Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Bug Internet Explorer The Internet

Yahoo and Hotmail Filter Flaw 250

Posted by CowboyNeal from the shields-up-and-drop-to-impulse dept.
gandam writes "Israeli computer security firm GreyMagic Software has detected a serious security flaw in Yahoo's Web e-mail service and Microsoft Corp.'s Hotmail service, which could allow hackers to run malicious scripts on users' computers. I tried sending a mail to my yahoo account and it never reached my mailbox. According to the website, all attempts to contact Yahoo unfortunately failed. Mail was sent to security and secure at yahoo.com and at yahoo-inc.com. No replies were received to date. Works only in IE5, though."
This discussion has been archived. No new comments can be posted.

Yahoo and Hotmail Filter Flaw More

Yahoo and Hotmail Filter Flaw

Comments Filter:

  • Works only in IE5, though? (Score:5, Funny)

    by slycer9 ( 264565 ) on Wednesday March 24, 2004 @09:32PM (#8663083) Journal
    Surely that's gotta be wrong! A security hole in IE???
    No freakin' WAY!?

    • Re:Works only in IE5, though? (Score:5, Informative)

      by xpl_the_myst ( 612106 ) on Wednesday March 24, 2004 @09:36PM (#8663110)
      And this is the reason it works only in IE5. Non-standard methods :

      However, Hotmail completely filters out that element, so another method of namespace declaration is needed. It so happens that Internet Explorer provides one other mechanism to declare a namespace, via the non-standard <?xml:namespace> processing instruction, which may be used anywhere in the document and does not get filtered.

      • Re:Works only in IE5, though? (Score:2, Interesting)

        by Anonymous Coward
        Here's a question: What are the odds that this came to the surface due to the leaked source code? It contained code from IE 5 IIRC...
      • I think the most important lesson is in how to filter things. Do not have a list of 'bad' content and remove that, because there might always be something you hadn't thought of (<?xml:namespace> in this case). Instead define what you will allow, and block everything else. Yahoo and Hotmail need to start with the HTML DTD, decide which elements and attributes are considered safe, and write a program to chomp through documents letting only those things through.

        That won't protect you if Microsoft dec

    • Re:Works only in IE5, though? (Score:5, Informative)

      by NickFitz ( 5849 ) <slashdot@@@nickfitz...co...uk> on Wednesday March 24, 2004 @09:44PM (#8663183) Homepage

      I just tried it on IE6, and it works there too - should have said "IE5 upwards", I suppose.

      (For those who don't know, MS's versioning is so bizarre that IE5 and IE5.5 are different in more than minor version number, while IE6 is pretty much IE5.5.1. No, I don't understand either; but I'm always glad of a reminder of why I use a Mac these days :-)

      • Version numbers are almost meaningless (Score:5, Interesting)

        by Prof. Pi ( 199260 ) on Thursday March 25, 2004 @02:54AM (#8665019)
        IE5 and IE5.5 are different in more than minor version number, while IE6 is pretty much IE5.5.1.

        When I worked for a VLSI team in Boston in the late eighties, our CAD vendor had a support contract which promised one major release a year. But it was almost a year since version 4.0, and their new release wasn't ready. So they just patched their latest release (4.2) with some bug fixes and a few minor features, and shipped it as 5.0. Everyone could see it was basically the same as 4.0 + patches.

        When version 5.1 came out a few months later, that was a huge change over 5.0! They replaced their standard menu-for-newbies + hotkeys-for-experts interface with the most hideous UI I've ever had the misfortune of using. It was based on "mouse gestures." You were supposed to "draw" a D with your mouse to delete a selected object, for instance. Half the time it would get the wrong gesture. Our productivity dropped precipitously, but because the 5.0 release had been rushed, there were bugs that were fixed in 5.1 and we couldn't work with the 5.0. So many customers complained that they quickly came out with 5.2, which was just 5.0 with the known bugs fixed.

        So I've learned that the positions of the digits don't necessarily mean anything. Hell, you can't even assume monotonicity all the time!

