Tech Smarties... How are spammers getting my friends names?

[K_W]

Over the last year I have been getting a few spam emails a month with my friends names as the sender, but from email addys that are obviously not theirs, and whose email I don't even have in my email contacts.

The names of friends so far are not very generic like "Tim Wilson" or "Bob Martin", some are ethnic or unusual, like LaBelle, and some are hyphenated, but they are always correct.

Today, one came with my wife's maiden name as the sender. The only place she still has that name is on her Myspace, which has been lying dormant for years.

My email account isn't hacked or they would only be people from my email contacts or have a spoofed email address. My Google/android account mostly has first names, and my email address is not on my Facebook which is private anyway.

Where is this list of names being mined from?

 

[CTS]

More than likely it's your friends who have been compromised, could be a wide variety of things though honestly. Get a good AV and scan with Malwarebytes now and then.

 

[CTS]

More than likely it's your friends who have been compromised, could be a wide variety of things though honestly. Get a good AV and scan with Malwarebytes now and then. It's also possible it somehow tied your email address to your social networking some other way and is just pulling names from those. Setting your Facebook to private is entirely meaningless to the spam community by the way, it's like putting a no gun sign up, only the law abiding are affected.

 

[RobbyMaQ]

Agreed with above... or, their email provides selling data (which would be sad really). I get them a lot. It's likely not their real email addy, because if you reply to warn them, it would suck for them (spammer) to be tipped off.

 

[Grump01]

I think when I get these, the person they are supposedly from has clicked on a link in an email and that hijacks their contact list??????

 

[K_W]

Found it... Old Facebook exploit.

Spam from 'friends' is actually result of Facebook hole - CNET

 

[AngryRooster]

Find and close down all those old dormant accounts. Login and change all the information you can. Change your name, contacts, delete friends and posts, change user name. Start the process to close down the account. Closing an account is sometimes pretty hard to do. Facebook is like this. There is a difference between an account put on hold and a closed account. Get everything ready to close down then go to the change password section. Enter a ton of random garbage by slapping keys for a few seconds in a notepad file then copy/paste it into the password box. That will keep anyone from being able to reactivate the account and will force a new clean account if you ever decide to use that service again.

Find a good VPN and route your traffic through that to help keep things on your end private.

 

[bwframe]

Found it... Old Facebook exploit.

Spam from 'friends' is actually result of Facebook hole - CNET

Is this a reason I can use as to explain why I stay away from Facebook at least partially for security reasons?

 

[CountryBoy19]

I don't think it's just a facebook hole. Viruses and data-mining malware can also take this stuff and utilize it against you. Learn to recognize what your friends would send you and you can easily weed out the spam. IIRC, it's called "spoofing", they are "spoofing" your friends name to make it look like the email came from a trusted source. As to how they learned the name of that source it's difficult to say. Good AV programs are only the first step, closing old SM accounts is another, but the biggest step, IMHO, is using your head to determine (before you even click the email) if it's legit or not.

Would your friend send you an email with a subject of "Invoice attached - Immediate Attention Required"? I don't have any friends that would, their subject would be "Invoice we discussed on the phone" etc because I would have already talked to them on the phone prior to them sending an invoice...

 

[Jomibe]

This is where not having any friends finally pays off.

 

[RobbyMaQ]

Is this a reason I can use as to explain why I stay away from Facebook at least partially for security reasons?

Yes. and Indianapolis also.

 

[mom45]

Whenever I have gotten those messages, it has been from friends that play games on FB. I don't do games and I just move those messages to spam and contact the friend to let them know they have been hacked.

 

[ModernGunner]

Facebook has more leaks than a sieve.

The INsecurity of Facebook is a perfect, the most perfect, reason NOT to use Facebook for anything. Ever.