We keep getting ongoing reports from readers about spam being sent from legitimate Hotmail accounts. Like web mail systems in general, Hotmail accounts are targeted to be able to send spam from trusted sources. if an e-mail is received from a friend or relative, you are much more likely to open and read it.
These accounts are compromised via many ways, most commonly these days via phishing. The question always is if it is actually a compromised account, or just someone spoofing the From address.
Hotmail adds some characteristic headers that can be used to identify the source as hotmail. While they may be faked of course, the allow you to narrow down the chances of the account being compromised.
You should see a Received header from a hotmail.com host, using Microsoft SMTSVC. If the e-mail was posted via the web interface, you should also see an X-Oritinating-IP
I obfuscated the X-Originating header.
Next question we get: What to do if you find out your friends hotmail account was compromised? If your friend is lucky, all that happened was a phishing attack. Your friend only needs to change the password (and of course, all sites he uses the same password with). Worse case: Your friend is infected with malware that stole the password. Point the friend to some decent anti-malware detection, or if you are a real good friend, help with the cleanup.
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.