SEO

Yahoo Mail Fixes Security Flaw, Was Open to Account HiJacking

Yahoo Mail was open to hacker attacks due to a file size bug. ZDNet reports that a flaw in the Yahoo Mail system could have let attackers control victims’ Yahoo accounts

Yahoo has fixed a bug in its Yahoo Mail email system that would have allowed attackers to seize control of users’ email accounts. This bug enabled attackers to take control of a user’s account by simply sending them a specially crafted email.

The security flaw, according to eEye Digital Security’s Drew Copley:

Allowed attackers to by-pass the Web-mail system’s Javascript filters. Any message exceeding approximately 100kb in length would not be analysed by the filter, which is meant to strip messages of any potentially malicious Javascript.

“A remarkable note about this bug is that no one seems to have found it before,” Copley’s advisory reads. “As far as anyone knows.”

Technical Description:
———–EXAMPLE EMAIL———

SCRIPT
[->a bunch of chars here [spaces are most stealth], the whole file size will be just about 100KB]
[this causes the filter to not work... the code is then run automatically]

———————————

The pseudo-diagram above explains the scenario rather well. For whatever reason, Yahoo’s email filter simply does not work on files which exceed a certain range. This kind of software issue is relatively common. A remarkable note about this bug is that no one seems to have found it before.

Yahoo has fixed the Yahoo Mail bug.

Screen Shot 2014 04 15 at 7.21.12 AM Yahoo Mail Fixes Security Flaw, Was Open to Account HiJacking
Loren Baker is the Founder of SEJ, an Advisor at Alpha Brand Media and runs Foundation Digital, a digital marketing strategy & development agency.
Screen Shot 2014 04 15 at 7.21.12 AM Yahoo Mail Fixes Security Flaw, Was Open to Account HiJacking

You Might Also Like

Comments are closed.

48 thoughts on “Yahoo Mail Fixes Security Flaw, Was Open to Account HiJacking

  1. yesterday aboutblank ,a virus,got thru all 5 of my filters.was this related to the yahoo mail incident?users beware of aboutblank it is a terrible virus i have first hand knowledge!i am now a aboutblank survivor!

  2. Wish they had fixed it before my account was hacked by some jerks in Canada. I was blackmailed for $275 to return the account to me. YAHOO WOULD NOT RESPOND TO MY PLEAS FOR HELP. Instead the hacker knows that yahoo doesn’t respond and in a few hours they themselves respond representing themselves as an arm of yahoo to help me out. Referring me to a company who could recover my account. They of course were the hackers. I did get it back with a threat that the link had been traced and police should be arriving any moment.
    BOOOOOO ON YAHOOOOOOOOO

  3. my yahoo mail
    khan9559@yahoo.com
    is not opening. it gives again and again the message of INVALID PASSWORD. Although i type the right password and also I have not change the password.
    please help me how can i open my yahoo mail.
    regards
    jan

  4. Since the new Yahoo Mail was implemented yesterday, I find I cannot really use the account at all. I can log in and view emails, but cannot delete an email, cannot send or reply, and cannot move an email from one box to another. My other email accounts are working fine. Is anyone else having this problem? Or know how to fix it? I have made no recent changes in my internet options or settings. Yahoo does not respond to my help messages.

  5. I am not able to read my mail from my computer and able to do it from another.

  6. I cannot log in to my yahoo mail! I enter my username and password and then it “thinks” for a really long time and finally gives me the “cannot locate server” page — is there something wrong with my email? Or is there something wrong with yahoo? I haven’t been able to find a way to contact yahoo so I was hoping someone here could help! Thanks!

  7. I have a similar problem here with Yahoo. “Invalid password” always. However, sporadically, I can log in once only from my home computer.

    I am more inclined to think this is a major screw-up at Yahoo during Yahoo!Mail upgrade.

  8. Yahoo is seriously malfunctioning. I, too, am unable to send or delete any mail. If there is anyone out there who knows how to fix this problem please leave a message explaining how to correct the problem.

  9. I cannot log in no either. Cannot get my Yahoo ID to work. Yahoo mail gives invalid password. Just need to get in long enough to get messages, addresses and sh**can the account and go back to hotmail

  10. i want to know the hacknig password cos i need it to open a box wi forgot the password pls i need it urgently , i guess u can help by sending the password tomorrow to my email add.
    thanks alot

  11. I am unable to check my yahoo mail. After I type in the login address and the password, the browser takes me to aboutblank

  12. My Account, yahoo ID is ( deaconblooze2000 ) Why am I not able to use My yahoo ID and/or Read My e-mail? ( I’m not able to do anything ). I have had to start a NEW Yahoo Account. At ( http://www.coldshot_07@yahoo.com ) Will You Help Me? I need the information in that account, email addresses etc.

  13. My Yahoo account was just jacked and cusomer service just sends me form letters is ther anyway to find out who or get back into your own account????

  14. I am unable to open yahoo mail .Some times it opens and mostof the time it does not open

  15. i am unable to open my yahoo id (roja_sud@yahoo.com), though able to open yahoo messenger & yahoo photos with my id.

    As i enter my id & password, its giving ” CANNOT FIND SERVER” message. Or if i open yahoomail from messenger, its going to the page where it asks the profile information. i am able to open other yahoo ids from the same computer but unable to open roja_sud id.

    i did not find answers for this in Help Tips. Please do help me.

  16. hello,
    I’m unable to open my yahoo account “mca_yadav_lokesh@yahoo.co.in”, by entering right mailID and password (shows message” Invalid Id or Password”), same condition in my yahoo messenger also.
    plz help me

  17. Yahoo Mail Still Not Fixed!!!!!!!

    My wife’s email account was just hijacked at Yahoo. they changed her password and sent out scam mail to her address book. I hate to say it, but Yahoo needs a wake-up call. We use our email for everything from on-line shopping to liquidation buy-outs. I would hate to have to take legal action, but Hey, that might be what it will take.

    I have been using Yahoo since ’97 and have been a firm believer in their security. Was I Wrong??

    Very Violated

  18. is not opening. it gives again and again the message of INVALID PASSWORD. Although i type the right password and also I have not change the password.
    please help me how can i open my yahoo mail

  19. Same problem as abhay, I continually get the message of INVALID PASSWORD on every yahoo account I have. This stinks.

  20. • my yahoo mail
    mirthu_1@yahoo.co.in
    • is not opening. it gives again and again the message of INVALID PASSWORD. Although i type the right password and also I have not change the password.
    please help me how can i open my yahoo mail.
    regards
    kalyan

  21. am enterin correct id n password but its givin invalid n am nat able 2 open my mail. wat 2 du ..plzz help..its URGENT

  22. Maybe this site is not for responding back because I see no answer to what the problems habe been raised???

  23. hiii
    in some system my mail id is opening but in some system it is not opening .it will not gve any error message but again comes to login option please help me friends .i have checked all blocking options in those system but all are correct.

  24. i m unable to open my yahoo mail id account. messages are being received from my above account regarding lending dollars. i think somebody has hacked my mail account and misusing the same. Yahoo authorities is requested to take necessary action to seize the above mail id or free the said yahoo mail account under intimate to me on my another email -madhumishra56@yahoo.in.

    matter may be treated as most urgent on security point of view.

    RM

  25. can anyone please tel me how can i know at which places has my yahoo account been opened? can i get those ip addresses.. gmail provides this service.

  26. IF its co.in means in india
    uk means dubai
    uk.lodon like this it will came when u open ur id

    u say me when i open my yahoo id its not opening its oops cannot be displayed
    plz give the right answer