Worm Wriggles Through Yahoo! Mail Flaw

Jasen Bell writes to mention a ZDNet article about a clever new worm affecting users of Yahoo!'s email service. The virus uses a flaw in JavaScript to infect a computer when an email is opened from the user's web-based mail. From the article: "The worm, which was spotted in the wild early this morning, has hit the remote server more than 100,000 times, forwarding Yahoo e-mail addresses harvested from unsuspecting users, Turner said. Although the worm is spreading quickly, and no patch has been issued, Symantec is rating the threat a '2.' The security vendor uses a 1-to-5 rating system, with '5' as its most severe category."

Copies available

I have a copy of this. I can forward it to anyone with a Yahoo! Mail account for further inspection. Isn't Open Source wonderful?

Fell for this yestereday

Yamanner arrives in a Yahoo mailbox bearing the subject header "New Graphic Site."

Damn ... I opened an email like this yesterday ... the reason being was because it was "from" one of my friends (they were marked as the sender). As soon as it opened I knew I f!cked up ... per a Javascript popup window shooting up ... grrr ...

Your "JavaScript"?

"flaw in JavaScript" - you really mean "flaw in JavaScript" or flaw in the implementation of the so-called "JavaScript"? I mean - all browsers with "JavaScript" are affected? Including mobile devices, linuxes, unixes...?

Not everyone affected...

With respect to:
Although the worm is spreading quickly, and no patch has been issued, Symantec is rating the threat a '2.'
According to Symantec [symantec.com], "The worm cannot run on the newest version of Yahoo Mail Beta." so I would use that if you are nervous, then again, you could also not open werid emails from people you don't know.

Fixed.

Fixed: At the time of the advisory, there was no patch for the vulnerability. But by later on Monday, Yahoo said it had come up with a fix for the flaw, which it said had affected very few of its customers.

I have to say I agree with the low threat level. All the virus does is propogate and collect email addresses, and only on yahoo. If you have a yahoo email address, you're getting spam anyway, so how will you even know the difference?

First reported

Yesterday by The Register [theregister.co.uk]

My question is: who thought it was a good idea to enable JavaScript in emails? Someone at Yahoo! wasn't paying attention to basic security.

Re:First reported

The article is wrong when it claims that it's "a flaw in JavaScript", it's a flaw in Yahoo's webmail. So the answer to your question is almost certainly: nobody thought it was a good idea to enable JavaScript in emails, the developers working on Yahoo's webmail didn't escape things properly and nobody was doing decent QA to catch the mistake the developers made. So basically, it's a management error.

There doesn't seem to be detailed technical information available anywhere, but it sounds very much like it's just a specialised form of an XSS attack, where you sneak code into the application in such a way that the application doesn't encode it properly for output to another user.

Medireview virus attacks yahoo.

I thought the security of yahoo would have captured a old [wikipedia.org] javascript virus by now. Bu i do not understand: how can this javascript break out the browsers? isn't yahoo just a webmail website? then how would the local pc be affected? why would you have to scan your pc as symantic tells you?

Ok, the virus can send a lot of e-mails and break the yahoo mail system. or si there something about yahoo mail i do not understand?

Re:Medireview virus attacks yahoo.

The poster's question is valid. He/she is asking if the JavaScript worm can actually do anything other that work within the browser, as in how can the worm "infect" the computer. The answer is that it can't. It only harvests the email addresses that are on your Yahoo addressbook, and emails itself to them, once again though Yahoo. So everything is done within the browser, and there is no compromise outside the browser's sandbox.

With a little creativity, this could be extended to grab a file off the HD, and send the data to any site it chose, but it does not sound like that is the case here.

Infecting the computer?

As I understand it, this doesn't infect the computer it runs on, it just uses the evils of Javascript to grap addresses from your contacts list and forward a copy to everyone in there while passing them on to a spammer site. There should be nothing left behind to 'infect' the computer it runs on, and it will run on anything that supports Javascript... which is needed to use Yahoo mail in the first place.

Just another reason why Javascript is evil.

Can't we all just leave each other alone?

Ironically, those of us with no contacts in our yahoo mail make for the best of friends!

Symantec

Symantec is rating the threat a '2.'

The lowball number is interesting, especially given the fact that Symantec is the company charged with the task of keeping an outbreak like this from happening:

Symantec to scan Yahoo Mail for viruses [infoworld.com]

Exploits a javascript bug?

