-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/21/2015 12:06 PM, I.Petrov wrote:

Hello,

The email is sent from an authenticated user, so he knows your username and password for webmail.roadrunner.com. Are you sure that these addresses are not in your web mail account ?

Regards, I. Petrov

Agreed. If as you surmise, someone has compromised his roadrunner account, the addresses might have been harvested from any old mails on roadrunner. Roadrunner appears to support imap, which means a great deal of mail could have been harvested from there. Obviously a password change at roadrunner is both important and too late. - -- After all is said and done, more is said than done. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlU2obcACgkQv7M3G5+2DLK4GwCdGYFcZNTiebswlqYsFwJn3JOu 7nQAoIzpMoh6bRVYA707noVRzHrkeyUO =7g39 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

web interface and use POP3/SMTP

So you believe that using pop leaves no emails on the server? This is not always the case. Especially when the mail is set up to allow access from more than one client. (Such as the web client AND your box). You might want to double check this. But if you COULD use the web interface if you chose to, its entirely possible that mail is retained on the server. Being POP does not automatically assure you that mail is deleted. -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Tue, Apr 21, 2015 at 4:18 PM, Mark Hounschell wrote:

On 04/21/2015 04:09 PM, John Andersen wrote:

...

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

...

web interface and use POP3/SMTP

So you believe that using pop leaves no emails on the server? This is not always the case. Especially when the mail is set up to allow access from more than one client. (Such as the web client AND your box).

You might want to double check this. But if you COULD use the web interface if you chose to, its entirely possible that mail is retained on the server.

Being POP does not automatically assure you that mail is deleted.

Well, before I "get mail" I can log into the web interface and see the emails. Then after "getting mail" they are no longer there via the web interface. I suppose that's not to say they are not being held "somewhere"? As we all know, the US gov is sucking in everything on the wire these days. But it is those email addresses that really concern me. I can see no way for them to have been gathered via the web interface without several years of constant monitoring/collecting. As I said, a couple of them have not been used for 2-3 years.

And the sent folder at RR? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/21/2015 01:46 PM, Mark Hounschell wrote:

Ah, the sent folder. That was it. Every email on that list was found in an email in the sent folder. It only contained about 15 emails. Thank you so much for that suggestion. I was wondering if I was going to have to rebuild my Linux box there for a bit.

Now to figure out how they got my password. I can't even remember it. That's why I let Firefox remember it for me.

Thanks again ALL

Regards Mark

Roadrunner has a log in tracker facility that might help you figure out where / when it was hacked into. You might report it as well to their security people. Might I recommend a password vault. You aren't getting any younger and the mind is the second thing to go. -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2015-04-21 22:46, Mark Hounschell wrote:

Ah, the sent folder. That was it. Every email on that list was found in an email in the sent folder. It only contained about 15 emails. Thank you so much for that suggestion. I was wondering if I was going to have to rebuild my Linux box there for a bit.

Now to figure out how they got my password. I can't even remember it. That's why I let Firefox remember it for me.

Maybe you used http instead of https. Also, many mail providers do not encrypt pop/imap/smtp connections, so they can be sniffed. Or you connected using a free wifi sometime... - -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlU2zIcACgkQja8UbcUWM1yEmAD/dDhA9XJZnvU0c1tGGV2K+1gm RSNkjoi687XnsC2YsukA/jA6bs5I2mLVS5ajAgdILXDs//THDhvSyANyzOkh3Y7u =8pYS -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Tue, 21 Apr 2015 22:18, Mark Hounschell wrote:

On 04/21/2015 04:09 PM, John Andersen wrote:

...

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

...

web interface and use POP3/SMTP

So you believe that using pop leaves no emails on the server? This is not always the case. Especially when the mail is set up to allow access from more than one client. (Such as the web client AND your box).

You might want to double check this. But if you COULD use the web interface if you chose to, its entirely possible that mail is retained on the server.

Being POP does not automatically assure you that mail is deleted.

Well, before I "get mail" I can log into the web interface and see the emails. Then after "getting mail" they are no longer there via the web interface. I suppose that's not to say they are not being held "somewhere"? As we all know, the US gov is sucking in everything on the wire these days. But it is those email addresses that really concern me. I can see no way for them to have been gathered via the web interface without several years of constant monitoring/collecting. As I said, a couple of them have not been used for 2-3 years.

Mark

In the web interface, check the "addressbook" / "contacts", some ISP do a automatic collection of addresses from the incoming mail, and check your "settings" / "preferences" in the web interface for such a collection. And, even if it is "too late", change your password for the mail-service. - Yamaban -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/21/2015 01:19 PM, Greg Freemyer wrote:

On Tue, Apr 21, 2015 at 4:09 PM, John Andersen wrote:

...

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

...

web interface and use POP3/SMTP

So you believe that using pop leaves no emails on the server? This is not always the case. Especially when the mail is set up to allow access from more than one client. (Such as the web client AND your box).

