Today somebody changes my yahoo password. And I only uses this password using my personal/office computer which is secured by antivirus.
This happens today when I am surfing internet using my tablet using Wireless@SG as internet connection. Then my password is changed by someone else.
Either my tablet or Wireless@SG is compromised. I believe only this two is the possibility, I remove out my tablet possibility as because I haven't heard about android tablet keylogger ever happens.
As because wireless@SG uses WEP encryption, which I suspect easily compromised and data in the network can be eardrops easily including my yahoo password.
Any expert please help me?
The only REAL SECURITY is usage of SSL with proper certificate checking on properly implemented sites
Anything else like using Wireless@SGx or VPN is delusional.
WEP is a broken security and not to be trusted. WPA/WPA2 which can be defeated by monitoring the traffic for the 4 EAPOL packets on initial connection made by client and subject to decryption. So Wireless@SGx is not as safe as you think it is. The devil is in the details and hackers are working on details.
Using SSL is not sufficient for proper security either. Too much half-baked knowledge about security to think when you see an SSL connection is good enough. You can be hoax into a split SSL tunnel as such
client <---- SSL ----> HACKED <---- SSL ----> REAL SITE
Your browser should complain if the above happens, but a mobile client may not because the responsibility of floating up the error message is by the mobile client. The SSL socket when using proper certificate checking by domain will helps to lower the risk, provided the local DNS server is not compromised. However this is the minimal and acceptable security level for most end-users.
VPN are not secure based on the way how it is introduced to consumers. It did not provide end-to-end security, partial protection is NO PROTECTION.
Simply to speak, wearing a broken condom is as good as not wearing one.
Even where proper SSL is implemented, poorly executed website will still be compromised. It is commonly found in a lot of websites where the login form is non-SSL protected, during during submission. This is a security hole where the form can be modified before you even get into a SSL session, which means you could have easily been hoaxed into submitting your userid and password to a phishing site.
Partial SSL protection implemented in websites also allow for cookies to be exposed and hence browser hijacking can be done to extract personal information stored in the site without even having a SSL connection. Badly implemented site might even allow password to be changed without the need for the original password, or even visible to hackers via forget password change. I have come across foolish implementor sending password via email to end-user.
Hacking can happen across services. One can start a forget password process. While the password is not sent to the hacker's email. It can be extracted via the wireless network since POP3 and IMAP are not necessarily SSL protected and can be sniffed in a shared network if the end-user start up a local email client working in the background. So the email is sent to the victim, and if it is concurrently sniffed by the hacker, it can then be retrieved and quickly access the website and lock out the victim if done fast enough.
Let be even more innovative. What makes you think when you are connecting to Wireless@SG, or starbucks network, these are real hotspots offer by the intended originator ? Even if there are 2 Wireless@SG network in the area, your devices will attempt to connect to the stronger ones even after initial connection to the real one. For all you know, your hacker is just sitting next to you monitoring your traffic.
If you are foolish enough to use your password in unprotected sites like HWZ and same as the one you use for yahoo, you are screw just as bad.
Passwords I used are like this "IP6JAsOKsF@vQgb{XT'k0dteB6OT6(aU" and they are different across all my services. If you decided to use such kind of complicated passwords without a password manager, how many can you remember ? If you are using simple passwords like this "johhmybaby2012", then I'm pretty sure the chance you reuse the password in another site is high, or just a few tweaks like "mybabyjohn2012", "johnmybaby2013", etc...
The approaches are endless and subject to the creativity of the hackers.
have you been installing apks from untrusted sources, for example?