      • MS's versioning is so bizarre that IE5 and IE5.5 are different in more than minor version number, while IE6 is pretty much IE5.5.1

        I wouldn't agree with your assesment that IE6 was a minor update to IE5.5. IE5.0 to 5.5 was probably a bigger change (and should have been called 6.0), but there were some big changes [microsoft.com], including print preview, privacy enhancements, .NET WinForm hosting, that damn image toolbar, and most importantly, big improvements in CSS [microsoft.com].

    • RTFA: *NOT* an IE bug. (Score:5, Informative)

      by Jack Porter ( 310054 ) on Thursday March 25, 2004 @01:18AM (#8664544)
      This is a bug in Hotmail and Yahoo's filtering of HTML and scripting code. Normally these sites strip any script code, but this is a new way of injecting arbitary script code into the HTML page Hotmail or Yahoo gives you showing the email you wanted to view.

      An attacker could craft an HTML email that, when viewed in your inbox on Yahoo or Hotmail will execute some JavaScript or other script code from within the context of the Hotmail.com or Yahoo.com window. So it could do nasty things like deleting your messages automatically, forwaring your emails to another address, etc.

      It does NOT allow your computer to execute native code unless the attack exploits some other browser-specific vulnerability.

      Webmail will always be succeptible to these kinds of attacks if it does not carefully filter out HTML using any number of obscure features to insert malicious script in the Hotmail.com output.
      • Wrong!
        (mostly).

        While it's true that this is a filtering bug in Hotmail and Yahoo, the reason it's a problem is because "It so happens that Internet Explorer provides one other mechanism to declare a namespace, via the non-standard <?xml:namespace> processing instruction.

        So once again, the web designers have to work around IE's non-standards compliance.
        • So if you think it's a bug in IE, what do you suggest Microsoft changes in IE to fix this bug?

          Should they release a patch which removes said (non-standard) feature?

          • Re:RTFA: *NOT* an IE bug. (Score:4, Insightful)

            by FireFury03 ( 653718 ) <`slashdot' `at' `nexusuk.org'> on Thursday March 25, 2004 @09:04AM (#8666110) Homepage
            I would've thought it obvious that the non-standard feature should never have been implemented to start with.

            Besides, MS have shown in the past that they're happy to completely remove [theregister.co.uk] completely standard features that have completely legitimate uses rather than just fixing the bug that makes them dangerous, so why should they find removing a nonstandard feature any more of a problem?

            Microsoft have cornered the market with a bugridden browser that they have no motivation to improve by bundling it with standard windows - no web developer wants to alienate 95% of their visitors by refusing to support such a broken piece of software, so web developers are stuck in the continual situation of having to work around the bugs in IE rather than using all those cool features [w3.org] that every other browser supports (and have supported for a long time).

  • Better free email (Score:4, Informative)

    by Patik ( 584959 ) * <cpatik@@@gmail...com> on Wednesday March 24, 2004 @09:32PM (#8663084) Homepage Journal
    Try myway.com [myway.com]. It's basically a Yahoo clone, only it doesn't have any banners or popups, and you barely need to put in any information when you sign up -- not even a separate email address.

    Myway [myway.com] is also great as a portal or homepage, it's much more customizeable than any other site I've seen, and again, no banners or popups.

    You can also read all AP and Reuters stories with no registration, and there's partner links to NY Times and other reg-req'd sites (great for submitting articles to Slashdot).

    • How much disk space do they give you? Is there a limit on the number of attatchments or size?

      --
      Hot deals. You won't be sorry! [dealsites.net]

    • Does it have Pay for POP3 access? (Score:5, Insightful)

      by Azureflare ( 645778 ) on Wednesday March 24, 2004 @09:43PM (#8663174)
      That's the whole reason I use yahoo. That and I get about 2 pieces of spam a week. I love yahoo, and I've had it for 6 years now. I got it when rocketmail and yahoo were still separate.

      I love being able to use yahoo with pop3, I like it a lot better than my ISP email.

      Also you know what's funny? myway.com is in my hosts file routed to 0.0.0.0. It's blocked from my computer, as a ad/spam domain. I unblocked it, and I can't see any features of myway on their site. It looks like an almost identical clone to yahoo. It goes back in the hosts file.

