Go Back and Forth Fast in Preview
If you're reading a PDF in Apple's Preview software, and you follow a bookmark or an internal link to move around within the PDF, you can quickly return to where you were by pressing the keyboard shortcut Command-[ (that's Command-Left Bracket). Or, you can choose Go > Back.
The command works iteratively, so you can go back to just the previously viewed page or if you issue the command again, to the page before that, and so on. There's also an equivalent Go > Forward (Command-]).
Written by
Tonya Engst
Recent TidBITS Talk Discussions
- Alternatives to MobileMe for syncing calendars between iPad/Mac (1 message)
- Free anti-virus for the Mac (20 messages)
- iTunes 10 syncing iPod Touch 4.1 (2 messages)
- Thoughts about Ping (16 messages)
Published in TidBITS 1033.
Subscribe to our weekly email edition.
- AT&T Makes Eligibility Transfer Process Clearer
- HTTPS Everywhere Enables Easy Encryption
- DealBITS Discount: Save 20% on TextExpander 3
- Looking Inside the iPhone 4
- Two Ways to Delete Lots of iPhone Photos
- Google Voice Opens to All Americans
- iOS 4: Essential Early Reading
- Roundup of iPhone 4 Early Reviews
- iBooks 1.1 Adds PDF Support, Runs on All iOS Devices
- TidBITS Watchlist: Notable Software Updates for 28 June 2010
- ExtraBITS for 28 June 2010
Change Your Passwords: Email Account Hacking on the Rise
In the past month or so, I've received a number of spam messages from people with whom I've had previous email correspondence. (I noticed these because Gmail is less likely to mark messages as spam when they come from someone with whom I've already exchanged email.) What's unusual is that these spam messages were not spoofed to appear as though they came from my acquaintances; the messages actually did originate from the listed accounts and were sent to people in those accounts' address books.
Tracing backwards through the Received headers in each of the messages reveals that this is indeed the case; messages that purport to have come from a user's Gmail account really did originate from within Gmail. I've seen several of these spam messages from Gmail accounts, several from AOL accounts, and a few from an MSN account. Most of the ones I saw were simple links to pharmaceutical sites. Also common is a particular type of spam sent from a friend's account asking for immediate financial help after a wallet theft while travelling in London - though poorly written, it's just believable enough to fool some people.
The Received headers, along with the fact that the To lines contain alphabetized addresses that come from someone's address book, indicate to me that the accounts in question have been hacked in some way, that the bad guys are actually logging in to the victims' accounts and sending mail. Plus, although I haven't received any of this sort of spam from any MobileMe or Yahoo Mail subscribers personally, I know people who have experienced their MobileMe and Yahoo accounts being hacked and used to send spam.
What You Can Do -- To reduce the likelihood of this happening, or the damage if it does, here are a few suggestions.
Most importantly, if you use one of the major email services with a Web-based client (Gmail, MobileMe, AOL, MSN, Hotmail, Yahoo Mail, etc.), change the account's password immediately. That may not be sufficient, depending on how the accounts are being hacked, but it's worth doing.
When you change the password, make sure it's a strong one that includes letters, numbers, and punctuation if possible (not all sites allow punctuation). To see if a password is strong, open Apple's Keychain Access application from your Utilities folder, choose File > New Password Item, and watch the strength indicator as you type your password. If you can't think of a good password, click the key button to open the Password Assistant, which will create strong passwords for you. For much more information about passwords, read Joe Kissell's "Take Control of Passwords in Mac OS X, Second Edition."
Don't use the same password on multiple large sites that contain personal information. If a spammer were able to come by your information in a large number of Facebook usernames and passwords, for instance, you wouldn't want them to use that information to compromise your accounts at Gmail, Amazon.com, and Citibank. (Facebook hacking is believed to be one of the ways email account passwords were acquired.) For the ultimate in security, though it increases your reliance on a single program, try a utility like 1Password that can create individualized strong passwords for every site you access, and then enter them for you (since you'll stand no chance of remembering any of them).
Remember that certain passwords, like those for Gmail, Twitter, and Facebook, are used by ancillary Web services like dlvr.it, Mac programs like TweetDeck, and iOS apps like Twitterrific. Once you change the main password, certain things may break until you update the password everywhere else too.
Whenever possible, and particularly when you're accessing the Internet via a Wi-Fi hotspot or other public connection, use secure connections (or a VPN!) if possible (look for https in the address field). If you're using Firefox, try the EFF's new HTTPS Everywhere extension (see "HTTPS Everywhere Enables Easy Encryption," 18 June 2010). For more details and real-world advice about securing connections, see "Take Control of Your Wi-Fi Security," which I co-authored with Glenn Fleishman.
