Hello Jel, Cherry and GP-UK,

On Thursday, January 25, 2007, at 11:44:22 PM, Jel wrote:

> Cherry Cullen wrote:
>> Daughter says she is happy with hotmail!

> Then you have neglected her education, or she is stubborn ;-)

>> She spoke to her boss today and explained that her PC was clean, boss didn't
>> look as though she believed her but is going to get someone to check her PC.

> Who, what, why where?

Indeed. From a security forensics point of view, ambiguity and dearth
of hard evidence make diagnosis difficult.

1. One email states daughter has a laptop; is this the PC mentioned in
other emails and the device from which daughter sent the original
email to "her charges mother"?

2. One email states "Not sure about her bosses PC but I suspect the
problem lies there". Is "her boss" the mother who was the recipient of
the original email? If not, why does Cherry suspect Bosses PC?

3. If "boss" and "charges mother" are one and the same, does "going to
get someone to check her PC" refer to boss/mother's PC?

Without the hard evidence, unless daughter has seen the offending mail
on recipient's PC with her own eyes I would place a question mark
against whether the offending email and the original email sent by
daughter are the same email. I am aware Cherry reports "When the
mother opened the email there were porn pictures along with the
pictures of the kid" but how reliable is the recipient's report; while
there may well be either a Hotmail vulnerability or PC/laptop trojan
that enables third party attachment insertion in a genuine hotmail
email item, it seems over complex. Remember originator addresses are
regularly forged and the way spam bots work it is not unusual to
receive spam purportedly from addresses familiar to you. One also has
to ask how the images were viewed by the recipient, i.e. were they
saved to hard drive and then viewed? If the genuine and offending
images were contained in the 'same' email, could it have been a
modified duplicate of the original email with genuine only images? The
latter question reflects the possibility of the Hotmail account being
compromised which doesn't necessarily mean daughters PC/laptop has
been compromised. However, does "Only daughter has access to her
laptop" really mean it is 'always in her physical possession', is
never left logged on unattended for even a few minutes and is password
protected (not foolproof but sufficient against 'non-technical
malicious' third parties)?

I would certainly focus on the recipient's PC given the checks that
have already been done; if she has opened an email containing "porn
pictures" or the mere fact that the images exist on her machine
however they arrived there, her machine should be thoroughly checked
anyway. The downside is that with today's root kit infections one can
never be 100 per cent sure a machine is clean without taking fairly
drastic measures! :-(

> If there is porn there that your daughter is unaware of, how will that help
> her?

> Robust approach needed, I think

> Jel
> (who once was asked to sort our some speed problems on a laptop and found
> it full of porn - that was not there by accident. Just felt a bit sad for
> the owner.)


--
 Chris Salter mailto:[log in to unmask]
 Lincolnshire Post-Polio Network http://www.lincolnshirepostpolio.org.uk/
 Polio and Post-Polio News http://mt.lincolnshirepostpolio.org.uk/pandppnews/