Yahoo plugs hole that allowed hijacking of email accounts - haynesariervintend

Hackers behind a recently detected email attack movement are exploiting a vulnerability in a Yahoo website to highjack the email accounts of Yahoo users and employment them for junk e-mail, according to security researchers from antivirus vendor Bitdefender.

The attack begins with users receiving a junk e-mail email with their distinguish in the subject agate line and a short "check exterior this page" message followed aside a bit.ly shortened link. Clicking on the link takes users to a website masquerading as the MSNBC news site that contains an article or so how to make money while working from home, the Bitdefender researchers said Wednesday in a blog post.

At first glimpse, this seems no different from other work-from-home scam sites. Yet, in the background, a piece of JavaScript code exploits a cross-site scripting (XSS) vulnerability in the Yahoo Developer Meshing (YDN) Web log site in order to steal the visitant's Yahoo session cookie.

Session cookies wide door

Session cookies are unique strings of text edition stored by websites inside browsers in order to remember logged-in users until they sign out. Web browsers use a security chemical mechanism known as the very-origin policy to prevent websites opened in different tabs from accessing each separate's resources, like school term cookies. (Learn also How To Protect Yourself From Supercookies.")

The same-origin policy is usually enforced per domain. For illustration, google.com cannot admittance the session cookies for chawbacon.com still though the user might be logged into some websites simultaneously in the same web browser. However, depending on the biscuit settings, subdomains can access session cookies set by their parent domains.

This appears to be the case with Yahoo, where the user clay logged in regardless of what Yahoo subdomain they visit, including developer.hayseed.com.

The varlet JavaScript code loaded from the fake MSNBC website forces the visitor's browser to call developer.yahoo.com with a specifically crafted URL that exploits the XSS exposure and executes additional JavaScript codification in the context of the developer.chawbacon.com subdomain.

This additional JavaScript code reads the Yahoo user's session biscuit and uploads it to a site controlled away the attackers. The cookie is then misused to access the user's email account and ship the spam email to all of their contacts. In a way, this is a XSS-powered, self-propagating electronic mail worm.

The exploited XSS vulnerability is actually located in a WordPress component called SWFUpload and was patched in WordPress interlingual rendition 3.3.2 that was free in April 2022, the Bitdefender researchers said. However, the YDN Web log site appears to embody victimization an outdated rendering of WordPress.

Exploit reported, squashed

After discovering the attack on Wednesday, the Bitdefender researchers searched the companionship's spam database and found very similar messages dating back near a month, said Bogdan Botezatu, a precedential e-menace analyst at Bitdefender, Thursday via e-mail.

"IT is extremely difficult to estimate the success rank of such an attack because it can't be seen in the sensor network," atomic number 2 said. "However, we count on that just about one percent of the spam we have processed in the past month is caused by this incident."

Bitdefender reported the vulnerability to Yahoo on Wednesday, only it even so appeared to be exploitable on Thursday, Botezatu aforementioned. "Some of our test accounts are still sending this specific type of spam," he said.

In a statement sent later o connected Thursday, Yahoo same IT had patched the exposure.

"Yahoo takes security and our users' information seriously," a Yokel representative said via email. "We recently learned of a exposure from an external security secure and corroborate that we have fixed the vulnerability. We encourage concerned users to vary their passwords to a strong password that combines letters, numbers, and symbols; and to enable the second login gainsay in their account settings."

Botezatu informed users to avoid clicking on links received via email, especially if they are shortened with bit.ly. Determining whether a link is malicious before scuttle information technology tin can atomic number 4 hard with attacks equal these, he same.

In that case, the messages came from people the users knew—the senders were in their contact lists—and the malicious site was well-crafted to look like the respectable MSNBC portal, he said. "It is a type of attack that we carry to Be extremely successful."

Source: https://www.pcworld.com/article/456686/yahoo-plugs-hole-that-allowed-hijacking-of-email-accounts.html

Posted by: haynesariervintend.blogspot.com

Share this post