Email attack exploits vulnerability in Yahoo site to hijack accounts

The vulnerability is located in an old WordPress version used on the Yahoo Developer Network Blog site, Bitdefender researchers say

By Lucian Constantin, IDG News Service |  Security

Hackers behind a recently detected email attack campaign are exploiting a vulnerability in a Yahoo website to hijack the email accounts of Yahoo users and use them for spam, according to security researchers from antivirus vendor Bitdefender.

The attack begins with users receiving a spam email with their name in the subject line and a short "check out this page" message followed by a bit.ly shortened link. Clicking on the link takes users to a website masquerading as the MSNBC news site that contains an article about how to make money while working from home, the Bitdefender researchers said Wednesday in a blog post.

At first glance, this seems no different from other work-from-home scam sites. However, in the background, a piece of JavaScript code exploits a cross-site scripting (XSS) vulnerability in the Yahoo Developer Network (YDN) Blog site in order to steal the visitor's Yahoo session cookie.

Session cookies are unique strings of text stored by websites inside browsers in order to remember logged-in users until they sign out. Web browsers use a security mechanism called the same-origin policy to prevent websites opened in different tabs from accessing each other's resources, like session cookies.

The same-origin policy is usually enforced per domain. For example, google.com cannot access the session cookies for yahoo.com even though the user might be logged into both websites at the same time in the same browser. However, depending on the cookie settings, subdomains can access session cookies set by their parent domains.

This appears to be the case with Yahoo, where the user remains logged in regardless of what Yahoo subdomain they visit, including developer.yahoo.com.

The rogue JavaScript code loaded from the fake MSNBC website forces the visitor's browser to call developer.yahoo.com with a specifically crafted URL that exploits the XSS vulnerability and executes additional JavaScript code in the context of the developer.yahoo.com subdomain.

This additional JavaScript code reads the Yahoo user's session cookie and uploads it to a website controlled by the attackers. The cookie is then used to access the user's email account and send the spam email to all of their contacts. In a sense, this is a XSS-powered, self-propagating email worm.

The exploited XSS vulnerability is actually located in a WordPress component called SWFUpload and was patched in WordPress version 3.3.2 that was released in April 2012, the Bitdefender researchers said. However, the YDN Blog site appears to be using an outdated version of WordPress.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Ask a Question
randomness