Adesso basta!

Non se ne può più!

Ha rotto il c***o GMail stavolta! Ieri ho raggiunto un nuovo record personale: 30 messaggi di spam in una sola giornata nella casella di posta personale, quella che non uso mai se non per gli amici e per la posta importante.

Per un totale di 462 messaggi di spam in 30 giorni (poi li cancella in automatico..)! Per carità il 99% la riconosce in automatico e la mette direttamente nella cartella apposita, però...

Era nato come un servizio innovativo: tanto spazio, grafica bella, semplice e intuitiva, ma soprattutto la possibilità di scaricare la posta da tutti gli altri account sparsi per il web (eccetto hotmail ovviamente...)! Oltre altre chicche come la possibilità di avere un'infinità di altri indirizzi associati semplicemente inserendo il simbolo "+" al termine del nome utente, seguito da qualunque combinazioni di lettere o numeri, o aggiungendo/spostando il "." nel nome utente...

Non è concepibile che invece nella casella su yahoo, per intenderci quella fake che uso per iscrivermi a tutti i siti/forum possibili, per le newsletter, ecc. non arrivino più di 3/4 messaggi di spam al giorno...

La conclusione è una sola: bigGim vende i nostri account a peso d'oro a quelli che fanno spam, non ci si scappa! Questo tra l'altro spiegherebbe anche perché il filtro Spam funzioni così bene! O magari nel contratto di vendita è prevista una clausola che dice che in automatico le e-mail ricevute andranno nella cartella Spam. ;-P

Almeno ci desse metà degli introiti sulla vendita...

I started using Plaxo with a client over a year ago. It was how I originally accessed and made changes to her calendar, contacts and tasks. It was a simple login from my web browser and my entries were synced to her Outlook. If you do use Plaxo with a client, either they will need to do the download and install to their email client, or you will need to log in and do it for them. After the install, the software leads you through choices about syncing. For example, you can choose to sync only the calendar and not contacts, etc. There will be Plaxo icons appearing in Outlook after installation.

You're not limited to using Plaxo with just Outlook. Plaxo gives you the option to add "sync points" with Yahoo, Google, MSN, Windows Mail, Mobile and Outlook Express. It must be noted that these are all 1-way syncs. So this means if you are entering calendar updates, contacts or new tasks in, you'll need to enter them in Yahoo, Google, etc. Then, they will sync to Plaxo. See below for an excerpt from the Plaxo Help Site that explains how it handles Google:

Google Synchronization Limits
Currently, the Google sync point is a one-way sync. It can only read data and changes to the data from Google to Plaxo. Any changes on the Plaxo side will not reflect back to your Google address book.
In addition, we only support contact deletions and additions during the sync. Changes to existing contact records will not sync to your Plaxo account.

It also must be pointed out that the web mail apps mentioned above are the 1-way sync. Since Plaxo has a software download for Outlook, that is a 2-way sync. This means when you enter a new appointment from within Plaxo, it will sync with the linked Outlook account.

When setting up your sync points with your various web accounts, Plaxo does give you options on what to sync. For example, you can choose to only sync your calendar and nothing else. If you change your mind and decide to remove a sync point, there are no worries about deleting any information. It simply stops the sync.

If one of your Plaxo contacts updates their contact information, it silently communicates this to your Plaxo account and updates it - nice.

There is a Plaxo Premium service that offers some benefits. A new service added is the ability to sync (again only 1-way) from your LinkedIn contacts to Plaxo.

There are many other features and benefits from Plaxo, such as ability to see and send your picture with each email, see pictures of your contacts (if they've uploaded one), get reminders of people's birthdays and many more.

Plaxo also has a popular Pulse feature. This is Plaxo's social networking side of things. You see your contact's updates, blog postings, comments, etc. This can be delivered to your in-box, or you can view updates from the web.

Earlier this year Plaxo was acquired by Comcast. This gives me reason for pause, although they initially said privacy policies would not be changed, policies can be changed at any time. By choosing to be on-line and participating in a number of social networks, I have no expectation of being anonymous. Since Comcast is an information-collecting gorilla, digesting Plaxo just made it a bit bigger. To put that in perspective though, just mull over all the information Google has on all of us!