You might want to double check this. But if you COULD use the web interface if you chose to, its entirely possible that mail is retained on the server.

Being POP does not automatically assure you that mail is deleted.

More importantly, pop does NOTHING to remove emails from the sent folder of the server.

Make sure you don't have years of emails sitting in there.

Greg

And: Google search points coughs up some hits: http://www.techsupportforum.com/forums/f138/road-runner-internet-storing-old... Lastly I have to ask, the OP: are you sure this email address you were concerned with existed ONLY on this Linux machine? Are you sure your address book hasn't been stored on another computer, an iphone or andorid phone? On on a Apple account? Have you, ever used Facebook and allowed it access to your address book on any computer of phone? Do you have any friends that might have that address in their phone books" True story: There are idiots in the world who choose to use facebook as their email addressbook, without realizing that Facebook will mine all of their addressbook entries and send those people "Facebook Invites". -- After all is said and done, more is said than done. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/21/2015 01:12 PM, John Andersen wrote:

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

...

Do Linux users now have to worry about browsing the web like Windows users do? I forgot to answer this bit.... The chances of you linux box being hacked is dramatically smaller than is the chance that roadrunner is hacked. Infinitesimally smaller in my opinion.

This might be a good topic: Has your Linux install ever been hacked? In my case, yes. Here are the particulars. SuSE 5.3, installed at home on a cable modem. The documentation at that time was partially in German, including the instructions for the host-based firewall. I figured I'd work on the firewall at some later date. Alas, someone hacked in using a mountd vuln (yes, I was running NFS). I noticed it when they renamed /etc/hosts.allow to /etc/host.allow. Another hack leveraged a vuln in ssh-1.2. This was in a corporate environment that lacked a firewall (it was a different time). This was in the late 1990's I think. A third time was only two years ago on a dedicated host at a remote noc. I'm not sure how they got in, ssh was the only open port. But I did just enable username/password logins so that the noc techs could do some maintenance, and I think that possibly someone guessed the root password or that one of the noc techs was hacked and had the password in a file on their own host. Yes, I was running sshguard too. I normally allow only ssh public-key authentication. Over the decades I've received LOTS of email (T-bird) and visited LOTS of web sites without any known issues. I wouldn't worry about it if one keeps their box up-to-date and runs behind a firewall. But has anyone ever been hacked through Flash, acroread, or Java? Any others? Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On April 21, 2015 4:41:51 PM EDT, Lew Wolfgang wrote:

...

On 04/21/2015 12:49 PM, Mark Hounschell wrote:

...

Do Linux users now have to worry about browsing the web like Windows users do? I forgot to answer this bit.... The chances of you linux box being hacked is dramatically smaller

On 04/21/2015 01:12 PM, John Andersen wrote: than is the chance that roadrunner

...

is hacked. Infinitesimally smaller in my opinion.

This might be a good topic: Has your Linux install ever been hacked?

In my case, yes. Here are the particulars.

SuSE 5.3, installed at home on a cable modem. The documentation at that time was partially in German, including the instructions for the host-based firewall. I figured I'd work on the firewall at some later date. Alas, someone hacked in using a mountd vuln (yes, I was running NFS). I noticed it when they renamed /etc/hosts.allow to /etc/host.allow.

Another hack leveraged a vuln in ssh-1.2. This was in a corporate environment that lacked a firewall (it was a different time). This was in the late 1990's I think.

A third time was only two years ago on a dedicated host at a remote noc. I'm not sure how they got in, ssh was the only open port. But I did just enable username/password logins so that the noc techs could do some maintenance, and I think that possibly someone guessed the root password or that one of the noc techs was hacked and had the password in a file on their own host. Yes, I was running sshguard too. I normally allow only ssh public-key authentication.

Over the decades I've received LOTS of email (T-bird) and visited LOTS of web sites without any known issues. I wouldn't worry about it if one keeps their box up-to-date and runs behind a firewall.

But has anyone ever been hacked through Flash, acroread, or Java? Any others?

Regards, Lew

I'm aware of at least 2 Macs being hacked the last few months. This is also common on Windows PCs I gather it is a combination of a drive by and social engineering. The user happens across a corrupted site from what I can tell and there machine starts to have issues. After a period of time (minutes to weeks) they get a pop up they advises they have a problem, please call xxx-xxx-xxxx for support and get the problem resolved. The "support" company has been Apple Support, McAfee, and once just a lesser known IT support company. Only "McAfee" employed a foreign helpdesk team when called. The others had typical American accents. The support people quickly say they can fix the issue but need remote access. Once granted who knows what they do. In all the cases I have helped with, after the remote access is granted the user is also asked for their credit card info to pay for the support. I don't know how the first part of the attack works, but at a minimum any decent web coder can pop up a dialog window saying you should call xxx-xxx-xxxx immediately to resolve issues with your computer. If this isn't happening with opensuse users, it is a testament to the awareness of our users, not the inherent security of Linux. Greg -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/22/2015 10:09 AM, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

On 2015-04-22 14:51, greg.freemyer@gmail.com wrote:

...

