Just a note to let any of our members that use Yahoo, please check out this site:
http://thenextweb.com/insider/2013/01/31/yahoo-mail-users-still-seeing-accounts-hacked-via-xss-exploit-amid-reports-yahoo-failed-to-fix-old-flaw/
In the last few days I have received a couple weird messages from people with Yahoo Accounts that have not actually been sent by the holders of those accounts and one of them is a forum member.
All Yahoo A/C holders should check their yahoo login details or their activity record, and if they find events happening that they didn't initiate, then their accounts have most likely been hacked.
Hacking of your email accounts can be made more difficult by changing your password so that it includes alpha, numeric and special characters such as: abcd1234*%!#
Similar events have happened in the past and Yahoo had advised that the problem had been rectified, but it seems that it has not been 100% fixed.
The hacked accounts do not appear to have been used for malicious purposes, but the hackers are using them to send out Spam.
I don't use Yahoo, and don't ever plan to, but if any members who currently do use it decide to change to another provider for their email service, please don't forget to let the Admin here know your new email address.
Nancy,
I used to have a Yahoo address,which I abandoned as a result of spammers hijacking it to spam some of those who were on my address list.
Gmail addresses are next to impossible to hack into.
Aidan.
Yahoo has had major security problems since they rolled out their new look mail system a couple of years ago. They keep claiming to have fixed the problems, yet that is not the case. Reports are that their servers have been hacked at least once, and millions of accounts compromised, without any action by the account holders. That makes simply having a yahoo account a risk, let alone using it. Its also worth noting that not just yahoo accounts, but all their affiliates are affected. If its hosted by yahoo, its at risk of being compromised.
Aidan's advice is sound. Of the available free email services, Gmail stands head and shoulders above the rest, at least for now. Apple's iCloud accounts are also sound, but only available to iOS 5+ or OSX 7+ users. Hotmail is a bad idea for other reasons, particularly the way they read incoming emails and reject them arbitrarily without notifying the recipient.
Here's a month-old timeline from thenextweb:
---
For reference, here’s the timeline of events up until today (2013-Mar-06):
On January 7, a lone hacker by the name of Shahin Ramezany uploaded a video to YouTube demonstrating how to compromise a Yahoo account by leveraging a DOM-based cross-site scripting (XSS) vulnerability exploitable in all major browsers. The same day, Yahoo got back to TNW with two statements, first saying it was investigating and secondly confirming it fixed the flaw.
On January 8, researchers from Offensive Security let TNW know they had discovered that the vulnerability is still present, demonstrating a workaround showing they can still exploit the flaw in question.
On January 11, Yahoo issued a third statement to TNW: “The cross-site scripting vulnerability that we identified on Friday was fixed the same day. We can confirm that we’ve now fixed the vulnerability on all versions of the site.â€
On January 28 and January 30, two Yahoo users contacted TNW to say their account was compromised via what they believed was the same way that was described in our previous articles.
On January 31, we followed up with a story regarding a known flaw in the SWF Uploader component of Yahoo’s developer blog as pointed out by Bitdefender Labs. Yahoo says it fixed this flaw and recommended affected users change their passwords.
On February 25, February 27, March 1, and March 4 we received more emails from Yahoo users saying their accounts had been compromised.