This weeks program: The lessons we can all learn about Web2.0 security from the Palin Yahoo Mail attack. We talk with The White Hat Security CTO, Jeremiah Grossman. Jeremiah is also a former Yahoo security executive. Plus, the latest security news.

–> Stream, subscribe or download Episode 19 - Listen or subscribe to the feed to automatically get the latest episode sent to you to your Google, Yahoo, iTunes, or other popular sites.

–>Tune into the show directly on iTunes, you can also subscribe to the program on iTunes.

This week’s show is sponsored by DeviceLock

Program Notes for Episode 19

News:

Conversation: Ira talks with Jeremiah Grossman about the lessons we can all learn about Web2.0 security from the Palin Yahoo Mail attack. Jeremiah is the founder and Chief Technology Officer of White Hat Security, and a formerly worked on Yahoo Mail security issues while at Yahoo. Be sure to read Jeremiah's blog posting for more on this topic.

Tra i file pubblicati c'erano cinque schermate della casella di posta gov.palin@yahoo.com, una rubrica indirizzi e due foto digitali della famiglia di Palin.

Quest'ultima è stata criticata per l'uso di indirizzi di posta elettronica privati per condurre l'attività dello stato. "Usare account privati per uso amministrativo o aziendale è incredibilmente dannoso", spiega Adam O'Donnell, director of emerging technologies di Cloudmark, società specializzata sulla sicurezza dei messaggi. "Esiste una ragione perché si ha un account ufficiale. E' in questo modo che si può applicare un gestione appropriata della sicurezza all'account".

Sono i diversi i modi in cui chi ha attaccato potrebbe avere ottenuto l'accesso a tale casella, spiega O'Donnell. Potrebbe avere semplicemente indovinato la password di Sarah Palin, oppure avuto sue informazioni personali sufficienti a indurre Yahoo ad azzerare la password. Un hacker più sofisticato potrebbe avere installato in qualche modo un software di key-logging sul computer della Palin o ottenuto le informazioni attraverso un attacco di phishing, continua l'esperto. Yahoo non ha commentato la cosa, spiegando che non si esprime su specifici account utente per questoni di privacy.

Se mai c'era ancora bisogno di una prova per dimostrare i rischi che si corrono ad affidarsi a servizi di mail esterni per condurre business o attività importanti, la notizia che questi hacker hanno violato l'account Yahoo di posta elettronica della candidata repubblicana alla vice presidenza americana, Sarah Palin, dovrebbe aver convinto tutti. Anche i più fiduciosi. E l'indirizzo gov.sarah@yahoo.com ormai appartiene al passato, essendo stato sospeso.

Eppure, non è da ieri che si legge e si sente di account di posta esterni violati, soprattutto i servizi webmail gratuiti, con tanto di contenuti esposti alla mercé di tutti. Alla faccia della privacy. La Palin non è stato il primo e non sarà probabilmente nemmeno l'ultimo dei politici americani a cadere in trappola. O in Rete.

Alcune aziende hanno deciso che l'economia di scala offerta da servizi come Gmail vale il rischio di affidare a terzi i sistemi e i server di posta elettronica, invece che mantenerli al proprio interno. Un rischio che, come dimostra il caso Palin, è molto alto, se alla fine si tratta di indovinare, o carpire, una password. E le procedure per il recupero delle password sono un'area dove il confine tra usabilità e sicurezza è spesso molto labile. A danno della sicurezza.

E' infatti provato che anche se un utente ha selezionato domande segrete non standard, questo non ferma per molto tempo un hacker determinato a violare l'account di posta. Soprattutto se il bersaglio è un personaggio pubblico di rilievo. Anche se il personaggio non è famoso, grazie ai siti di social networking e ai blog non è così impossibile risalire a informazioni personali che potrebbero condurre l'hacker alla scoperta della password corretta attraverso il meccanismo della domanda segreta.