      I think I'll stick with good ol' reliable yahoo. It's only been down once in the past two years.

      BTW, I use linux, so I don't need to worry about this silly IE vulnerability. (I don't even use the webclient anyway).

      • I have to agree with you here, I too have had been using yahoo mail since rocketmail. Yahoo notepad is another reason I like yahoo mail so much, I don't have to keep emailing myself small bits of information.
      • FYI - POP3 access is only available for Yahoo! if you pay for. I forget what the actual yearly costs are, probably around $30. However, Yahoo!POPs [sourceforge.net] is freeware that you can access your Yahoo! mail on. It sets up a localhost for the SMTP and POP3 server, and it remotely accesses yahoo! and translates the HTML email pages. Very incredible free program!
        • Not true. I just activated POP access on my Yahoo account yesterday and it didn't cost me anything. Surprising, because I'm pretty sure you used to have to pay, but no longer it seems. What you do have to do is agree to recieve one advertising email a week from them, to your choice of address. Not a big deal IMHO.
      • I signed with Yahoo in 1996, from no spam at all I am now receiving 100+ messages a day.

        The irritating thing is that at least 5 or 6 make it to my Inbox that could have been clearly filtered.

        Also false positives are common, so I am forced to check the last page of spam for legit messages before removing the full lot.

        Very dissapointing, specially since early adopters like me, that got a yahoo.com address have to pay for POP3 access (the people sying you don't have to are clearly uninformed). WIth POP3 I w

    • Myway uses adware. (Score:5, Informative)

      by Azureflare ( 645778 ) on Wednesday March 24, 2004 @09:49PM (#8663218)
      I just did a google search and came up with this:: MyWay Speedbar [scumware.com]

      Sorry, but I'm not willing to get email with a service that supports the use of adware/scumware.

      • Re:Myway uses adware. (Score:4, Funny)

        by geekoid ( 135745 ) <dadinportland @ y a hoo.com> on Wednesday March 24, 2004 @09:53PM (#8663243) Homepage Journal
        Thats why you don't have to enter much information when you sign up. It gets it for you..it's a feature...yeah, thats it.

      • Re:Myway uses adware. (Score:3, Informative)

        by Patik ( 584959 ) *
        You don't get adware from using MyWay's news or email services, but from downloading an IE toolbar. How many people on Slashdot are going to do that?

      • Re:Myway uses adware. (Score:4, Informative)

        by HD Webdev ( 247266 ) on Thursday March 25, 2004 @12:01AM (#8664052) Homepage Journal
        Sorry, but I'm not willing to get email with a service that supports the use of adware/scumware.

        I looked at the linked page, but although it made several accusations, it almost, but not quite, actually backs up those accusations with facts. It's rather vague. For instance, the "How does it Violate Privacy?" doesn't say how it violates privacy. WTF?

        What's strange also is that in contrast to the article, the ratings are as low as possible. All of them are:

        "1 - The lowest on the scale of 1 to 5, exhibiting a few potentially harmful or scummy traits with little effect on the end user.".

        vim would receive the same ratings.

        I'd never looked at the scumware site until now, but I do hope that their reviews more often than not include some useful information. I'd like to have an informative scumware site to look information up at.
    • I currently recommend My Real Box [myrealbox.com] by Novell.

  • phew... (Score:4, Funny)

    by rajinder ( 303281 ) on Wednesday March 24, 2004 @09:33PM (#8663094)
    ...almost paniced, then I noticed:

    only works in IE5 though...

    hmm... <mouseGesture>down-right</mouseGesture&gt ;

    • More details for those interested (Score:5, Informative)

      by securitas ( 411694 ) on Wednesday March 24, 2004 @09:44PM (#8663190) Homepage Journal


      Tried submitting this a couple of times since yesterday but the submission system seems to have picked up a few bugs of its own where it says "Thanks for the submission" but nothing shows up in the queue. Here are the details...

