Slashdot Mirror
"Lax" Crossdomain Policy Puts Yahoo Mail At Risk
msm1267 writes A researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that put email message content, contact information and much more at risk. The researcher said the weakness is relatively simple to exploit and puts users at high risk for data loss, identity theft, and more. Yahoo has patched one issue related to a specific .swf file hosted on Yahoo's content delivery network that contained a vulnerability that could give an attacker complete control over Yahoo Mail accounts cross origin. While the patch fixed this specific issue, the larger overall configuration issue remains, meaning that other vulnerable .swf files hosted outside the Yahoo CDN and on another Yahoo subdomain could be manipulated the same way.
I thought Flash was so nearly dead now that all that was left was pronouncement by two qualified physicians. I seriously find it hard to believe that a modern firm like Yahoo would even support it at this point.
Time is what keeps everything from happening all at once.
I love how I get proven right in the face of idiots with mod points.
Except...you didn't. Yahoo's email got screwed by *YAHOO'S* CDN, which is run by Yahoo on a yahoo.com domain. Their problem is that they failed to pass the buck to someone who could actually manage their content securely. You claimed that a CDN allows others to infect the shared CDN content which then would infect those people that used them. Here, the problem was that Yahoo Mail decided to trust everything with a yahoo.com domain or sub-domain, and a different part of Yahoo made an SWF file that allowed privilege escalation.
If Yahoo had used a proper CDN with a different domain like akamai.net, then they wouldn't have had this particular problem. That'll teach them to follow your advice. The worst part is that you read this as you being right when actually reading what happened shows that you had things completely backwards.
I care. You wouldn't have posted unless you care too. Fearing enough that he might be taken seriously that you'd field a ham-fisted attempt to discredit him is still a type of caring.
Well, you need a lax SWF policy to allow the SWFs to swim upstream and spawn.
"We consider that six courts and an asylum claim are a rather odd way of returning to Sweden within a month."
Of all the email front ends that I have ever used, I have nothing but slowness and crashes from Yahoo no matter what platform I'm on.
Anyone else having this experience?
blindly antisocialist = antisocial
This is why my Yahoo account is my "disposable account" creation SH*TBOX . Way back since 1998
I'm completely shocked to hear this.
No, wait, I'm not surprised at all. Flash has been a security hole for as long as it has existed.
I don't understand why people let web sites run arbitrary code. Adobe made a horrible platform from a security perspective, and it's been pretty much constantly in the headlines since.
I honestly don't know why people continue to trust the damned thing, and can't believe the sheer number of times I've heard it's been a vector for security holes. Donzens? Hundreds?
Seriously, just stop running the damned thing.
Lost at C:>. Found at C.
Why does Yahoo still exist?
"If any question why we died, Tell them because our fathers lied."
That's funny, because YouTube happily rolls over to HTML5 when you don't have Flash installed, and it works just fine.
As much as it pissed me off when Jobs said 'no Flash on the iPhone', it was a brilliant move at weaning the world from one of the least secure software packages in history. It's impossible to change the whole world at once, especially when Adobe is trying so desperately to cling to this albatross, but Adobe has never taken the responsibility for building a new, secure engine and eliminating the backward compatibility holes. They just keep enabling vulnerability after vulnerability.
Flash may not be dead, but it's long past its time to live.
John
When has yahoo mail ever really been secure? Every couple of years it "Yahoo mail has a security hole because of (insert issue here)".
"Except...you didn't."
You didn't bother reading the rest of the article, did you? It goes right on to cover how this affects OUTSIDE sites using Yahoo's Advertising CDN.
Which STILL PROVES MY POINT.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I remember the days when the highest rated comment on Slashdot would be a nice summary of the salient point of the article with some insightful agreement or disagreement.
Its an obvious and simple problem that has plagued their services for a very long time, in one or another similar incarnation at least. I'm quite sure in fact that they are actively avoiding hiring anyone who looks like they are experienced enough to notice and seem willing to speak up about it.
Because Flash still works on many old browsers. YouTube wants to serve as many people as they can, and want to avoid as many technical issues as they can. They know there are many people who got something working five or more years ago that haven't upgraded their browsers to anything that can display HTML5.
John