my girlfriend got her yahoo account hacked. suggestions?

so my girlfriend has a yahoo account and someone has hacked into and gone through her emails looking up the "activation email" when you first sign up to a site. (you know, the email that tells you that your account is now active and lists your username and password). so this guy went into her myspace, facebook, livejournal, paypal, and modelmayhem account and deleted them all.

we think it may have been a myspace phishing thing because she's had to change her myspace password in the past because of spam bulletins. but it could also be a pissed off ex-boyfriend. we're not sure. :-/

so we called the yahoo tech support and all they could tell us is that the account is still active. she forgot her "secret question" so they refuse to help her even though her account is still being used without her permission.

we've been emailing the tech support for the sites, and so far we've recovered the livejournal account. but that's it. any suggestions on what to do to recover her email?

Yahoo are really the only ones who can help with this.

if it's that's much trouble, why not just cut your losses, and recreate all the myspace, facebook, livejournal, paypal, and modelmayhem accounts? I mean if it is an ex boyfriend wouldn't it be wise to just start anew with most of the same friends. that way it wouldn't be as easy for him to find your girlfriend. As the saying goes: "On the internet, no one knows you're a dog."

A few things you might want to do is check the PC's she uses to access those sites for any type of trojan, key loggers, rootkits, etc etc. You might want to beef up the browsers security settings as well, so to speak. Low security settings make it more likely to fall victim to cross site scripting attacks, which honestly are one type of attack that still rattles my nerves. If public computers were used to access the sites that were compromised, you might want to not use them to access personal information in the future, theres no way for you to tell whats been done to a lab computer before you got there. Same goes for public wifi, you have to be aware of the possibility of evil twins.

Nobody but yahoo can fix her yahoo mail. Sorry. Best I can offer is some advise that may help you have a safer experience on the net in the future.

First thing I'd do is set up another email account with another provider (Gmail maybe). Then email all of her friends thjat she can get a hold of explaining the hack and her new email addy.

Then she could recreate the other accounts but this time use a different password for the accounts.

An old hack from the bbs days was to set up a bbs. Offer something that people have to log on for. Try to get them to list other boards they visit because usually they will use the same username and password. Then you harvest the username and password fro your bbs and have fun on their accounts.

I don't know how many times I've connected to someone else's email account on a public computer because they failed to log out correctly. All I had to do was connect to the provider and voila, I'm logged in and they could have pwned.

Hi and welcome to AO.

You will not get much help out of Yahoo! because they do not give a damn. You are not paying them anything, and free services are not well supported.

When you subscribe to a service be sure to print out or write down all the account details, and keep them in a safe place.

When you get a confirmation, print it out and save it to a secure folder on your hard drive then delete it from your mailbox.

Quote:

---

so this guy went into her myspace, facebook, livejournal, paypal, and modelmayhem account and deleted them all.

---

How do you know it was a guy?

If there was a balance on the paypal account then you are looking at a felony offence. Report it to the police as they will not have difficulty in getting the logs from the service providers and may be able to trace the culprit.

In any event, their enquiry will demonstrate that you are genuine, rather than trying some social engineering scam. It will also cover you if any of these accounts are used for malicious or illegal purposes;)

ddddc:

Quote:

---

I don't know how many times I've connected to someone else's email account on a public computer because they failed to log out correctly.

---

Actually that is probably not true. people forget about the MRU records and session cookies. :eek:

The real culprits are the service providers who do not manage sessions properly, sometimes leaving them open for hours if not days after the user has logged off. Anyone coming along later can continue with that session as no re-authentication is required.

Quote:

---

Originally Posted by nihil

Hi and welcome to AO.



If there was a balance on the paypal account then you are looking at a felony offence. Report it to the police as they will not have difficulty in getting the logs from the service providers and may be able to trace the culprit.

In any event, their enquiry will demonstrate that you are genuine, rather than trying some social engineering scam. It will also cover you if any of these accounts are used for malicious or illegal purposes;)

---

no money was actually taken out of her paypal. it was not really activated, but her credit card information is still on there. either it was deleted or the person changed the password. we're not sure.

but the person sent an taunting email from the email he hacked saying "how do you feel about this?" to her alternate email. and because it's yahoo, i now have his IP address and i tracked it to a computer in new jersey.

but no money has been taken or anything. however, he has gone into her accounts and has tried to humiliate her by changing her profiles and has been sifting through her journal and private emails.

since yahoo obviously won't help us, is there anything else we could do to stop this person from trying to humiliate her? or will she just have to delete everything she's every signed up with on that email? this type of harassment seriously can't be legal, can it?