The article is lacking many details, like specifically which browsers seem to be vulnerable to this problem, or even if this is a browser bug that it is exploiting.... It could be a server side problem they are exploiting, or a client side browser bug. It says the vulnerable systems are every Windows OS, so it appears to be a client side problem with Internet Exploder, although from the article it is impossible to determine this.

Here's the flaw that's exploited

It's fixed on yahoo's servers now, but according to the source link posted earlier, the flaw that's being exploited seems to be a bug in how yahoo parses html attributes. The bug sends itself as:

<img src='http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ ma_mail_1.gif'
target=""onload="whole bunch of crappy javascript here that uses only
single quotes and just goes on and on">

Note the lack of a space between the 'target' bit and the 'onload' bit. Now, apparently "target" is one of the HTML attributes that yahoo allows through on an IMG tag (why?). Anyway, it appears that yahoo's servers see both the target and the onload bit as one big long target attribute and let it through, whereas most browsers see that as a separate "target" and "onload" attribute and execute the javascript as soon as the image (one of the standard yahoo mail images, so it'll likely already be in the browser cache) is loaded.

The lesson here? I'm not really sure, beyond "double- and triple-check your parsing routines, since they will be used in security-sensitive code".

Spread?

I just got a wave of mails in my gmail box that are from random senders, with multiple small 1-4k attachements.

Anyone have any idea if this works on/through gmail too?

Behavior

The article doesn't really mention the behavior of the worm and is actually slightly misleading. It doesn't "infect" your computer per se, it harvests your address book contacts and then spams them. From a different article: [theregister.co.uk]

Once executed, the worm forwards itself to an infected users' contacts on Yahoo! Mail. It also harvests these address and sends them to a remote internet server. Only contacts with an email address of either @yahoo.com or @yahoogroups.com are hit by this behaviour.

As The Worm Turns...

I just tried to compose an email in my Yahoo! email account and was informed that my contact list failed to load. So did the worm eat my contact list?

BETA version not effected

I've seen lots of complaints about people using javascript and Yahoo!'s use of it. Yahoo!'s beta version is not effected by this worm.

FTFA, "The Yamanner worm targets all versions of Yahoo Web-based mail except the latest beta version, Symantec said in an advisory released Monday." (Emphisis mine)

Here is the Source, Luke.

Lameness filter got me. Here is a link [groovin.net].

Crime and punishment

In short, I believe there should be some very stiff penalties to pay if it is proven that someone has written and deployed malware of this sort. There should be prison time and forfeiture of any money and assets acquired as a result of gains from this activity.

People often complain that punishment is too severe for this otherwise 'harmless' activity (and often compared to more heinous crimes such as assault, robbery, murder sex/child related crimes) and that damages are quite often exaggerated beyond reason. I can't say much about exaggerated damages, but I can say that in addition to other classifications of crimes, I also consider the following:

Planned/premeditated or not. Many aspects of the more heinous crimes where punishment is often less than these "white collar" crimes are not planned or premeditated. They are driven by little more than emotional or other motives. There is something more cold, more dark and indeed more arrogant when it comes to crimes such as the act of creating and deploying an internet worm. There is no question that what they are doing is immoral and illegal. They perform the act believing they will not be caught, that they will profit from the act and seemingly that it is somehow their right to take advantages of weaknesses in security simply because they are 'superior' in some way.

I see a noticable decline in the amount of spam in my inboxes of late. People claimed that the current federal legislation regarding spam wasn't enough and yet I see stories of people being prosecuted under these law successfully and when these people are put out of business, most all see a difference -- an improvement. It's working.

We don't need more legislation, but we do need to up the level of aggression in persuing these people and up the amount of punishment they are given when they are caught. While they are thinking about their planned attacks, they need to have cause to consider the potential cost to their lives as well.

The subject field is important

If you did not open a mail whose subject was "New Graphic Site", you are not infected.

Reference: Symantec advisory at http://securityresponse.symantec.com/avcenter/venc /data/[e-mail] [symantec.com]

"a flaw in JavaScript"?

A flaw in whose JS implementation then?

The warm may not be as "innocent"

Some people tend to think that this worm is harmless (just "spreading itself"). But the worm actually sends the harvested email adresses to an external site - www.av3.net [which I wouldn't dare to browse to].

Here are the technical details of the worm:

1) Arrives on the compromised computer as an HTML email containing Javascript. The email may have the following characteristics:

From: Varies
Subject: New Graphic Site
Message body: Note: forwarded message attached.

