Yahoo! 0-day! exploit! hijacks! status! updates!
Right now I'm: spamming my contacts with malware links
Security researchers have discovered an unpatched flaw in Yahoo! Messenger that allows miscreants to change any user's status message.
Hijacked status updates are a handy way to persuade a victim's contacts to click on a link and lead them to a dangerous website. Worse still, the bug in version 11.x of the Messenger client requires minimal user interaction to work, unlike previous exploits that relied on conning prospective marks.
The attacker sends a supposed file to a target that is actually an iframe that swaps the status message for the attacker's customised text, as explained in a blog post by net security firm BitDefender here. The message might be, and in most attack scenarios would be, sent firm outside a targeted user's contact list.
If successfully executed, a victim will have no indication that his or her status message has been rewritten. The ruse might be used to gain affiliate incomes by promoting dodgy sites as well as directing users towards sites loaded with exploits or scareware scams.
Bitdefender said it has notified Yahoo about the vulnerability. Attacks based on the as yet unfixed flaw have already been detected in the wild, the Romanian security firm warns.
It advises users to change the setting of their IM client to “ignore anyone who is not in your Yahoo! Contacts" (which is off by default) as a precaution pending the release of a patch. In addition, some security suites include a web filter function that ought to defend users from this attack. ®
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
COMMENTS
Miranda IM
I've never installed any of the official messengers since 2004. Dabbled with Miranda IM back then and haven't looked back.
Point of Clarification
When i read this article my first thought was:
"Duh, don't accept file transfers from people you don't know"
When you actually read the MalwareCity blog that the article points to it clarifies that the exploit is actually injected into and run from the file transfer accept/deny dialog, so once you've got the request you're already 'sploited.
The el reg article says they're trying to send a file that's actually an iframe, but actually that iframe is already automatically sent and run.
The Bottomline action of denying off-list messages is still the same, but i think it's an important point of clarification.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
Steps to Take Before Choosing a Business Continuity Partner