Quote:

---

since yahoo obviously won't help us, is there anything else we could do to stop this person from trying to humiliate her? or will she just have to delete everything she's every signed up with on that email? this type of harassment seriously can't be legal, can it?

---

1. Report it to your state cybercrimes team.

2. Yes she will have to start afresh, hopefully having taken the advice given here.

3. That would depend on your laws.

Basically you have no evidence of a felony and have suffered no material loss, as these were free accounts.

The harassment and "cyberstalking" bit may have some mileage in it, but there do not seem to have been any threats?

The IP address you have (in NJ) is useless, so you might as well forget it.

My advice would be to learn the lesson and move on. You would have a better chance of getting him busted for tossing a candy wrapper on the pavement, and I mean that! Cybercrime is the most under resourced area of law enforcement Worldwide, not just in the USA :(

(so this guy went into her myspace, facebook, livejournal, paypal, and modelmayhem account and deleted them all. )

SEEMS LIKE HE IS WAY SMARTER THAN YOU.

(we think it may have been a myspace phishing thing because she's had to change her myspace password in the past because of spam bulletins. but it could also be a pissed off ex-boyfriend. we're not sure. :-/ )

AS LONG AS YOU ARE NOT SURE ,YOU NEED NOT WORRY ABOUT THE BF.ELSE JEALOSY MAY CAUSE YOUR MIND SOME HARM.

(so we called the yahoo tech support and all they could tell us is that the account is still active. she forgot her "secret question" so they refuse to help her even though her account is still being used without her permission. )

OK YAHOO SHOULD HAVE HELPED.

we've been emailing the tech support for the sites, and so far we've recovered the livejournal account. but that's it. any suggestions on what to do to recover her email?

POST THE EMAIL RIGHT HERE.YOU HAVE TO FIND SOME ONE SMARTER THAN HIM TO CRACK IT AND GIVE IT TO U .



[/QUOTE]

anandovski please don't post to a 2+ month old thread with bullshit answers that a kid with an IQ of 5 could've thought of....thanks

Stay out of chatrooms, unless you use a client. Don't click on an adult profile or photo bucket, where you have to put in your username and password. And lastly, GET RID OF THE YAHOO ACCOUNT!!!

Tim

A WORD OF ADVICE TO EVERYONE WITH A FREE E-MAIL ACCOUNT:

Just try this little test:

1. Create a shortcut or icon to your e-mail provider

2. Open your account

3. Mess around with your mail then click the little "x" in the top right corner of the screen.

4. Click on the icon or shortcut..........................

Does it bring your account back up?

If it does, then you are vulnerable to "session hijack"!

5. Try the same with logging out from the application.

6. Try the same with clearing your cookies first.

7. If you can re-open a session, see what you can do. Naturally you will be able to read, move, delete and send mail.............. can you change the password?

It can be quite an eye opener :D

If you do not log out properly and clear your cookies and/or your e-mail provider doesn't close your account when you log out, you are at risk. I have been horrified how long some of them will leave a session that you haven't closed for........ it could be days :eek:

Also, I personally do NOT check the "Remember Me" in the email username page itself, and I use Firefox, and I choose to NOT remember me there also. This makes me enter my username and password every time. I also have any "auto-complete" disabled. As Nihil says, I always clear my cookies on a regular basis.

Hey, Ciscoman, FireFox gives you the options of clearing private data on exit, and you can select the same option out of the "tools". I think those are pretty good options.

Hey I am no browser fanboy, but that just seems good to me?

:)

I'm not too worried about auto complete and the browser remembering the password since I am the only one who uses this PC and if it gets stolen then my e-mail passwords are the least of my worries. (For credit card sites I do tell it to forget passwords)

Refering to the original post - its bad practice to store activation e-mails or other e-mails with passwords. Better to write them down than store them in your e-mail.