Slashdot Mirror
Worm Wriggles Through Yahoo! Mail Flaw
Jasen Bell writes to mention a ZDNet article about a clever new worm affecting users of Yahoo!'s email service. The virus uses a flaw in JavaScript to infect a computer when an email is opened from the user's web-based mail. From the article: "The worm, which was spotted in the wild early this morning, has hit the remote server more than 100,000 times, forwarding Yahoo e-mail addresses harvested from unsuspecting users, Turner said. Although the worm is spreading quickly, and no patch has been issued, Symantec is rating the threat a '2.' The security vendor uses a 1-to-5 rating system, with '5' as its most severe category."
Fixed: At the time of the advisory, there was no patch for the vulnerability. But by later on Monday, Yahoo said it had come up with a fix for the flaw, which it said had affected very few of its customers.
I have to say I agree with the low threat level. All the virus does is propogate and collect email addresses, and only on yahoo. If you have a yahoo email address, you're getting spam anyway, so how will you even know the difference?
Yesterday by The Register
My question is: who thought it was a good idea to enable JavaScript in emails? Someone at Yahoo! wasn't paying attention to basic security.
GetOuttaMySpace - The Anti-Social Network
The article only mentions the systems affected (only Windows systems apparently) but not the browsers. However, it is the browser that executes the Javascript code, which steals the e-mail addresses from the Yahoo! address book. So, are they sure that a Linux-based system with Mozilla (such as mine) would not be affected by the worm ?
In Soviet Russia, our new overlords are belong to all your base.
Symantec is rating the threat a '2.'
The lowball number is interesting, especially given the fact that Symantec is the company charged with the task of keeping an outbreak like this from happening:
Symantec to scan Yahoo Mail for viruses
ZuluPad, the wiki notepad on crack
The article is lacking many details, like specifically which browsers seem to be vulnerable to this problem, or even if this is a browser bug that it is exploiting.... It could be a server side problem they are exploiting, or a client side browser bug. It says the vulnerable systems are every Windows OS, so it appears to be a client side problem with Internet Exploder, although from the article it is impossible to determine this.
A flaw in whose JS implementation then?
# cat
Damn, my RAM is full of llamas.
"flaw in JavaScript" - you really mean "flaw in JavaScript" or flaw in the implementation of the so-called "JavaScript"? I mean - all browsers with "JavaScript" are affected? Including mobile devices, linuxes, unixes...?
Well, I've got to get back to work. When I stop rowing, the slave ship just goes in circles.
Using cryptographic signatures to verify that an email is really from your friend, before you trust its contents, simply isn't an option.
well, the email *was* from his friend. His friend was infected. If his friend was using a standalone email client and using cryptographic signatures, then most likely, his friend would have entered his password for PGP or whatever, and that password would be stored in memory, and then when the virus took over his account and started sending mail, the virus would sign the mail.
So in this particular instance, I don't see how a standalone client would help things.
Don't see anything on the home page, my.yahoo, or even the login page of yahoo mail.
That's pretty shitty. How hard would it be to add a warning and some helpful directions to the template of the login page?
-William Shatner can be neither created nor destroyed.
and still collecting all those addresses
http://www.av3.net/
and the whois is of course using that American whois "privacy" service, perhaps the FBI would like to sift through their computers, iam sure a lot of online crime could be cleared up quite quickly
I agree with the parent on the bullet points, but I think the conclusion "death to webmail" is barking up the wrong tree. The real issue goes back to point number two: rendered in too powerful an environment. If e-mail was ALWAYS treated as text, instead of trying to support HTML and mime types blah blah then having a safe webmail interface would simply mean a control that shows the text as text only with no possible execution. Simple and what e-mail was always meant to be. If you need to send "pretty" stuff then send it as an attachment and let that be what it is.
I don't have a problem with rendering HTML in webmail or any other mail. Javascript is not HTML, however, and should NEVER be activated with webmail. A proper webmail client needs to filter out all script tags before display. They are not needed.