Spam on my email address soley used here.

I have just received Spam on the email address used in here only, the email address doesn’t exist as its a forward address to a collection address, it has never, and cannot be used to send mail. Therefore the weak link is this forum. So perhaps Avast exec or website manager would care to explain this.

I say again, this is an email address that is a forwarder only, has never cannot be used to send mail. This is done for the specific purpose of knowing where a weak link is when Spam is received on a given email address. I do not allow other users to contact me in this forums.

I attach the Spam email in raw form for your perusal. I am not impressed!

exocet,

I got the same spam email (also sent to a forum unique address), I already posted about this in another thread.

I’d suggest you change your forum email address (and disable your current one), especially since your attachment includes your forum address for anyone to download and see.

Thank you, I did that already before I even posted, I run a forums using the same core software this forum uses.

You can check out this post on my forums by clicking here.

Now we will see how long it takes before my new email forwarder unique to this forum gets breached.

This has nothing to do with avast. I have the same spam on a reserved email address that has never been used anywhere at avast.

The same complaint has been seen of late on several forums I use and people automatically think it MUST be the sites fault. Fact is spam can be sent to domains where no email account has ever been set up, I have 3 domains where the mail system has never been used, BOTS however are programmed to locate domains and find a usable name to forward their junk and crap is received.

That may well be true but my domain has had no bots probe email addresses, I cannot say too much but I will know instantly if an email address received a probe, again it is not an email address its a trap for a forward.

That’s all I’m saying, only one other forums leaked my email and others but that was down to and idiot admin who decided to reveal email addresses. But this is not probed as it doesn’t exist and cannot respond to a mail request.

Both exocet and I received identical emails to our avast! forum only email addresses on the same night. And the same night, the user Stalka (who started a similar thread) also received spam to his avast forum only address (I don’t know the content’s of Stalka’s email, so I can’t confirm if it’s identical or not). The only place my email could have been detected is from the avast! forum. The domain is used solely for email, and the email addresses used are not stored there (they are primarily unique addresses for various uses - forums, merchant sites, etc.). And I have also not received the same spam to any other email address - only to my avast! forum one. To me this clearly points to someone/thing having access to the forum’s email list.

Now given the topic of the spam, I’m sure a lot of people may have this automatically blocked by their ISPs, so they may never know if they received one. But I predict that more forum users will be soon be posting messages similar to the ones exocet and I have posted.

I also have received spam emails (not related to antivirus products, either) from the email address I use ONLY for this forum. I believe I may also have received spam emails to the email address I use for my Avast account itself.

Not very encouraging for a security company, huh?

  • Tim

I have my own domain, and specifically tag each email address I supply with the name of the party to whom I am supplying it. A “dictionary attack” spam (where they try many addresses at a given domain) wouldn’t be likely to generate these specific strings that are ONLY provided to certain parties (forums or other accounts).

This has happened with even big-name companies - for example, I provided the Wall Street Journal and United Airlines with special tagged emails that only they had, and I received spam on them.

Happily, I have received spam on these tagged emails rarely, so they are likely instances of employees of the companies stealing the mailing lists, the companies themselves having an internal policy of selling them, or third party hackers getting hold of the user databases.

Man-in-the-middle attacks can happen (capturing packets, capturing routed emails, etc.), but I would be seeing a LOT more spam on these tagged emails if that were happening frequently, so I tend to hold the people I gave the email address to (eg. this forum, etc.) accountable for its lack of security.

  • Tim

I have also received today 2 spam messages to my email account that was used for registration to this forum in 2009.
The email address is not used anywhere else and so it identifies Avast forums as the source.
I would like to know if Avast sells email address lists to 3rd parties. As has been said before, this is not impressive !!!

  1. I can’t confirm the reports posted here…!!!
    I had a look at my mails, on my local spam folder and even on my ISP’s spam folder. Nothing related there.
  2. Certainly not…!!!

I too have received 3 spam emails within the past day or so to an email address used to register with Avast in 2007 and later used to register with this forum, but not used for any other purpose.

Means absolutely nothing

How would you know?

BTW, 2 emails this morning to the address I only use here, both marked as spam but the sender must be known to the AV I use coz they both got flagged as phishing attempt as well.

@ exocet
I have received spam on address that haven’t even been used anywhere before (just created).

But what doesn’t help is the attachment you have posted has your email address in it, so I would suggest you remove the attachment.

These are publicly available forums that no doubt email harvester bots would scan, so another area is your email address showing in public (forum profile settings, Allow users to email me), if it was even for a limited time that too could be a source. But your settings currently don’t allow that so there is no email icon displayed (only you and moderators can see the email icon).

That said the new forum software doesn’t directly display your email address, but it could potentially be harvested, if you have the Allow users to email me, it could be manually harvested.

Well, that’s my personal experience. :stuck_out_tongue:
If I should get such mails in the future, I’ll let you know.

Me too, today.

I imagine the problem is nothing to do with Avast itself but with the forum software. Many forum coders (and CMS website coders) are ostriches with their heads firmly stuck in buckets of sand when it comes to the issue of address harvesting.

http://spamwise.org has some tools which can help locate such vulns.

I can say on behalf of AVAST Software, that we are not selling any e-mail addresses and that we are running the latest available version of the forum software.

  1. Nice PR reply to something that was never stated (selling email addresses), it has been clearly stated Phishing and email harvesting is the cause, if you care to read the original comments you would know this, or perhaps your reply is a deliberate deflection. If I sound hostile it is because of lack of care over this security issue.

  2. My profile has been set to never show email or anyone to contact me except the admin.

  3. The latest Version is far from immune form spammers and harvesters, it is the added security issues and diligence by the webmaster that prevents this. I have vast long term experience with Simple Machines Software. It would be safe to say I know this software inside out and to use the term “we are running the latest available version of the forum software” is no comfort as not only are you hiding the version number but the latest software is not safe enough on its own to combat Spam.

This is a subject I am passionate about, the security of my users on my forums (also the very latest available), but if you knew the additions put in place and the education the moderators have received, my users personal information is obviously more secure than here.

Re 1. you may not have mentioned it, but DPAvaster certainly did in Reply #8.

One of the things my own company thrives on is, “what we do about your problem/query” what I have constantly said to others companies, “Its not the fact its broken that will impress or anger me, its what you do about it that will impress or anger me”.

So far I’m not impressed.

As an aside

The Spamwise site get a 403 from my website and an error 22 on their error system (whatever that is), I looked for their meaning of error 22 and gave up after a few clicks looking for its meaning. However http error code 403 is a “forbidden request”, this means even if the request was a legitimate probe/request it was denied by the server (my domain).

Yes the software is responsible for the security issues, but Avast are responsible for the control and security of the software and the impact it has on its users. The blame and burden of responsibility falls firmly on their shoulder of Avast.

So perhaps I should have been clearer in the first instance, so here goes. You have a security breach on your forums, I and others are receiving Spam gleaned from addresses on these forums, what are you going to do about it?

Hmmm, I just looked, and there is a “lonely girl” trying to contact me in my gmail SPAM folder.

It no 100% confirmation or anything, since I do not have a separate email for every purpose. But the law of coincidence can only stretch so far.

::slight_smile: It has not even been 24 hours, did you expect a klaxon alarm, with a full armed response?

Avast! does not make SMF, so apart from the responsibility of running the latest version, how does the any blame fall to them? Now, if this continues, then you might have something.