Unpatched Yahoo! Messenger Flaw Allows Status Updates Remote Hijacking
Security researchers have discovered an unpatched flaw in Yahoo! Messenger that allows miscreants to change any user’s status message.
Hijacked status updates are a handy way to persuade a victim’s contacts to click on a link and lead them to a dangerous website. Worse still, the bug in version 11.x of the Messenger client requires minimal user interaction to work, unlike previous exploits that relied on conning prospective marks.
The attacker sends a supposed file to a target that is actually an iframe that swaps the status message for the attacker’s customized text, as explained in a net security firm BitDefender blog. The message might be, and in most attack scenarios would be, sent firm outside a targeted user’s contact list.
If successfully executed, a victim will have no indication that his or her status message has been rewritten. The ruse might be used to gain affiliate incomes by promoting dodgy sites as well as directing users towards sites loaded with exploits or scareware scams.
Bitdefender said it has notified Yahoo about the vulnerability. Attacks based on the as yet unfixed flaw have already been detected in the wild, the Romanian security firm warns.
It advises users to change the setting of their IM client to “ignore anyone who is not in your Yahoo! Contacts” (which is off by default) as a precaution pending the release of a patch. In addition, some security suites include a web filter function that ought to defend users from this attack.
Credit: The Register
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.