Una volta che l'account è compromesso, sta tutto nell'hacker decidere cosa fare dopo. Qualcuno utilizza l'account violato per scoprire altre informazioni per arrivare a bersagli più grossi o, nel caso di dipendenti aziendali, a dati vitali per l'azienda. Altri utilizzano queste caselle per inviare spam o malware. Altri ancora ne diffondono i contenuti. Quale prospettiva è peggio?

Molte aziende cercano di bloccare l'accesso ai servizi di webmail dalle loro reti nel tentativo di limitare il rischio che i dipendenti spediscano dati sensibili attraverso canali non gestiti direttamente dall'IT aziendale. Ma spesso anche queste pratiche di risk management non bastano.

“Usare account privati esterni per uso amministrativo o aziendale è molto pericoloso", spiega Adam O'Donnell, director of emerging technologies di Cloudmark, società specializzata sulla sicurezza dei messaggi. "Esiste una ragione perché si ha un account ufficiale. E' in questo modo che si può applicare un gestione appropriata della sicurezza all'account".

E, come sempre, esistono anche delle semplici regole da seguire nella composizione della password, tipo evitare nomi di battesimo, date di nascita, nomi comuni di persone conosciute, di figli, di animali domestici. Non che la Palin abbia usato come password JohnSidneyMcCain36, ma non si sa mai...

fonte: Computerworld.it

According to Web traffic analysis companies (including Compete.com, comScore, Alexa Internet, Netcraft, and Nielsen Ratings), the domain yahoo.com attracted at least 1.575 billion visitors annually by 2008 according to a Compete.com study. The global network of Yahoo! websites receives 3.4 billion page views per day on average as of October 2007. It is the second most visited website in the U.S., and the most visited website in the world.

From Wikipedia, the free encyclopedia

Details describing how someone hacked into Sarah Palin's Yahoo Mail account emerged on Thursday, and it appears to have been done with little more than social engineering.

Since Tuesday, anonymous posters using a forum on the 4Chan.org Web site have been circulating password-protected zip files containing the contents of the now-deleted e-mail account once belonging to the Republican vice presidential candidate.

Like most Web account services, Yahoo Mail provides an option to reset or recover one's user name and password. What is unclear is how the account recovery was rerouted from the alternative e-mail address chosen by Palin to a secondary e-mail address.

When Yahoo Mail prompted for Palin's birthday, one poster said it took only 15 seconds on Wikipedia to answer that question. When it prompted for ZIP code, Wasilla, Ala., has only two ZIP Codes. As for Palin's personal security question "Where did you meet your spouse?" that did slow the process down. The poster claimed it took several tries but eventually hit upon the correct answer: Wasilla High.

Inkadentally, the leading suspect in the crack - I wouldn’t call it a hack, especially - is a college student named Mike Kernell.

He changed Palin’s password to “popcorn”. Whadda you think?

Die Hacker, die sich "Anonymous" nennen, haben aus dem E-Mail-Account gov.palin@yahoo.com mehrere persönliche Fotos, den Inhalt einiger Mails sowie Betreffzeilen und die E-Mail-Kontaktliste von Palin bei Wikileaks.org gepostet. Der Name "Anonymous" ist ein Sammelbegriff für anonyme Aktivitäten im Internet, zu denen sich die Teilnehmer meist spontan zusammenfinden. In den vergangenen Monaten machten sie durch Protestaktionen gegen Scientology von sich reden.

Zur Zeit ist Wikileaks wohl wegen Überlastung nicht erreichbar. Sensationelle Enthüllungen enthalten die noch einsehbaren Screenshots nicht. Verschiedene Mails in Palins vorgeblich privatem Yahoo-Account kamen von den Adressen ihrer Mitarbeiter, darunter der Entwurf eines Briefs an den kalifornischen Gouverneur Arnold Schwarzenegger. Einige der aufgelisteten Mails trugen aber die Buchstaben DPS, die Abkürzung für Alaskas Department of Public Safety, also der Behörde, in der sich "Troopergate" entfaltete: Palin soll dort einen ranghohen Mitarbeiter gefeuert haben, weil dieser nicht in ihrem Sinne gegen ihren Schwiegersohn vorgegangen sei.

weiterlesen bei heise-online

Quelle: heise.de

*Infographics: "The Gay Plot" shows the venn diagram of Out's Top 25 Gay Albums, Rolling Stone's Top 25 Greatest Albums and The Guardian's Top 25 Albums. Hint: The Velvet Underground. [tobs]

*Television: R. Kelly is a nutball. 19-year-old girls are inbounds, he reminds us via an interview with BET.