If this isn't happening with opensuse users, it is a testament to the awareness of our users, not the inherent security of Linux. Oh yes, it happened to me. At least they tried. :-)

But you see, they said that I had a problem in my Windows. I did not phone, they did. And I got no popup.

There were several strange things. One, they were speaking to me in English (bad English), and I live in Spain. They knew my name. And they did not know how to cope when I said that I had no Windows, but Linux. They insisted, so I hanged the phone.

(ie, their "staff" were not trained to cope with Linux systems)

Apparently, they had a list of Spanish phone subscribers with English names, and they phoned them. Many of those (I think) are folk that come to Spain for retirement, so they are old, supposedly easy prey.

They were phoning from India or thereabouts. I asked in the forum and they told me that it was a quite common occurrence, only that they were now going round Spain.

They tried me several times, then the calls stopped.

We mess with those stupid people. Tracie had one ready to get a technician to "fix" our tornado's. It was stormy day and there were tornado's about so she said we didn't have any windows but we had some bad tornado's, could they fix them. -- A cat is a puzzle with no solution. Cats are tiny little women in fur coats. When you get all full of yourself try giving orders to a cat. _ _... ..._ _ _._ ._ ..... ._.. ... .._ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 22.04.2015 um 17:09 schrieb Carlos E. R.:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

On 2015-04-22 14:51, greg.freemyer@gmail.com wrote:

...

If this isn't happening with opensuse users, it is a testament to the awareness of our users, not the inherent security of Linux.

Oh yes, it happened to me. At least they tried. :-)

But you see, they said that I had a problem in my Windows. I did not phone, they did. And I got no popup.

There were several strange things. One, they were speaking to me in English (bad English), and I live in Spain. They knew my name. And they did not know how to cope when I said that I had no Windows, but Linux. They insisted, so I hanged the phone.

(ie, their "staff" were not trained to cope with Linux systems)

Apparently, they had a list of Spanish phone subscribers with English names, and they phoned them. Many of those (I think) are folk that come to Spain for retirement, so they are old, supposedly easy prey.

They were phoning from India or thereabouts. I asked in the forum and they told me that it was a quite common occurrence, only that they were now going round Spain.

They tried me several times, then the calls stopped.

This happened just a few weeks ago to a friend of my mama, in Switzerland. She was called from "Microsoft" and told, that she has more than 1000 viruses on her computer (which, b.t.w. seems average to me for a win pc that has run for more than 30 minutes...). They asked her for access data and ... she gave it! Next day her PC was unusable, everything deleted. Only then she realized that she had to change all her online passwords for banks etc., to her luck her accounts stayed untouched... My mother received an e-mail with an .exe-file (within a zip) and opened it, because the message said: we just charged your bank account for 2000 Swiss Francs. Because exe-files don't execute on her linux box, she called me desperate "But I had to click it, when they take so much money from my account!". ... I guess there are two generations that are easy to cheat: the elder ones who only use a PC that their children or grand children have installed for them, and the very young ones who do not have any idea what happens inside a box. They just touch their screens and think they are computer geniuses. -- Daniel Bauer photographer Basel Barcelona http://www.daniel-bauer.com room in Barcelona: https://www.airbnb.es/rooms/2416137 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 22.04.2015 um 21:48 schrieb John Andersen:

On 04/22/2015 09:23 AM, Daniel Bauer wrote:

...

I guess there are two generations that are easy to cheat: the elder ones who only use a PC that their children or grand children have installed for them, and the very young ones who do not have any idea what happens inside a box. They just touch their screens and think they are computer geniuses.

And neither one of those two groups should be running windows. I'm blaming you Daniel ;-)

Seriously, friends don't let naive friends run windows. And, the best thing you can do for these people is get them a Gmail account, because, whatever you think about Google in general, Gmail's spam filtering is close to perfect.

I take the blame on me... I tried, but I was not capable to convince the friends of my mother for Linux. You know, I'm the crazy artist, and so my computer must be crazy, too :-) -- Daniel Bauer photographer Basel Barcelona http://www.daniel-bauer.com room in Barcelona: https://www.airbnb.es/rooms/2416137 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2015-04-27 03:26, Patrick Shanahan wrote:

And you are not able to access email headers and "harvest" the same information?

No, they are addresses of people that do not post in this list. Private addresses of third parties. - -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlU9kv0ACgkQja8UbcUWM1zPhgD9F45Oo3X7owNvPsqW0ghVkZgA FQHoOKx3068JlrhYPv0A/3rpcgqBKcesPnVt4azoA3xwLUgtCpi6CnveG5V0d/0W =4Cup -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org