Q: Somehow everyone on my e-mail list has received a spam message with a link to a Viagra ad -- and the e-mail looks like it came from me. I also got one that looks like it came from a friend of mine.
I was notified a couple of weeks ago that Epsilon had a security breach. Could the two events be related? How can I avoid this problem in the future?
MARCIA TRUITT,
PEMBROKE PINES, FLA.
A: Yes, this could be a result of having your e-mail address stolen from Epsilon, an e-mail outsourcing firm used by top retailers and banks. Anyone who has your e-mail address could subject you to a "dictionary attack" or a "viral inviter" attack.
If you've used a real English word as your password, a dictionary attack can identify it by rapidly trying every word in the dictionary. Once someone has your password, they can use your account to send e-mail.
A "viral inviter" attack makes use of the fact that some social media sites allow you to import your e-mail contacts into the social media site's friends list.
For example, take a look at www.facebook.com/find-friends. A hacker who knows your e-mail address can e-mail you a phony Facebook page that looks like this one. If you fill in your e-mail address and password, your contact list will be uploaded to the hacker's website. The hacker can then fake your e-mail address on junk e-mail that's sent to your contacts.
