Monday, April 24, 2017
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
Micron and Microsoft To Collaborate On Internet of Things Security
The New Radeon Pro Duo Delivers The Power of Two Polaris 10 GPUs
Toshiba to Spin Off 4 Operations
Seagate And DJI Announce New Portable Drive For Storing Drone Footage
Nikon Takes Legal Actions Against ASML and Carl Zeiss Over Semiconductor Lithography Patents
LG X Power 2 Smartphone Packs A Huge Battery
Questions Remain About The Fate Of Toshiba's HDD and SSD Business
SK Hynix Develops First 8Gb GDDR6
Active Discussions
Which of these DVD media are the best, most durable?
How to back up a PS2 DL game
Copy a protected DVD?
roxio issues with xp pro
Help make DVDInfoPro better with dvdinfomantis!!!
menu making
Optiarc AD-7260S review
cdrw trouble
 Home > News > General Computing > Yahoo B...
Last 7 Days News : SU MO TU WE TH FR SA All News

Thursday, January 31, 2013
Yahoo Blog Hijacked, Bitdefender Says


An email-based attack has been hijacking Yahoo accounts, security software company Bitdefender Labs has reported.

The security firm warned that a spam wave that has been circulating for roughly a month has been stealing Yahoo login credentials by exploiting an old vulnerability in a component of the Yahoo Developers blog.

The spam message features a bit.ly shortened URL that takes the user to a web page impersonating the popular MSNBC page, but which turns out to be located on a series of subdomains on hxxp://com-im9.net.

Whois information for the domain reveals it was bought in Ukraine and hosted in a data center in Nicosia, Cyprus, Bitdefender says.

Once the user lands on the alleged MSNBC page, a piece of JavaScript code inside tries to exploit a known vulnerability (CVE-2012-3414) in the SWF Uploader component on the Yahoo Developers Blog, which is powered by WordPress.

Since the exploitable component is located on a sub-domain of the target website, the same-origin policy does not prevent the exploit code access to cookies, which are subsequently sent to the attacker. Once they have the log-in cookie, they can authenticate into the victim's account and send spam or harvest contacts' e-mail addresses for other spam campaigns.

Bitdefender's experts believe this is the account recruitment stage of the operation and we expect the next wave of messages to feature links to malware.

Bitdefender said it had notified Yahoo about the incident and had provided the proof-of-concept documentation.


Previous
Next
Up To $80 Discount For CyberLink's PowerDirector 11 Software        All News        DVD and Blu-ray Still Drive Home Entertainment Revenue
Vulnerability Affects Latest VLC Media Player     General Computing News      Chinese Hackers Target New York Times Servers

Get RSS feed Easy Print E-Mail this Message

Related News
Yahoo's First-quarter Revenue Jumps
Verizon Is Moving Yahoo and AOL Under the New Name "Oath"
U.S. Charges Russian Spies Over Yahoo Hacks
32 Million Yahoo Accounts Were Compromised Using Malicious Cookies
Verizon and Yahoo Agree to Lowered $4.48 billion Deal
Yahoo Unveils New Malicious Activity To User's Accounts
Yahoo Sees Verizon Deal Closing in Second Quarter
Yahoo To be Named Altaba, Mayer to Depart Following Verizon Deal
Yahoo Unveils New Security Breach
Yahoo's 2016 Top Searched Celebrities, News Stories, Fashion Trends, and More
Yahoo Investigates New Hack Claim
EU Privacy Authorities Warn WhatsApp on Data Privacy Policy, Yahoo on Breach

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2017 - All rights reserved -
Privacy policy - Contact Us .