Feeds

Brute-force attacks target two-year hole in Yahoo! Mail

Your password is 123456

SANS - Survey on application security programs

Scammers are exploiting a two-year-old security hole in Yahoo's network that gives them unlimited opportunities to guess login credentials for Yahoo Mail accounts, a researcher said.

The vulnerability resides in a web application that automates the process of logging in to the widely used webmail service. Because it fails to carry out a variety of security checks followed by the login page Yahoo! Mail users typically use, it's providing criminals with a backdoor through which user accounts can be breached, said Ryan Barnett, director of application security research at Breach Security.

"If the front gate of your castle is your login page to Yahoo Mail, they've done a good job of securing it," he told The Register. The web application amounts to "some sort of water tunnel that the bad guys are walking right through."

Over the past seven weeks, a sensor deployed by WASC, or the Web Application Security Consortium, has detected "a few thousand" or more attempts to use the unprotected web application to carry out brute-force attacks on user passwords, Barnett said. Because the sensor is installed on just one of a massive number of open proxies, the honeypot is likely detecting only a small fraction of the overall activity, he added.

The data is some of the first to confirm what security professionals have suspected for almost a decade: A major contributor to the steady stream of account hijackings on a wide range of sites is overlooked backend web applications that aren't properly locked down.

"I fought these exact kinds of attack when I was at eBay," said Laura Mather, a former security employee at the online auction house who is now VP of product marketing at a company called Silver Tail Systems. "Almost every site I can think of has this problem."

Jeremiah Grossman, CTO of White Hat Security, concurred. "Every major social network and portal is seeing this brute-force attack," he said. "Now that Ryan has put this out, it's exposing what we already knew to be true."

The web application in this case appears to be a backend application programming interface that allows customers of Yahoo partners to check their Yahoo Mail without having to leave the partner website. Because it contains the text "config/isp_verify_user" in URLs, it's easy to track it using search engines. This Google search, for instance, showed hundreds of locations on Yahoo's network where it was deployed.

Among the security lapses leading to abuse of the API is its failure to implement what are known as access control lists, which restrict the computers that are allowed to use the service. While best practices dictate that only qualified partners have access to it, at time of writing, anyone could tap into it and plug in usernames and passwords to authenticate Yahoo Mail accounts.

Another failure is the wealth of information the app returns when invalid information is entered. When a user enters the wrong password for a valid username into Yahoo Mail's front end system, it returns a terse error message that says only that either one of them is incorrect.

By contrast, plugging a valid user ID and wrong password into the API returns a message that indicates the username is valid. And that gives attackers information that proves invaluable in further compromising the account. Armed with that information, criminals can run a long list of the most commonly used passwords against the user IDs. Because Yahoo has virtually no rules barring the use of weak passwords - "123456" is perfectly acceptable, for instance - a decent percentage of credentials can be deduced.

What's more, the front end presents Yahoo Mail users with a captcha if they've entered incorrect passwords an excessive number of times, a measure designed to thwart automated cracking scripts. The API, by contrast, never implements a captcha no matter how many incorrect credentials are entered.

"They're cycling through different common usernames, different common passwords," Barnett said, describing the modus operandi of many password crackers. "At least if a web application locks out an account or does something if it's under attack, that might buy you some more time. If they have unrestricted access to run these kinds of scams, then it's just a matter of time."

Once breached, the accounts prove to be a spammer goldmine, since spam filters typically give webmail services the green light. Even worse, criminals can use the accounts to break in to other, more lucrative accounts, such as those used for bank accounts and other financial services.

Barnett, who earlier this week blogged about the vulnerability here, said he's known of the flaws in the Yahoo API for years. He brought them to the attention of Yahoo officials in 2007, but as of Friday it still hadn't been fixed, he added.

"Yahoo! takes online security very seriously," a company spokesman said. "We are investigating the situation and will take appropriate action." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.