| |
XSS worm spreading through Yahoo webmail
by Acidus at 2:00 pm EDT, Jun 12, 2006 |
I just received an email with an html attachment, on a yahoo account. When I opened the mail, yahoo automatically displayed the html, and executed
the code within. What the hell. =) It forwarded the message to my contacts
list, (or some other set of addresses, dunno,) and redirected my browser to
a website.
XSS-based worm spreading through Yahoo's web mail. Looking an an email message causes the XSS to run. The XSS uses AJAX to make an HTTP POST to the URL on YAhoo for sending mail. The worm does this to send email containing the worm to everyone in your address book and sends your address book to a 3rd party. Probably to sell your email address to spammers. This is a great example of XSS+AJAX=BAD! Even if Yahoo mail doesn't use AJAX, the XSS can use AJAX to make requests for you using your credentials. |
| |
RE: XSS worm spreading through Yahoo webmail
by ubernoir at 4:37 pm EDT, Jun 13, 2006 |
Acidus wrote: I just received an email with an html attachment, on a yahoo account. When I opened the mail, yahoo automatically displayed the html, and executed
the code within. What the hell. =) It forwarded the message to my contacts
list, (or some other set of addresses, dunno,) and redirected my browser to
a website.
XSS-based worm spreading through Yahoo's web mail. Looking an an email message causes the XSS to run. The XSS uses AJAX to make an HTTP POST to the URL on YAhoo for sending mail. The worm does this to send email containing the worm to everyone in your address book and sends your address book to a 3rd party. Probably to sell your email address to spammers. This is a great example of XSS+AJAX=BAD! Even if Yahoo mail doesn't use AJAX, the XSS can use AJAX to make requests for you using your credentials.
on my yahoo account i've clicked "Block HTML graphics in email messages from being downloaded" but there's no option for turning off HTML completely
sorry for the idiotic question but will that help |
|
| | |
RE: XSS worm spreading through Yahoo webmail
by Acidus at 11:56 am EDT, Jun 19, 2006 |
adam wrote: Acidus wrote: I just received an email with an html attachment, on a yahoo account. When I opened the mail, yahoo automatically displayed the html, and executed
the code within. What the hell. =) It forwarded the message to my contacts
list, (or some other set of addresses, dunno,) and redirected my browser to
a website.
XSS-based worm spreading through Yahoo's web mail. Looking an an email message causes the XSS to run. The XSS uses AJAX to make an HTTP POST to the URL on YAhoo for sending mail. The worm does this to send email containing the worm to everyone in your address book and sends your address book to a 3rd party. Probably to sell your email address to spammers. This is a great example of XSS+AJAX=BAD! Even if Yahoo mail doesn't use AJAX, the XSS can use AJAX to make requests for you using your credentials.
on my yahoo account i've clicked "Block HTML graphics in email messages from being downloaded" but there's no option for turning off HTML completely
sorry for the idiotic question but will that help
That's actually a good question. If Yahoo never downloads the image, the onload event will never fire. However the a literally thousands of places in the HTML standard where JavaScript can execute. I could do a IMG tag with SRC="." (which is invalid) and have an ONERROR tag with JavaScript in it. It really all depends on what Yahoo is filtering. The fact the forgot about IMG ONLOAD makes me think there are many more they forgot about to. |
|
XSS worm spreading through Yahoo webmail
by Rattle at 4:33 pm EDT, Jun 12, 2006 |
This just in from Acidus. There is an AJAX/XSS worm carving through Yahoo! Mail. I just received an email with an html attachment, on a yahoo account. When I opened the mail, yahoo automatically displayed the html, and executed
the code within. What the hell. =) It forwarded the message to my contacts
list, (or some other set of addresses, dunno,) and redirected my browser to
a website.
XSS-based worm spreading through Yahoo's web mail. Looking an an email message causes the XSS to run. The XSS uses AJAX to make an HTTP POST to the URL on YAhoo for sending mail. The worm does this to send email containing the worm to everyone in your address book and sends your address book to a 3rd party. Probably to sell your email address to spammers. This is a great example of XSS+AJAX=BAD! Even if Yahoo mail doesn't use AJAX, the XSS can use AJAX to make requests for you using your credentials.
Acidus has given presentations outlining exactly this threat several times in the past year at conventions including Outerz0ne, Shmoocon, and Blackhat Federal. Were we the only ones paying attention to him? This is downright innocent and harmless when compared to some of the uses for this type of XSS exploit that he was concerned with. |
|
|
