Yahoo! Mail service vulnerable to hacking

[Ace]

Hi everyone! Don't know if this is the right place to post this. Heads up:

http://www.ynetnews.com/articles/0,7...290172,00.html

Yahoo! Mail service vulnerable to hacking

Exclusive: Simple security vulnerability allows hackers to gain control over email boxes by sending malicious code. Yahoo: We are distributing a repair
Ehud Kenan

A security vulnerability exposes Yahoo! Mail private mailboxes to hackers, Ynet has learned.


A test conducted by Nir Goldshlager and Roni Bahar from the Israeli security company Avnet shows hackers may gain access to Yahoo!Mail users' mailboxes by sending an email message with a malicious code.

According to a test conducted by Ynet, and without disclosing the process, a new email account was opened. An email message was sent to that mailbox along with an html file with the malicious code, as an attachment.

Opening the tainted email on Internet Explorer undetectably sends the user's cookie to the hacker's server. The user is exposed to the vulnerability without having to download or open the html file.

Full access to users' mailboxes

At this point, the hacker can retrieve the cookie from the remote server, and gain full access to the user's mail box, with no time limit. The hacker may read and send emails from the mailbox.

The hacker cannot change the password from within the mailbox, since such an action requires entering the original password.

However, according to Goldshlager and Bahar, tools available online may be used to retrieve personal information from the cookie. The information may assist the hacker to use the password retrieval system, normally used by users who forgot their password. Alternatively, the hacker can exploit the vulnerability for performing phishing and by sending different malicious code, he can direct the user to enter his password in a site resembling Yahoo.

A user whose cookie was stolen may change his password, but it will still leave the hackers with access to parts of the mailbox, such as user's calendar.

Yahoo's spokeswoman, Kelley Podboy told Ynet: "Online security issues such as this bug are taken very seriously at Yahoo! We have developed a fix and are in the process of deploying it worldwide. Yahoo! Mail users will not be required to take any action to be protected from this exploit."

Might be too late to hide your privy stuff. yahoo!

[samizdat]

I thot this was old news. People have been sending emails from my yahoo mail for years. I even get some junk mai from fake me, and quite a bit from fake yahoo admin.

[Brian Baldwin]

I don't deal with Yahoo. To me they are as secure as AOL which means not at all. I feel badly for all those DSL customers that are forced to have Yahoo as their ISP. I've heard too many horror stories and fixed too many messes that come from them to believe that Yahoo even cares what happens to their customers once they have their money. Much like AOL.