*Wi-fi: Zune owners get free wi-fi under the Golden Arches. I don't got to McDonald's and I don't own a Zune. I'm just telling you this so you don't think I only blog about shit I like. [medialoper]

*Reviews: Soulja Boy reviews the videogame Braid. New dances, videogame reviews – the man is indefatigable. And also, rich. And he has a lot of time on his hands.

*Internet stupidity: Rick Astley comments on rickrolling. [urlesque]

*E-mail: Sarah Palin uses Yahoo! mail. Weird? Also, I have it on good authority that she has a one-armed dentist. (Not kidding.) Related.

*Local: Husker Du's Bob Mould is working on his autobiography. Additionally, I am too lazy to figure out umlauts. [earfarm]

do you think I'm donkey?!

From: Yahoo Customer Care <torbrei@yahoo.com>
To: mailcenter@yahoo.com
Sent: Monday, September 15, 2008 20:46:04
Subject: Account Suspension.. Verify Your Account now. Message ID: 38402

Due to the congestion in all Yahoo users and removal of all unused Yahoo Accounts,Yahoo would be shutting down all unused accounts,You will have to confirm your E-mail by filling out your Login Info below after clicking the reply botton, Or your account will be suspended within 24 hours for security reasons.

UserName: ...................................

Password:........................................

Date Of Birth:  .........................................

Country Or Territory:...............................

After Following the instructions in the sheet,your account will not be interrupted and will continue as normal.Thanks for your attention to this request.We apologize for any inconvinience.

این ایمیل را امشب گرفتم،

یک هکر محترم با ادبیات خوبی پسورد ایمیلم را خواسته بود!

خیلی‌ها را دیدم توی یاهو مسنجر پیغام هایی را برای تمام دوستانشون می‌فرستن تا آیدیشون پاک نشه، این مطلب را گذاشتم یه وقت گول این را نخورید.

پ.ن: راستی لینک این صفحه را برای هکر میل کردم :))

منبع عکس: Standards compliance mode

تهیه شده در ایستگاه اتوبوس

Not in terms of functionality or ease of use but check this out:

Yahoo dominates e-mail with 88.4 million users in the United States in August, according to comScore. That is far more than Microsoft’s Windows Live Hotmail at 45.2 million and AOL at 44.8 million, not to mention Gmail at 26.0 million.

When you look at how much time people spend reading their e-mail, Yahoo mail users spend the most time (286 minutes a month), Gmail users the least (82 minutes), with AOL and Microsoft in the middle (229 and 204 minutes, respectively).

Wow. As a Gmail-lover, i would have never thought that was the case. You read the whole article here.

Untuk membuat email di Yahoo! sepertinya sekarang sangat jauh dipermudah. Dan berapa langkah simple kita sudah memiliki email dari Yahoo.com. Diakhir posting ini anda sudah akan punya email seperti ini :

1. Cukup klik disini, layar seperti ini akan muncul dihadapan anda.

Itu adalah 3 langkah mudah mendapatkan email dari Yahoo.

2. Isikan dulu bagian pertama :

3. Pilih ID yang anda inginkan .. bila tidak ada dalam pilihan anda bisa tulis dan cek apakah ID yang anda inginkan belum milik orang lain.

4. Setelah memilih ID dan mengisikan password yang diinginkan ..

5. Kemudian kita harus mengisikan ini :

Huruf dan kotak yang menyatakan kita menyetujui persyaratan yang ditetapkan Yahoo!

6. Satu langkah lagi klik Create My Account.

Bila tidak ada yang keliru anda masukkan anda akan berhadapan dengan layar ini :

Bila anda klik Continue anda akan segera masuk ke dalam inbox dari email anda.

Selamat mencoba!

