InBox

Q: Craig had several items listed on Trade Me, but started receiving comments saying his auction had been hacked. Sure enough, he discovered he was selling all sorts of weird illegal rubbish that he wouldn't normally have a bar of. He wants to know why people do this, how it happened, and what he can do to prevent it.

A: Financial gain is a common motive, but mostly it's just a sick challenge.

Like a dog at a lamp post, these hackers want to put their mark on someone else's property. With their toolbox of tricks, they usually fool users into handing over account information.

Among these tricks is bogus email that links to a clone site that swallows the user's login and password. There are also Trojans, which send account information back to the criminal, and password crackers that log into a site until they hit the jackpot - a ploy easily negated by administration policies that lock accounts after several failed attempts.

By hacking the user's email account, a password can be requested, which is in turn sent back to that email box. Hackers can also acquire website password files, although this is less common now.

Many years ago, ihug learned the dangers of allowing its password file to reach the wrong hands - the result was a major volume of hacked accounts, as one by one the passwords were cracked from the encrypted file.

You can't help website security, but you can minimise yourself as the information source.

Never follow email links - use your own Favourites link to enter Trade Me. Change your Trade Me password regularly - daily when an attack is on.

Keep your wits about you, run anti-virus, anti-spyware and firewall software and you reduce the risk substantially.

Q: Lucy has been getting "Mail System Error - Returned Mail" messages off and on recently. She's worried because she hasn't sent any of these emails out, and she wonders if she has a virus.

A: It's possible, but unlikely. Either a virus is masquerading as the email address or the mail server that bounced it.

Delete it without opening the attachment then re-run your virus scanner for peace of mind.