WebMail accounts are a popular target for malicious hackers, law enforcement conducting investigations, and rouge insiders. WebMail security is very important, perhaps even more so than your online bank account. If your WebMail is hacked, every web-account associated to that address (using send-an-email-forgot-password-system) could be compromised, including your bank. Phishing scams, password brute-force attacks, cross-site scripting exploits, and insufficient authorization vulnerabilities are all commonplace. And for the most part these attempts are impossible for normal users to detect or do anything about. The problem is that unless your password changed without our knowledge, how can you tell if your account has been compromised? Fortunately there is a fairly simple way.
Normally when someone compromises a WebMail account they’ll pilfer through all your messages and save anything they’re interested in keeping. Unless the intruder is really dumb, and sometimes they are, they’ll change all the messages back to unread (bold) so you won’t notice their presence. What you can do ahead of time is set a kind of a virtual silent alarm on your account. Here’s how:
1) Upload a tiny image somewhere online where you can see the logs of who accesses it. There are a lot of places that offer web space, could come with your DSL provider, or a friend that might have some to share. Once uploaded, NEVER share out the URL to the image. Hide is well because no one should ever find it online by accident.
2) Send your WebMail account an email, containing the silent alarm image, with a juicy sounding subject line like “Your new online Bank password”, “Re: employee personnel files”, or “That’s it, we’re through!!!”. Anything an intruder wouldn’t be able to resist reading. Leave the email as unread in your inbox. This is your silent alarm email.
3) Hopefully this day will never come, but if an intruder were to ever break into your account and read your silent alarm email, they’re browser will unknowingly request the embedded image. By periodically checking the image logs, if it ever has activity, you’ll know something is up. The web server logs will contain the intruders IP address as well as the date/time of when they broken in and read the message.
Simple. This same process can also be used to protect your MySpace account through the messaging system. Enjoy!