2) Once the email is opened the worm exploits a vulnerability in the Yahoo email service to run a script.

3) Sends a copy of itself to certain email addresses gathered from the Yahoo email folders.

4) Targets email addresses from the @yahoo.com and @yahoogroups.com domains.

5) Contacts the following URL:

[http://]www.av3.net/index.htm

6) Sends a list of email addresses gathered to the above URL.

Lacks information

It would be nice to know if the worm affects any Web Browser or only the usual suspect (it seems so, for the platforms affected are only Windows 95-2003)

Why isn't Yahoo saying anything about this?

Don't see anything on the home page, my.yahoo, or even the login page of yahoo mail.

That's pretty shitty. How hard would it be to add a warning and some helpful directions to the template of the login page?

the creators website is still up

and still collecting all those addresses

http://www.av3.net/ [av3.net]

and the whois is of course using that American whois "privacy" service, perhaps the FBI would like to sift through their computers, iam sure a lot of online crime could be cleared up quite quickly

Don't open unknown emails

It should be standard practice not to even open emails if you're not certain the sender is legitimate, just delete them. Even if it's from someone you know, if you have any reason to be suspicious, (as in, perhaps their system was compromised and a virus is propagating itself by emailing everyone in their address book), don't open it. Check with the person first.

We who are "in the know" about this sort of thing should make sure our less technical family and friends follow this practice.

Yay for NoScript!

Bless Firefox and the NoScript (https://addons.mozilla.org/firefox/722/ [mozilla.org]) extension.

Does it affect limited user accounts?

Anyone know if the worm is able to wiggle into users with limited accounts?

Can you tell if you've been hit?

Does it leave traces behind? Do the outbound emails sent by the worm to propogate itself show up in the Sent folder? I know that I accidently opened one of those "New Graphic Site" emails the day before this hit the headlines; nothing strange happened at the time (e.g., no popups as some users have been mentioning).

I was using webmail on Mozilla on Linux, which usually makes me feel safe from things like this. There goes another false sense of security.

Crap

Sigh... I put myself on my own adress book... Man I'm screwed!

I guess that...

I guess that I'll be ok. Not too sure though. I got the "NoScript" extension for FireFox. Hopefully, I can say, "How can it infect me when the script is blocked in the beginning?"

Re:Very interesting

My ISP is Rogers (I live in Toronto, Canada,) they are a fast cable ISP but they outsorced their email handling to Yahoo. So I have an email account @rogers.com and I have to type my full email address to log into Yahoo. So I guess all Rogers customers maybe affected by this worm.

Re:Very interesting

The article only mentions the systems affected (only Windows systems apparently) but not the browsers. However, it is the browser that executes the Javascript code, which steals the e-mail addresses from the Yahoo! address book. So, are they sure that a Linux-based system with Mozilla (such as mine) would not be affected by the worm ?

Re:Very interesting

Any that will execute JS, from the look of it.

FireFox + NoScript for the win.

Re:"This worm is a 2."

Just copy-pasted this off symantec:

Category 5 - Very Severe
Highly dangerous threat type, very difficult to contain. All machines should download the latest virus definitions immediately and execute a scan. Email servers may need to come down. All three threat metrics must be High.

        * Wild: High
        * Damage: High
        * Distribution: High

Category 4 - Severe
Dangerous threat type, difficult to contain. The latest virus definitions should be downloaded immediately and deployed.

        * Wild: High
        * Damage or Distribution: High

Category 3 - Moderate
Threat type characterized either as highly wild (but reasonably harmless and containable) or potentially dangerous (and uncontainable) if released into the wild.

        * Wild: High
            or
        * Damage: High and Distribution: High

Category 2 - Low
Threat type characterized either as low or moderate wild threat (but reasonably harmless and containable) or non-wild threat characterized by an unusual damage or spread routine, or perhaps by some feature of the virus that makes headlines in the news.

        * Damage: High
            or
        * Distribution: High
            or
        * Wild: Low or Moderate

Category 1 - Very Low
Poses little threat to users. Rarely even makes headlines. No reports in the wild.

        * Wild: Low
        * Damage or Distribution: Low

Re:JavaScript and CSS

Redesign CSS now so it does not depend on enabling JavaScript.

