NOTE: I want to start by being clear: I'm not asking how to implement this, or how the code works, (if I did, I would be posting in stackoverflow). I'm asking about the high-level aspects of its behavior and how a power user might see it.
From a previous job, I have an account on Yahoo Mail by way of using Yahoo Instant Messenger. Periodically, I get email from my former co-workers in my Yahoo Mail, that are addressed as if from them, but are actually created by "fanbox.com".
I got curious about why this happens (usually in small clusters of 2 or 3 messages at a time), and what I found was essentially: They run a site where they send an email with a clickthrough that somehow copies all your addressbook email entries, and sends mail to them with the same message. There were some online discussions, which confirmed the general behavior, but provided few useful details.
What I'm wondering is things like:
1- Is their attack something that operates against specific web mail services, or is it something where they get user privs on your system, and could potentially copy any data source?
2- Is their attack exploiting specific browser behaviors and/or specific webmail services?
(In other words, can I solve the problem by abandoning specific browsers, webmail providors, or avoiding a specific combination).
3- Would getting the tricked users to delete me from their addressbook help? It seems that these individuals are relatively gullible, because this happens about once a year to them.
