Webmail Vulnerability Compromised 40 Million Vodafone, Virgin, T-Mobile, and Telefonica Email Accounts
A webmail application vulnerability seriously compromised the security of 40 million accounts until it was fixed early last month, independent researchers said.
The flaw, in the Memova messaging application sold by a company known as Critical Path, is yet another testament to the power of cross site scripting vulnerabilities. Combined with another bug, it allowed attackers to surreptitiously forward the email of millions of end-users from some of Europe’s biggest internet service providers.
“The attacker only needs to send a specially crafted email to his victim,” independent researchers Rosario Valotta and Matteo Carli wrote in an advisory. “As soon as the victim opens the mail (no further interaction required) the forwarding settings of his webmail account of silently modified.”
The researchers tested a proof-of-concept attack on Italian ISPs Tiscali, Libero (also known as Wind) and Virgilio (aka Telecom) and found all three to be vulnerable. Using Critical Path press releases announcing customer deployments, they say about a dozen other large ISPs also used Memova, including Vodafone, Virgin, T-Mobile, and Telefonica.
Critical Path issued an update patching the vulnerability shortly after it was brought to their attention. “They answered immediately to our advisory,” researcher said. By last week, all of Critical Path’s customers had installed it, he added.
What’s notable here is that two of the three sites Valotta and Carli tested had implemented protections designed to mitigate the exploitation of XSS vulnerabilities. Specifically, the providers designated one domain for webmail and a separate domain for iframes that display the mail content. Even still, the researchers found a way to bypass the protection using a technique known as reflected XSS.
Currently there are no reports the vulnerability was exploited in the wild.
Credit: The Register
More on CyberInsecure:
Print This Post
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.