Related Posts :

• Cara bikin email di Google Mail
• Cara Bikin eMail di Hotmail

(si eres usuario del messenger ... no hay problema ...
solo suscribe tu correo OnVipMail al messenger y ... ya está!)

Esta es una tecnologia patentada a nivel mundial por el socio tecnologico de Vip. Nosotros tenemos la exclusiva a nivel mundial en nuestra industria (redes) , puedes ver aqui copia de la noticia que se dio a conocer a nivel mundial en Reuters CLICK

Por fin, un correo electrónico que usted puede controlar ¡aun después de enviarlo!
Con el correo VIP, usted puede tomar ventaja de lo más nuevo en comunicaciones. Ahora usted puede tomar control de su correo electrónico y lo que sucede con él, aun después de que este ha sido enviado

• Evite que sus fotografías o mensajes privados sean difundidos a través del ciberespacio.
• Tome USTED el control y no lo deje en manos del destinatario. El correo VIP le otorga el privilegio de agregar nuevas ideas, puede también limitar el número de veces que el mensaje sea visto, y cuenta con la oportunidad de programar la hora de envio del correo.
• Ahora USTED decide el destino de sus correos electrónicos. ¡El correo VIP puede ser destruido, recuperado o cambiarse aun después de que haya sido abierto! Usted es el que manda, y presionar "enviar" nunca será otra vez un desastre irreversible

El nuevo correo gratuito de VIP Connectz onvipmail.com tiene las ventajas de un correo regular, más ...

1. Envío de correos electrónicos en forma de Video

2. Envío de corre electrónico encriptado con una contraseña para que solo sea visualizado con ésta.

3. Correos Auto destruibles, donde USTED puede elegir el tiempo o cantidad de visualizaciones para que éste sea borrado de la carpeta de correos de quienes lo hallan recibido.

4. Correos corregibles, donde envías un correo y lo puedes corregir después de haberlo enviado. Es más, también puedes hacerlo después de haber sido visto por el destinatario.

5. Correos Recuperables, puedes hacer que se borre de la carpeta de correo del destinatario así ya lo halla abierto.

6. Seguimiento de su información, puedes saber cuantas veces han visto tu correo, la hora a la que fué visto, y hasta la zona geográfica donde fué visto.

7. Email no reenviables, no imprimibles , la seguridad en correos privados se recupera con VIP

Y LO MEJOR DE TODO ESTO, ES QUE PUEDES TENERLO GRATIS!!!
ASEGURA YA TU CUENTA DE CORREO ONVIPMAIL ... para que no la tomen ... y

A DISFRUTAR DE LA ERA DIGITAL
Y PREPARATE PARA TODO LO QUE VIENE!
MEGARED SOCIAL, MEGACHAT, WEBPHONE, VIPSPORTSNET, TVonLine, ...
y si te unes a VIPConnectz ... de todos estos productos te beneficiarás!

Guia de Como Registrar Correo Electronico GRATIS!!!

CÓMO PUEDES ABRIR YA TU CORREO GRATIS "OnVipMail"?

Muy simple ... solo haz clic en la siguiente imagen Te fijas que en la parte superior indique: el nombre de la persona que te invitó a que tengas un cuenta de correo LUEGO HACES "CLIC" AL BOTON ANARANJADO TE APARECERÁ UNA VENTANA PARA QUE DIGITES TUS DATOS: TE APARECERÁ UNA VENTANA PARA QUE DECIDAS EL TIPO DE CUENTA QUE DESEAS CREAR una Cuenta Gratuita o Cuenta Premium Debes presionar clic en el botón azul que desees TE APARECERÁ OTRA VENTANA PARA QUE DIGITES la cuenta de correo que deseas tener TE SALE UNA VENTANA INDICANDO SI ESTÁ DISPONIBLE O NO Si no está disponible clic en "Back" (regresar) Si está disponible clic en "Continue" (avanzar) LUEGO DIGITA TUS DATOS DE REGISTRO Y LISTO ... YA ESTÁ ... TIENES TUCUENTA@ONVIPMAIL.COM TU CORREO INTELIGENTE DE 2DA GENERACIÓN

Cómo ingresar Otros días a tu correo?

