Worm Wriggles Through Yahoo! Mail Flaw 186
Jasen Bell writes to mention a ZDNet article about a clever new worm affecting users of Yahoo!'s email service. The virus uses a flaw in JavaScript to infect a computer when an email is opened from the user's web-based mail. From the article: "The worm, which was spotted in the wild early this morning, has hit the remote server more than 100,000 times, forwarding Yahoo e-mail addresses harvested from unsuspecting users, Turner said. Although the worm is spreading quickly, and no patch has been issued, Symantec is rating the threat a '2.' The security vendor uses a 1-to-5 rating system, with '5' as its most severe category."
Fixed. (Score:4, Insightful)
I have to say I agree with the low threat level. All the virus does is propogate and collect email addresses, and only on yahoo. If you have a yahoo email address, you're getting spam anyway, so how will you even know the difference?
First reported (Score:5, Insightful)
Yesterday by The Register [theregister.co.uk]
My question is: who thought it was a good idea to enable JavaScript in emails? Someone at Yahoo! wasn't paying attention to basic security.
Re:Very interesting (Score:3, Insightful)
Symantec (Score:4, Insightful)
The lowball number is interesting, especially given the fact that Symantec is the company charged with the task of keeping an outbreak like this from happening:
Symantec to scan Yahoo Mail for viruses [infoworld.com]
Exploits a javascript bug? (Score:3, Insightful)
"a flaw in JavaScript"? (Score:3, Insightful)
Your "JavaScript"? (Score:4, Insightful)
Re:This is an example of webmail's suckiness (Score:3, Insightful)
well, the email *was* from his friend. His friend was infected. If his friend was using a standalone email client and using cryptographic signatures, then most likely, his friend would have entered his password for PGP or whatever, and that password would be stored in memory, and then when the virus took over his account and started sending mail, the virus would sign the mail.
So in this particular instance, I don't see how a standalone client would help things.
Why isn't Yahoo saying anything about this? (Score:3, Insightful)
That's pretty shitty. How hard would it be to add a warning and some helpful directions to the template of the login page?
the creators website is still up (Score:1, Insightful)
and still collecting all those addresses
http://www.av3.net/ [av3.net]
and the whois is of course using that American whois "privacy" service, perhaps the FBI would like to sift through their computers, iam sure a lot of online crime could be cleared up quite quickly
Re:Symantec (Score:2, Insightful)
The article you linked to mentions that it is Symantec's job to scan Yahoo attachments for viruses.
This Worm that we are talking about though is not even passed via attachments so there is no way (with the agreement mentioned in that article) that Symantec can actually clean it for Yahoo.
"Unlike its predecessors, which would require the user to open an attachment in order to launch and propagate, JS-Yamanner makes use of a security hole in the Yahoo! web mail program in order to spread to other Yahoo! users."
This bug will have to be fixed server side by cleaning out the Javascript that is still being allowed in email messages. This is something I doubt Yahoo gave Symantec access to do.
Re:This is an example of webmail's suckiness (Score:3, Insightful)
Re:This is an example of webmail's suckiness (Score:2, Insightful)