Try:

crack-cocaine { smoke: false; }

Here ya go

from Learn about threat levels [symantec.com].
ThreatCon Level 1
Low : Basic network posture This condition applies when there is no discernible network incident activity and no malicious code activity with a moderate or severe risk rating. Under these conditions, only a routine security posture, designed to defeat normal network threats, is warranted. Automated systems and alerting mechanisms should be used.
Threatcon Level 2
Medium : Increased alertness
This condition applies when knowledge or the expectation of attack activity is present, without specific events occurring or when malicious code reaches a moderate risk rating. Under this condition, a careful examination of vulnerable and exposed systems is appropriate, security applications should be updated with new signatures and/or rules as soon as they become available and careful monitoring of logs is recommended. Changes to the security infrastructure are not required.
Threatcon Level 3
High : Known threat
This condition applies when an isolated threat to the computing infrastructure is currently underway or when malicious code reaches a severe risk rating. Under this condition, increased monitoring is necessary, security applications should be updated with new signatures and/or rules as soon as they become available and redeployment and reconfiguration of security systems is recommended. People should be able to maintain this posture for a few weeks at a time, as threats come and go.
Threatcon Level 4
Extreme : Full alert
This condition applies when extreme global network incident activity is in progress. Implementation of measures in this Threat Condition for more than a short period probably will create hardship and affect the normal operations of network infrastructure.

Re:Very interesting

But seriously, Yahoo Mail is nothing but a piece of crap. I wouldn't use it if it weren't for the groups which don't accept non Yahoo e-mail addresses. Reasons:
1) slow while browsing and full of annoying ads;
2) impossible to categorize my e-mails;
3) but the worse is that Yahoo messes up my e-mails with non-latin symbols.
GMail is far more convenient and just better.

Re:Symantec's rate "2" seems ok to me.

Anyway, i don't think anyone is using yahoo or other webmails for prefessional activities.

Oh, really? As a contractor, I used Yahoo! email to communicate with the outfit that cuts my paycheck and to send in my hours to the manager at the job site. Why? Because I don't have access to my regular email account from the job site due to the firewall configuration. Go figure.

Re:Symantec's rate "2" seems ok to me.

Yahoo does provide web hosting services. For $12 a month [yahoo.com], you get 5GB of disk space, and 200GB of data transfer. If you don't want to actually bother administrating your own server, that's a pretty good deal.

I am betting a fair number of small to medium businesses actually do use Yahoo! web hosting. But, since their paid services allow pop3 access, I am wondering how vulnerable those users are.

Re:"This worm is a 2."

we're at terror alert orange! Which means something might go down somewhere in some way at some point in time. So look sharp!

Re:Javascript == web security problem number 1

Users: disable javascript Devs: Make sure your site is functional without javascript What's so difficult to grasp here?

I agree 99%. I'd also recommend turning off your computer and hiding under your desk.

Re:Javascript == web security problem number 1

why should on earth does the BBC require people to enable Javascript to view a video?

More importantly: Why would the BBC require you to use a Browser to view a video?

Re:I thought...

That's second base. [everything2.com]

Re:Symantec's rate "2" seems ok to me.

Not true.
People think Yahoo/Hotmail are viable email services.

Look at this guy... He's running for Pa Senate, with a yahoo account. http://www.threesources.com/archives/002949.html [threesources.com]

Re:JavaScript and CSS

As far as I'm aware, the only browser which tied JavaScript and CSS support together was the craptacular Netscape 4.x. Modern browsers let you enable/disable them independently.

Re:"This worm is a 2."

Or that the worm did very poorly in the olympics?

No, all it means is that the Candian judges were coerced into giving the Russian virus a better score.

Re:Mac users aren't directly affected by this

> Mac users aren't directly affected by this

Correct: in exactly the same way that PC users aren't directly affected by this... Or Linux users...

The platform doesn't matter, you tool: the flaw is in Yahoo! Mail, not in the browser. It should spread in exactly the same way on any browser that has JavaScript turned on. You mentioned turning off HTML... Did you think about that a second? There is no EMail client involved in this.

You DO know that Yahoo! Mail options work the same on all platforms, right?

Re:Mac users aren't directly affected by this

Mac users ARE affected. I have seen it running on a MacOSX box running safari.

Re:Mac users aren't directly affected by this

Actually Mac are affected by this (unless you keep Java Script disabled). I noticed the virus when I receive a Mail from one of my Mac using friends.

Re:I thought...

So goatse girl is, like, a 5?