      Yahoo, Hotmail Users Vulnerable to XSS PC Attack

      Both Yahoo Web e-mail and Microsoft Hotmail are vulnerable to an Internet Explorer cross-site scripting (XSS) attack [infoworld.com] that lets malicious users run local code, according to Israel's GreyMagic [greymagic.com] security consultants (proof of concept [greymagic.com]). Possible consequences range from theft of login and password to a remote takeover of the compromised machine. Reports indicate that Microsoft has patched the hole but Yahoo has yet to solve the problem. The vulnerability presumably affects Windows PC-based versions of Internet Explorer only. Some people might want to read this developerWorks article on how to prevent cross-site scripting and protect oneself [ibm.com], mentioned last month [slashdot.org] on Slashdot. More coverage at InternetNews [internetnews.com] and The Register [theregister.co.uk].

    • Re:phew... (Score:5, Informative)

      by orthogonal ( 588627 ) on Wednesday March 24, 2004 @10:02PM (#8663311) Journal
      only works in IE5 though...

      Well, that is what the article says, but the proof of concept page [greymagic.com] also works in IE 6.0 (6.0.2800.1106)

      As it happens, provoked by receiving he Netsky virus embedded in an html email in Outlook that attempted to launch via an iframe, I happened to download Spybot Search and Destroy.

      Using Spybot Search & Destroy, I found out about another Grey Magic discovered vulnerability, Executing arbitrary commands without Active Scripting or ActiveX [greymagic.com]. I also discovered that I'd apparently had an Alexa phone-home browser extension installed as a "Browser Helper Object" in IE, god knows for how long.

      I've been using Mozilla FireWhatever for quite sometime, eschewing Internet Explorer except for those sites that don't work with IE or for testing my own sites in IE. But clearly, even a careful user with an up-to-date copy of IE and a firewall, isn't safe, principally because rather than concentrate on security and getting what they already have working securely, Microsoft prefers to pile on ever-accumulating layers of non-essential crap like HTML-TIME .

      I've no idea why someone thought that HTML-TIME, ostensibly for adding "timing and media synchronization support" to HTMl, required the ability to arbitrarily re-write pages. But clearly it's nothing that's desirable in an email.

      My course is clear at this point: after repeated attempts, Microsoft still can't get it right, still cannot write a browser that's anywhere near secure. Crap like "HTML + TIME" is NOT worth the risks it brings with it -- especially when the risks are borne by the end-user in order to make life easier for (generally commercial) web site developers. Boycott IE, and boycott sites that only work in IE -- even if -- especially if, they use Microsoft extensions like "HTML + TIME".

      • Re:phew... (Score:3, Interesting)

        by Safety Cap ( 253500 )

        Boycott IE, and boycott sites that only work in IE ~.

        You're advocating boycotting the POS browser that at least 95% of people use. While a noble cause, IE is here to stay, warts, bugs 'n all. The best you can probably do it get your friends/family converted (no more popups!), but corp America won't go for it, and neither will Grandmaw who can't install jack shit (except for gator and hotbar, of course).

        If only FireFox would take a page from these slimebags and make it as easy to install the better browser

        • If only FireFox would take a page from these slimebags and make it as easy to install the better browser as it is to install Hotbar. We could get way more people converted that way.

          That's actually a pretty good idea, at first glance anyway:

          Promote Fire/Moz~ the way gator, or Monkey, or wondertoolbar, whatever that crap is people install. Don't look at from the tech view that most of us here share, look at it from grandmas view, and take a page from the marketers. Don't make them feel foolish for not swit

        • You're advocating boycotting the POS browser that at least 95% of people use. While a noble cause, IE is here to stay, warts, bugs 'n all. The best you can probably do it get your friends/family converted (no more popups!), but corp America won't go for it, and neither will Grandmaw who can't install jack shit (except for gator and hotbar, of course).

          If only FireFox would take a page from these slimebags and make it as easy to install the better browser as it is to install Hotbar. We could get way more
      • Holy cow.

        I have never heard of HTML-TIME and just looked at the specification [w3.org]. I have now read the entire thing. There is nothing in that entire specification that can't be accomplished (and in all likelihood, better and more flexibly accomplished) by giving Javascript access to a more accurate timer (the same one that HTML+TIME will need to work correctly), a couple of additional properties on reflected movie object, and a Javascript library (where each library could offer different things to different us

      • Re:phew... (Score:3, Informative)

        by yppiz ( 574466 )
        orthogonal writes:

        I also discovered that I'd apparently had an Alexa phone-home browser extension installed as a "Browser Helper Object" in IE, god knows for how long.