Simple ... solo digitas en internet: www.onvipmail.com Se le presentará una pantalla para que ingrese su correo y su contraseña: Invita a tus familiares, amigos, clientes y a cualquier persona a obtener un correo inteligente como VIP Messaging con "OnVipMail.com"

Here is a classic Grimmer Tale..... I went online to find info about PO Boxes.  Saw that I could order it and pay for it online.  Did so.  Printed out my paper and took it, and my two IDs to the Post Office.  The poor teller had no idea how to complete the process and had to ask for help.  I was at her window for over 45 minutes.  I'm fairly forgiving, especially to service people.  But, at the end of all of it, she tells me that I have to come back the next day for the keys.

Turns out the box hasn't been rented IN YEARS and they have to change the lock it.  Classic.  Why else should it have happened in any other way?

Today I go back to get the keys.  Seems simple enough.  I give her my ID.  They have no record of me being there.  I tell her that I did it online, but she has me fill out an application for a box, yet again.  Great.  She even has me step to the side while I do it.  Yet again, Classic.

I get done, she tells me to go to the box number to get my keys.  I do.  The man changing out the lock goes on to tell me that they weren't updated by the main Postal System on the new "PO Box buying online".  He said they had no idea people could do it and that none of them really knew how to do it.  I go on to tell him that I was in on Monday and filled out the paperwork, and even told the teller today that I did it online, and that the teller from Monday has my paperwork.

He asked me, "You don't have to bring in any papers when you do it online, do you?"  "Yes," I said.  "On monday I brought in the paper, showed my two IDs, she initialled all of it, gave me my reciept and took the paperwork.  It's in there somewhere."  "Thanks," he said.  "I'll have to go over all of this with everyone.  You know, they never told us anything.  We had no idea this was coming."

Of course not.  Jeez.

Following that, I came home and sat down to answer all the questions for the second interview for a job I really want.  To be the Assistant to a celebrity Chef.  I really want this one.  My cover letter was brilliant, my resume in top form.  I spent over 3 hours crafting this email.  It was great!  It was well written, made me look smart, sound nice and it sounded like "me".  As I was spell checking it, the body of the email went blank.  Nothing there.  I start to freak.  But I see that Yahoo has saved a copy of it in the Draft folder.  I feel a little better.

I reload the page.  Still nothing.  Yahoo email has eaten my entire second interview and now, 4 hours of time.

I check the Draft.  It's blank as well.  Somehow Yahoo mail ate all of it, in both folders.  Not sure how that happened.

I start to cry.  Just a little.  In frustration.

WTF?!?!?!  Are you kidding me?!?!?!

I sent a mail to Yahoo Technical Support.  Maybe they know how to restore it.  If not, then I have to spend another 3 to 4 hours crafting another email.  It was due by tomorrow, end of day.  But, because I didn't send in my application until this past monday, I have been given until this next monday to get the questions back to them.  Great. At least I have a little extra time.

Oh, and I have to work tonight, at Howl.  Yay.

G just called.  She told me to step away from the computer and she's going to buy me a drink.  I need something to break this up.

And I never even got out to get my art supplies.  Sucks.  Yet again.  I have to get them and get started by tomorrow.  I only have a little over a week to get it done.

I need a walk.

Opening each Inbox, so you can monitor them, is a simple matter of opening a new tab (see, Browser tab quick tips for more) and logging in-- as long as we're talking about different services.

If you have more than one "Identity" at a Webmail provider, (two different Gmail accounts, say) you typically are automatically 'logged out' of one when you log in to the other from the same computer. This is annoying. Here's how to fix that behavior.

Tip of the day: Change IE's settings to allow separate log ins.
As strange it may seem, you need to close Internet Explorer, and then make a change in Folder Options.. this will affect IE as Microsoft consider it to be a part of the operating system.

1) Start >Control Panel >Folder Options (XP user: Start >Settings >)

2) Click on the "View" tab.
3) Scroll down until you see "Launch folder windows in a separate process" and place a check in the checkbox.
4) Click "Apply", and then "OK".

