On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies and whatever else.
1
-
While it's good that you changed your password and we all need to do that more often than we should, but the exploit isn't a Yahoo Mail systems exploit. The exploit in question is XSS that needs to be pointed at a target and the PoC is not public last I checked. That being said, knowing it's there may lead to other people to discovering the exploit.– g3kCommented Jan 9, 2013 at 16:03
Add a comment
|
1 Answer
Changing your password is enough to prevent them from regaining access to your Yahoo mail account. While you're doing it, you may want to change your security questions/recovery questions, and set up a mobile number for password resets. You should not need to delete your cookies (though you can if you want).
If you used the same password on any other site, change it on the other site as well.
In principle, there are some ways that the hacker might have been able to access other accounts you have on other websites. First, if you stored the passwords for other websites anywhere in your inbox or any mailboxes on your Yahoo account, then an attacker could have viewed them. Second, if you use your Yahoo email address as the email address for accounts on other websites, then the attacker could have used the password reset functionality on those other websites to gain access to your accounts on other websites. There's probably no good way to know for sure if either of these happened. If you are concerned about this risk: log into every other account you have on every other website, and change the password on each of those accounts to something new. Yes, I realize this is a serious pain, so you'll have to judge for yourself whether it's worth doing or whether you want to just take the risk that the hacker didn't get access to any of your other accounts.