If your email provider allows forwarding of mail to another account, check those settings! Scan your filters as well, if they could be used to forward mail automatically too. The London scammers rely on email forwarding so they can remain undetected even if you continue to use your account. More generally, although it seems unlikely, a bad guy could use forwarding to siphon copies of all your messages to another account for scanning. In one case of a MobileMe account being hacked, the scammers were not only forwarding email from it, but had also changed the password and all the security questions.
Be careful what you put in email - random bad guys aren't likely to do anything with information about your life, but passwords, bank account numbers, credit card numbers, and the like could be extracted automatically.
Prepare for the possibility that your account could be hacked by figuring out ahead of time who you can contact and how to respond. For instance, if you use Gmail, pre-configure a mobile phone number at which you can receive a verification text message to re-enable a temporarily disabled account (more on why that might happen shortly). And if you use MobileMe, note that although there's no phone support, there is live chat support.
Use Apple Mail or another POP or IMAP client, if possible, to keep a local copy of all your mail. If someone can send spam from your account, they could also delete all your stored mail, though vandalism is the only reason to do that. If you're saving a local copy via IMAP, back up that local IMAP store, since an IMAP client would likely delete its archive if all the remote messages were deleted.
Escalating Warfare and Collateral Damage -- I now believe that at least Google is increasing security based on these events. Within the last two weeks, a number of people, including Tonya and me, have had their Gmail accounts disabled temporarily by Google. We were each able to reactivate our accounts by receiving a verification code on our iPhones, entering it in Gmail, and then changing the passwords.
Working on a tip from a friend who had this happen to him as well, I went back through the email I'd sent in the previous 24 hours and found one message that Google could easily have seen as spammy - it was a single line of text followed by a URL and was sent to three recipients.
I assume that Google monitors outgoing mail for spam-like behavior, so if they had ratcheted up the sensitivity on that monitoring code to detect account hacking more quickly, that could explain why my account was disabled temporarily. (I have no evidence to indicate that my account was compromised or my password stolen.)
These sorts of problems are less likely to occur to smaller ISPs and email providers that aren't large targets like Apple, Google, Yahoo, and Microsoft. And if problems do occur, smaller companies are more likely to provide human support, which can be extremely comforting when an account has been compromised or disabled. Of course, the large email services offer many advantages too - life is full of tradeoffs.
A good deal of what I've said here is based on observation and conjecture, of course, but regardless, it's a good idea to change your passwords every so often. And if you have suffered from having your account hacked and know how it happened, please share your experiences in the comments!
![](/file/11593/db.tidbits.com.tar/db.tidbits.com/images/badges/dragondictatelockup_vertical_onlight.png)
Get the all-new Dragon Dictate for Mac from Nuance Communications
and experience Simply Smarter Speech Recognition.
Learn more about Dragon Dictate: <http://nuance.com/dragon/mac>
Sarah Palin likely wishes she had done that on Yahoo.
http://www.businessinsider.com/how-a-nigerian-scammer-hacked-our-gmail-account-2009-12
http://db.tidbits.com/article/11034
I'm feeling better about having all my mail forwarded to Google from an account on a machine I control. That way, should worst come to worst, I'd just turn off the forwarding and pick up mail locally.
It goes back to the 1600s (although Wikipedia currently only claims 1800s).
http://american.com/archive/2010/june-2010/thwarting-cyber-predicaments
My hypothesis is that they registered at some sleazy site and used the same username and password as their email account. The site owner could then capture their credentials and hack into their accounts.
The Facebook hypothesis, as Adam mentions, seems like another likely source of passwords. I'll find out if the four folks use the same passwords as their email accounts.
FYI one of the Yahoo spam messages I received originated in Brazil while another came from the US.
The scam artist not only used this man's password but used information included in his automatic signature to try to fool people. Also this message only implies the need for help and does not ask for money directly. Here is the message with the names changed. My gmail was also hacked 9 days ago with the drugstore
Subject: My Predicament!!!
I'm writing this with tears in my eyes, Sue and I came down here to London,England from Germany for a short vacation, unfortunately we were mugged at the park of the hotel where we stayed all cash,credit card and cell were stolen off us but luckily for us we still have our passports with us.
We've been to the embassy and the Police here but they're not helping issues at all and our flight leaves in less than 7hrs from now but we're having problems settling the hotel bills and the hotel manager won't let us leave until we settle the bills.
Am freaked out at the moment.
--
Jo & Sue Smith
------ Missionaries to Germany
I logged into my gmail account again and found it was disabled. I verified with a code creating a new password.
I thought it had something to do with that. Hmmm.