That's it. You're done. Now you can launch IE and you will be able to log in to each of your Identities/Inboxes, and one will no longer 'log out' the other.

Copyright 2007-8 © Tech Paul. All rights reserved. post to jaanix

Share this post :

A little bit of theory

Web servers can identify a client through a piece of data that it sends called cookie. After the client authenticates itself to the server (by username and password) , the server assignes unique cookies to that client. When the client makes a request to the server using those cookies, the server knows that he is who he pretends to be and allows him to access personal data.

Most web-based email systems use the mechanism described above and most of them do not encrypt their traffic. As you know, HTTP is a clear text protocol and  anything sent in the network using HTTP can be sniffed and interpreted.

So, in a LAN environment, by using a sniffer and a man-in-the-middle tool you can get the cookies used for session identification and use them in your own browser to impersonate the real cookie owner. I think the image below clarifies the scenario.

Proof of concept - the automatic way

YM_hijack is a tool that automates the process described in the picture above. It must be run on the "Man in the Middle" host (see the picture). It does not have any MITM (man in the middle) capabilities so, in order to do that, you must use another tool like Cain or Ettercap or arpspoof or macof.

Prerequisites (for YM_hijack.exe):  Windows XP, Mozilla Firefox (2 or above)

Prerequisites (for YM_hijack.py):  Windows XP, Mozilla Firefox (2 or above), Python, Pcapy, Impacket

How does it work?

• Make yourself Man-in-the-middle
• Start YM_hijack.exe (or the python version) which does the following:
  • Sniff packets from the network destined for tcp port 80
  • Extract HTTP payload and search for Yahoo mail specific cookies (Y, B, T)
  • Create a new Firefox profile named after the IP address of the originator
  • Create the cookies.txt file in the newly created profile's folder
  • Start a new instance of Firefox with the new profile
  • Enter directly into the Yahoo mail session of the 'poor guy'

You can find more details by studying the source code (for python speakers).

The solutions:

• use HTTPS during the entire session (Gmail has an option to do that)
• encrypt your email content using PGP or a similar tool

Conclusion:

Think twice before using/choosing the email, especially with confidential information!

My email journey has actually been very fascinating. I started of with hotmail, my first mail account. However I had to let in go since it was too slow for a 64kbps dial up connections and that too when the rates of accessing internet in a net cafe were as high as INR 100 to 150 per hour. After dabbling for few days with Rediff, I moved to Yahoo.

Yahoo, I must admit, introduced me to the world wide web. It was the best and most talked about thing about 8 years back from now. My teenage thrived and bloomed on Yahoo messenger ( :mrgreen: ) and so did my professional self. I remember registering in the websites of the likes of Naukri and Monster using my Yahoo account. I remember uploading photographs for the first time on flickr using a yahoo id. All the final year project, Yahoo mail has been the carrier of the documents between our team (I headed them... Yo!) and our professor who was away most of the times. And when I tried my hand at doing Post Graduation in management, Yahoo it was again. And Yahoo it was, when I got through. But in the end, I ditched Jerry Yang and shifted my base to Google.

I don't know what made me go back to the Yahoo account. May be all the memories did. Sadly, all that communication which would have felt me nostalgic is now lost. But my Yahoo is back. And it is looking really good. I mean they have put good effort in developing the new mail client. One reason why I continued with Google was I found it easy on the eys as well as to use. May be I will change that perception now. May be I'm starting my Yahoo again.

PS: "maxmayur" actually is my name since my Yahoo days. It was my chat id. :-)

Lowdown:
A lamina that is plural garish unless ego seems. Goofiness abounds friendly relations this overdraw as respects 70’s VTOL diastrophism films. Him is ace with regard to the fugleman prestigious savor of wit anent metagalaxy tour of duty over and above hand in glove relating to the yet quotable.

“Be conversant with yours truly in any case seen a well-constructed Indian exposed?”

Reviews:
Popular song Matters
Moving picture Views

Categories: haziness, cinematic problem play, Zucker, Leslie Nielsen, Peter Graves, Lloyd Bridges