Major Yahoo Mail Vulnerability Discovered
A significant Yahoo Mail vulnerability has been discovered that has reportedly already resulted in a number of compromised accounts. The attack was first demonstrated by a hacker named Shahin Ramezany, who now claims that Yahoo’s initial fix is easy to work around. The last link even includes a video explaining how the cross-site-scripting (XSS) vulnerability works.
The Next Web closes its articles about this vulnerability with a couple of useful tips: Yahoo users should change their passwords immediately and take care not to click on suspicious links, even from senders they know (their friends’ accounts may already be compromised, allowing the attacker to send email from them).
This particular attack relies on persuading the victim to click on a link directing them to a site that harvests the contents of their Yahoo Mail cookies. The attacker then replaces the contents of two of their own cookies with those of the victim, allowing the attacker to effectively use Yahoo Mail’s “Remember Me”-style feature to bypass the password entry screen.