Mysterious spam attack hits Virgin subscribers

Stewart Mitchell Read more November 22, 2011

Virgin Media customers say their email accounts have been hacked, but the company denies any security breach.

Mysterious spam attack hits Virgin subscribers

Virgin users are reporting spam email is being sent from their email address to contacts in their webmail inboxes.

“Somebody has hacked the contacts in the webmail system and the first I knew about it was when I got an email from my son saying he’d been spammed by me and it looked as if my account had been hacked,” said PC Pro reader Dave Forth, echoing concerns on a Virgin Media forum thread on the issue.

The first I knew about it was when I got an email from my son saying he’d been spammed by me and it looked as if my account had been hacked

“The people it was sent to matched precisely my webmail contacts list, which is different to the local contacts, so the list was definitely from there.”

However, Virgin doesn’t believe it’s been hacked, claiming the issue was part of a wider problem across the web. “It can’t really be a server-based issue as our servers are run by Google, as are lots of ISPs, and if our servers had been compromised then the whole farm would be compromised,” a spokesperson for the company told PC Pro.

“It appears to be specific to individual customers and is happening with other ISPs too,” the spokesperson said. “It seems to be quite pervasive.”

Change passwords

The company sent messages to some subscribers who had reported the issue, with Virgin saying it suspected the accounts’ passwords had been “brute force” attacked.

“There has been no breach of our mail servers,” the company said in a message sent to a user and posted on the support forum. “Passwords are hacked and cracked by spammers using brute force or dictionary attacks on soft passwords, and that happens to all users on all internet providers and this seems to be the case here.”

A Virgin support team member warned in a forum post that users should change their passwords.

“We would suggest that customers who believe their account has been used in this way to log in to ‘My Virgin Media’ and update their email password and security question,” the post read. “Customers should also run a full virus scan on the computer they normally use to access their email.”

However, the forum posters who had run tests all claimed their antivirus software had found no infection.

Passwords are hacked and cracked by spammers using brute force or dictionary attacks on soft passwords

Widespread issue?

Further investigation reveals similar issues are being reported by Gmail and Yahoo Mail users, with thousands of forum complaints about the issue over the last month.

According to Virgin, the issue might be caused by “a webpage that uses an authenticated cookied Gmail-style login to use Gmail to spam out to your contacts”.

Google said it hasn’t seen any real increase in spam attacks, and suggested the accounts could have been hacked via phishing attacks.

When PC Pro asked why so many people, including web-savvy readers, would have been hit by the same problem at the same time, the company said phishing attacks were getting more sophisticated and difficult to spot.

Information gap

While the details of the intrusion remain unclear, Forth and other posters hit by the spam attack criticised the lack of information coming from Virgin regarding the issue.

“I went to Virgin and they didn’t want to talk,” Forth said. “I filled in an email abuse form and got only an auto-response and have heard nothing since, while in the Virgin shop… they said it was nothing to do with us. There’s been very little information.”