How worried should I be about a hacker?

[Nix]

Last Friday I tried to access my yahoo email account and it said that my password was incorrect. I never thought anything of it and reset the password. There were hundreds of emails in my inbox so I just deleted them and thought no more about it. Until this morning... I had to reset my password again this time there were over 3000 messages in my inbox mostly saying failed delivery attempt. When I went into the sent items some are from someone called John England wanting to give someone 15% of a treasure chest if they get help to get it out of Iraq the others are written in arabic.

With some help from my work's IT manager we found that someone elses email address was on my account and they've been informed every time I changed my password. They have since been deleted from my account and I have saved the relevant stuff in case it gets investigated. Do you think BT will investigate this fully (it's a BT yahoo account)? And should I be worried that I'll be held responsible for anything?

We've done a virus check and there's nothing on the machine - seems to be purely and email address hack.

Any thoughts and suggestions but mostly words of comfort would be appreciated.

Thanks

Nix

[knightengale]

Last Friday I tried to access my yahoo email account and it said that my password was incorrect. I never thought anything of it and reset the password. There were hundreds of emails in my inbox so I just deleted them and thought no more about it. Until this morning... I had to reset my password again this time there were over 3000 messages in my inbox mostly saying failed delivery attempt. When I went into the sent items some are from someone called John England wanting to give someone 15% of a treasure chest if they get help to get it out of Iraq the others are written in arabic.

With some help from my work's IT manager we found that someone elses email address was on my account and they've been informed every time I changed my password. They have since been deleted from my account and I have saved the relevant stuff in case it gets investigated. Do you think BT will investigate this fully (it's a BT yahoo account)? And should I be worried that I'll be held responsible for anything?

We've done a virus check and there's nothing on the machine - seems to be purely and email address hack.

Any thoughts and suggestions but mostly words of comfort would be appreciated.

Thanks

Nix

Nix,

From the sound of it i wouldnt be worried.
Although i would check if you have any other account that have simular passwords. Also how difficult is your password. i.e does it have numbers, letters, upper case and lower case etc? If not then it wasn't secure enough .
Also check if you have any type of confidenutal emails saved in the yahoo account. AS the user might have read them.. i,e if you saved an email with your bank account details etc.

Any questions let me know .

[Nix]

Thanks for your advice Knightengale! The password was ancient and was 6 letters and 2 numbers no upper case. Luckily I don't have anything relating to my bank account in my emails. The only emails containing passwords relate to the likes of Boots.com, Estee Lauder, and various other mail order websites. Should I worry about that?

Should I also consider changing my passwords with the likes of the bank etc?

Thanks again

Nix

[knightengale]

Thanks for your advice Knightengale! The password was ancient and was 6 letters and 2 numbers no upper case. Luckily I don't have anything relating to my bank account in my emails. The only emails containing passwords relate to the likes of Boots.com, Estee Lauder, and various other mail order websites. Should I worry about that?

Should I also consider changing my passwords with the likes of the bank etc?

Thanks again

Nix

With your boots.com etc account passwords where they saved in the email account? As if so. do these site save your bank / credit card details? If so i would change then too.

With your bank account how 'strong' is your password. i.e it should have some numbers, upper case and lower case in it.

It should also NOT be something like H0m3Town123 etc. As that could be easy to guess if someone knows you. Or even if the hacker checked if yu had a facebook page etc.. if you know what i mean.

Hope that doesn't sound to scary

[pmjd]

Just come across this article, which is probably how the hackers got a hold of your yahoo account. It's a security hole that has bee known for two years but yahoo have yet to fix it.

Basically the hacker can set up an automated way of constantly trying to access your account with lots of commonly used passwords, also called a dictionary attack. Because yahoo has no limit to the amount of times you can try and login with a bad password the hackers can keep going until they get the right one and you will be none the wiser until you try to login again.

The stronger password should help, also consider using another site for any emails with more sensitive info in them.

HTH,
Paul

[rtwwpad]

Also ensure you run a spyware checker on the system you use as well as a virus checker. Spyware isn't picked up by Virus scanners. AVG do a combined SPYware and AV scanner for free.

Strong passwords are good, substitutions are not good on words i.e.

ceroc123 - rubbish
c3r0clover - poor
1ltdwtPb-hisgibmm! - which is a passphrase is good - its a simple mnemonic - I Love to dance with that Phil bloke - he is so good it blows my mind! Dictionary or brute force attack isn't going to get to that.

Easily cracked passwords are happening as new threat came out about a year or so ago where Graphics card's GPU's can be sued to run the code, so they are about 1000 times faster.