[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On 27/03/13 23:52, bad apple wrote: > > So, WTF? A lot of it around. So as discussed the password was strong, you only use it via a mail client, I'm assuming the password is encrypted over the link, and stored hashed (surely), and even a weak hash on a strong password like that is going to be hard to crack, so probably not leakage of the hashed password. Since there has been active XSS attacks, one has to wonder if you were left logged in, seems unlikely. You are probably insanely paranoid enough to clear your cookies on browser closing, and even if not hopefully Yahoo have some protection against Cookie theft etc. So unless the Yahoo! certificate is compromised, and routing... Or someone is permanently inside Yahoo or Yahoo systems stealing bits... Maybe they simply don't have the password. There are similar reports elsewhere of long unused accounts being hijacked (although mine is so old it is de-activated). The emails I've seen are all sent via the webmail interface, maybe Yahoo WebMail simply has some bug that allows attacker to change some settings and send email as someone else. Since it looks like a botnet, presumably as long as it doesn't trigger Yahoo! security action they can poke around. Time to open a new Yahoo account with a new email address. And only send emails to myself :) http://thenextweb.com/insider/2013/03/06/despite-its-efforts-to-fix-vulnerabilities-yahoos-mail-users-continue-reporting-hacking-incidents/ -- The Mailing List for the Devon & Cornwall LUG http://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq