having emails sent to people (NOT in their address books even). It happens. I know of a bunch of people who said that they had received emails from yahoo accounts, they said that their addresses were NOT in those people addy books even, yet they got spam from that other persons yahoo account (and I have had people tell me that they have had emails sent from their yahoo accounts to others, again not in their address books even---and some of them had not even USED those accounts in months!)

sre

sre

Ascalonian Squire

Join Date: Mar 2006

The Order of the Frozen Tundra (ToFT)

W/Mo

13 Mar 2013 at 20:57 - 10
Quote:
Originally Posted by cosyfiep View Post
no, that is not what I am saying, what I am saying is that ANY traffic that goes thru a PUBLIC email system can be found out --yahoo, hotmail, gmail, etc. Hackers and phishers are much much more likely to strike at BIG email providers than a single website like guru. While this is possible (you're talking about a man-in-the-middle attack) it is amazingly unlikely. I can't stress just how unlikely it is my email address was snarfed by a hacker to send me a phishing message for a runescape account. Not to mention the 500+ other aliases I have on various domains haven't seen this phishing message or any other spam for that matter. For that matter, why wouldn't they just spam to me directly via my gmail account?

Let's think about this for a second... runescape is an online game like GW is an online game. This makes it seem very targeted to people who are likely to play online games. So, let's go after people who play online games and make them think they have a problem with their online game account so we can snag their info.

What's the saying... the simplest answer is most likely the correct one. If gmail had been hacked, not only would I be seeing the results on my own accounts, but also the 30+ thousand email accounts I monitor 24/7 would be getting hit right now. What you're describing is a wide spread problem and would be all over the news (at the very least on slashdot). And if you've really got a rouge server out there, why bother with spam? Why not go after credit card numbers, banking accounts and the like? No, I'm sticking with Occam's Razor.

cosyfiep

cosyfiep

are we there yet?

Join Date: Dec 2005

in a land far far away

guild? I am supposed to have a guild?

Rt/

14 Mar 2013 at 00:52 - 11
they are not looking for that kind of information to start with, they just want to get their 'phishes' out there--and find out if the addresses are real ones.
Have you checked with other gmail users to see if other gmail accounts have been doing this as well???? Were you aware of the yahoo incident back in November? (it was also doing things like runescape and diablo 3, not to mention that these are also quite popular to send like cialis and russian ladies). I have multiple public emails as well and NONE of them were doing this either, so it is possible that the phishers just got lucky with one of their bogus return addresses.
It is more likely since no one else here has had that kind of problem to look at the much much bigger fish than the small one.
The simplest answer is gmail NOT guru.

Kvinna

Kvinna

Administrator

Join Date: Aug 2009

14 Mar 2013 at 17:02 - 12
Hey everyone, Guru hasn't been compromised. However, if you were around last August, we were and we notified everyone of that. If we ever find ourselves in that situation again, and I hope we don't, we will definitely let you guys know. We're not going to hide something like that from you.

With that said, please make sure that your forum password is different from any email or game account (same with any forum - unfortunately we are not the only ones that had been compromised last year).

Bristlebane

Bristlebane

Desert Nomad

Join Date: Jan 2008

Mo/

14 Mar 2013 at 18:02 - 13
1. Unless many many more guru members come forward saying they received the exact same emails, it's highly unlikely they managed to get hold of your email from guru itself.

2. Now if they did get it from Guru, it's much more likely the phishing emails would have targeted Guild Wars directly and not online game in general.