My friend had her Yahoo account taken over (her mistake) and now all her friends are getting the following email from her:
hello,
I hope this message meets you in best of health, Pardon my mistakes because I am in a hurry writing this, I had traveled to Nigeria for official purposes, Unfortunately for me all my money was stolen at the hotel where I lodged, I am so confused right now,I do not know what to do or where to go,I did not bring my phone here,I have access to only emails, please can you send me $3000
I find that really funny but on a serious note has anyone ever had their Yahoo email taken over and then had the password reset again by Yahoo?
25 replies on “I am in Nigeria, please send me $3000”
LOL , again with the african trickery
keep your password safe and give it to anyone ppl
The only way this happens is usually when they respond to bigus emails requesting them to verify their name and password. Other wise is pretty much impossible to hack into someones account
Its not about giving your password to anyone. All you have to do is use your laptop in a public hotspot. A traffic sniffer will easily uncover ur password and any other data u send and receive (even with SSL encryption which Yahoo doesn’t use anyways). I can personally do this and I’m no super hacker. There are videos all over youtube that can show a monkey how to do it. Sadly you are not much safer at ur own wifi network at home. Even a protected home network running WEP, WPA, or WPA2 can be hacked into. Once again videos all over youtube that are completely moron friendly. If you guys really wanna get serious about security then you have to use a trusted VPN anytime you use a wifi hotspot, and to be more secure you should use TOR (The onion router).
this might help:
https://help.yahoo.com/l/us/yahoo/security/general.html
sneaky bastards !
nigerian scam artists.. they are well known.. infact the country makes alot of money out of the funds that are transferred into nigeria. google it.
they always need money in order to release millions that are hidden somewhere.. its always the same bullcrap!!!.
Cain & Abel can mess around with VPN networks…
How was her Yahoo! account taken over and how was it her fault?
I don’t know if the same thing happened to me, but I have noticed that there are a couple of subscriptions in different websites (such as DVD websites) that were registered with my Yahoo! account (that I NEVER use) and also my name.
I think I will go ahead and delete my Yahoo! account because I never use it anyways…
Cain & Abel is soo 2007 🙂
oldies goldies =P
a month ago my friend’s hotmail account got taken and the person who took it sent an email to all his contacts advertising a chinese company selling electronics called GVCCN i checked their website and its pretty funny they have the Sony Ericsson Xperia on sale which is not even out yet !:D,at least if you want to scam people try to be smart about it !:D and everything on the website is listed for way less than its original price 😀
@7ussien, i did get something like that from my friend as well but i don’t really remember if it is the same company .. !
@ Frankie, I wish you were writing English..
Its probably not been taken over, more like she opened an email with a script which went through her contacts list and emailed all her friends with the same script and CC’s the original sender, thus they know that all the emails have real people at the other end.
Then her friends open up the email sent from her (As its a trusted or marked safe email address) – then the script runs again, and the loop goes on. The original sender ends up harvesting a load of real email addresses – which can then be used/sold anywhere they like.
Clever these little cyber kiddies!
Frankie are you mad? Hacking WEP and wireless protected networks are time consuming, you have to gather 1GB worth of data before running the algorithm! SSL with Yahoo is a choice at sign in, if you do not choose to then its your problem not Yahoo’s!
Computers are not stupid, they do their masters bidding, if the master is stupid then there isn’t much the computer can do about it!
RainQ8, Frankie is 100% correct. What are u talking about 1GB to hack WEP? Are you mad? Wep takes less than a min to crack nowadays with the correct tools. I have a script on my N80 that cracks WEP in about 7 mins (and thats a tiny phone!) WPA and WPA2 (esp. Radius) can take longer, but again neither require 1GB of data.
Also the script you are describing is not what happened to Mark’s friend. He clearly states that the password of the account was changed (so that the Nigerians can have back and forth communication with anyone that actually believes the emails,
Guys it is soooo extreemly easy for someone to totally see every bit of data going to and from ur pc when connected to a public hotspot. Next time u are there at Starbucks, look over and try to spot the hacker checking out everything you are doing =)
On YouTube check out Hak5Darren. It will show you how to do all I just mentioned. It will also show you the best ways to protect yourself. Stay safe people, and be very careful when using credit cards.
i’ve gotten an email like that once. I knew it was a scam but I simply replied with “Dude, I’m sorry about whatever happened to you, but if I had $3,000 I’d be out shopping right now not reading this stupid email from you :)”
Why are they always Nigerian?
People, listen. You are playing a cat and mouse game that has been going on for years. Simple countermeasures go a long way…like a password that has letters, numbers, and special symbols. Make it long too. Change it every now and then. Use software that protects you to a degree, and finally… Don’t FALL FOR IT!!! Would you open up mail sent to you, if you had NO IDEA who the sender was? Then again, don’t answer that…
Omar, yep you are right about WEP cracking but the nice data you want to look at is not easy to hack in minutes or low volume data capture, and if they are using wireless WPA then it is time consuming to even get connected.
Even if you sniff packets at starbucks, and the surfer is connected to a SSL site it would take you donkey years to brute force the encryption on the packets to get the credit card, you would have to sit and gather (Not that I do)!
But I never use the local wi-fi spots. Good to get the key to surf for free, but expose your computer to others?
It sounds like a script with simply the reply-to changed before/after harvesting (SMTP masking is easy). Mark pastes the Nigerian guys blurb and he didn’t actually confirm if she can’t get back into her account.
The reason I mention the script is one of my friends had the same thing happen, but it was not that her account got taken over (although she thought they had) it was just a script (Sent to her in another email, subject: RE: ) harvested her contacts address book.
She changed her password just in case and unless there’s a trojan key logger on her machine knocking out to some server in China its pretty much safe now. Although she is still looking for tools to protect herself from herself.
Not sure how you can have your email password reset by Yahoo unless you specified another email address when you signed up to have it sent to. How do they know its 100% you?
Omar is right with CC’s, my rule is no httpS then no card!
Sheep, it could have been a bot generating addresses by replying to the email you have just confirmed to it that you are a real live recipient that would like to receive even more junk email.
Just Jay, you are right with the simple stuff, but be warned about the wireless free spots and not using SSL sites as you will be easy targets for Frankie and Omar.
@RainQ8. Hehe, I don’t target anyone. I learn all of this just for counter security. By the way, cracking SSL using brute force has gotten tremendously easier since the development of Rainbow Tables earlier in the year. Check it out: Rainbow Tables Brute Hash Cracking https://en.wikipedia.org/wiki/Rainbow_table
Omar you really are feeding the forum too much info which will result in me experimenting – I think thats the same as counter security?
Rainbow is limited at the moment and all my passwords are longer than 8 characters, contain case change, numbers, and symbols.
If caught experimenting I will tell them some bloke called Omar set me up with all these ideas! 😛
Rain, it’s cool. I work in IT, so I get a kick out of the cat/mouse game. I employ a few tricks to keep my side of the house clean. Trend Micro also has a program called. R U Botted… it’s pretty good too.
https://www.trendsecure.com/portal/en-US/tools/security_tools/rubotted
I encrypt, surf anonymously, use proxies (not free ones, either) and do what I need to do to keep my less honest friends at bay.
This happend to my mom and we sent Yahoo! A million of emails and they didn’t reply to any.
My mom uses her email a lot for business and such so a lot of people started calling her asking if she was ok haha.
Wow oops this is a 2008 post :p