4 ms·

The forged cookie attack was used on a limited number of accounts, by a state sponsored actor. Going to this amount of effort and then sending spam would be on

by dsl 10y ago

The forged cookie attack was used on a limited number of accounts, by a state sponsored actor. Going to this amount of effort and then sending spam would be on par with breaking into a bank just to steal the printer paper from the office. Most likely either: 1) you were phished and didn't realize it 2) logged in to your Yahoo account from a device that had malware on it

joering2 10y ago
> just to steal the printer paper from the office Or stealing $6,000 with $100,000 gun :) http://www.fenrir.com/free_stuff/columns/callcops/ctc-436.htm http://www.fenrir.com/free_stuff/columns/callcops/ctc-436.ht...
alyandon 10y ago
I'm willing to accept that perhaps that was not how my account was compromised but the time frame when this happened was well in line for when this breach supposedly occurred. Regardless, it was some sort of automated spam/phishing emails that were sent from Yahoo's network using my account to contacts on my list. I analyzed the headers of multiple bounced messages that were sent to email addresses no longer in use and confirmed the origin of the traffic. I'm not going to fall for a phishing attack and I only access email from devices I personally control. Could one of them had some sort of malware infection? I guess it is possible but I am security conscious and it is highly unlikely. I also would expect a hacker that has compromised one of my devices would be far more interested in using my banking credentials than using my Yahoo account to send spam.
- mike_hearn 10y ago
  You reused the password on other websites, I'm guessing. Especially likely if it was a strong (i.e. hard to memorise) password. The bulk hacking attacks that began around Spring 2010 hit all the big webmail providers. The source of the passwords was always, without fail, reversed hashes from breakins at other big websites: https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-against-account.html https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-... Source: was a tech lead on the Google anti-hijacking team during this period.
  - alyandon 10y ago
    Nope, not password re-use either. I learned that lesson the hard way over a decade ago. Regardless, it's something that has always continued to eat at me since I can't say for certain how it happened.

by dsl 10y ago

joering2 10y ago

> just to steal the printer paper from the office Or stealing $6,000 with $100,000 gun :) http://www.fenrir.com/free_stuff/columns/callcops/ctc-436.htm http://www.fenrir.com/free_stuff/columns/callcops/ctc-436.ht...

alyandon 10y ago

I'm willing to accept that perhaps that was not how my account was compromised but the time frame when this happened was well in line for when this breach supposedly occurred. Regardless, it was some sort of automated spam/phishing emails that were sent from Yahoo's network using my account to contacts on my list. I analyzed the headers of multiple bounced messages that were sent to email addresses no longer in use and confirmed the origin of the traffic. I'm not going to fall for a phishing attack and I only access email from devices I personally control. Could one of them had some sort of malware infection? I guess it is possible but I am security conscious and it is highly unlikely. I also would expect a hacker that has compromised one of my devices would be far more interested in using my banking credentials than using my Yahoo account to send spam.

mike_hearn 10y ago
You reused the password on other websites, I'm guessing. Especially likely if it was a strong (i.e. hard to memorise) password. The bulk hacking attacks that began around Spring 2010 hit all the big webmail providers. The source of the passwords was always, without fail, reversed hashes from breakins at other big websites: https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-against-account.html https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-... Source: was a tech lead on the Google anti-hijacking team during this period.
- alyandon 10y ago
  Nope, not password re-use either. I learned that lesson the hard way over a decade ago. Regardless, it's something that has always continued to eat at me since I can't say for certain how it happened.