        I believe the Alexa BHO you saw is one that Microsoft includes in IE's for the "Show Related Links" tool. This is similar to Netscape and Mozilla's "What's Related" button. This BHO only phones home when you do "Tools -> Show Related Links"

        Alexa also makes a separate downloadable toolbar that shows related links automatically on each

    • I wonder how many other people caught the Opera "close window" reference...

      Or maybe you have Firefox with mouse gestures...

  • Only in IE5 (Score:2, Interesting)

    by Hanzie ( 16075 ) *
    Had me worried there for a second.

    Still, I've got friends who run IE, and now they'll have incentive to learn the true joys of Mozilla FireFox.

    Thanks for the heads-up.

    hanzie

  • new spamming opportunity (Score:4, Funny)

    by laugau ( 144794 ) on Wednesday March 24, 2004 @09:34PM (#8663098)
    Just have the malicious code make the browser go to my viagra site and force the user to buy 10 cases. That would make me an ULTRA spammer.

    Once I do this, I will be able to afford that sould I've been eying on eBay all week.

  • Another reason (Score:3, Interesting)

    by Anonymous Coward on Wednesday March 24, 2004 @09:34PM (#8663100)
    to use Mozilla, Konqueror, Opera, et al instead of IE.

  • Hotmail evidently fixed (Score:4, Informative)

    by Strudelkugel ( 594414 ) on Wednesday March 24, 2004 @09:36PM (#8663112)

    "Solution: GreyMagic started work on this issue with Microsoft on 11-Mar-2004. They have quickly confirmed our findings and were able to produce a fix less than two days later. As a result, Hotmail is no longer vulnerable to this method of exploitation. All attempts to contact Yahoo unfortunately failed. Mail was sent to security and secure at yahoo.com and at yahoo-inc.com, no replies were received to date. "

    • Re:Hotmail evidently fixed (Score:5, Insightful)

      by Call Me Black Cloud ( 616282 ) on Wednesday March 24, 2004 @09:42PM (#8663172)
      Yes, Hotmail was fixed in less than 2 days. That's impressive. You won't hear much about it because it's Microsoft. If Hotmail was open source you'd be reading posts trumpeting the superior open source development model. "See how we joined hands and overcame the problem quickly!"

      Well, all I can say is: See how Microsoft worked with a (foreign) company and fixed the problem less than 2 days after hearing about it. This company is clearly focused on security.
      • yeah, and i wonder what they broke in the process ala Office SP3 and the iframe email tag fiasco in 2002.

      • Re:Hotmail evidently fixed (Score:5, Insightful)

        by quantaman ( 517394 ) on Wednesday March 24, 2004 @10:09PM (#8663371)
        I don't really want to jump in on the open source vs. microsoft security debate here but I think there are a couple important points here, first you're talking about a sample size of 1 here for MS on the contrary most open source security holes I hear about on /. are patched in less than 2 days as well (sometimes hours though those patches don't always work:). But more important this isn't really in the same categories as other security holes, most holes are with microsoft products and there they can drag their feet in releasing a patch because even when the a member of the public has their machine comprimized by a virus (which the patch usually predates) they don't associate microsoft with the problem. A problem with affecting hotmail however is a problem with a microsoft service and thus would be immediatly associated with microsoft and would recieve a much higher priority in being fixed. Not to say that open source is better just that this isn't a good example to cmopare the two.
        • >you're talking about a sample size of 1 here for MS on the contrary most open source security holes I hear about on /. are patched in less than 2 days

          And you are talking about a sample size of 1 for websites as a source of news.

          And a highly biased one at that.
        • most holes are with microsoft products and there they can drag their feet in releasing a patch because even when the a member of the public has their machine comprimized by a virus (which the patch usually predates) they don't associate microsoft with the problem. A problem with affecting hotmail however is a problem with a microsoft service and thus would be immediatly associated with microsoft and would recieve a much higher priority in being fixed.

          I'm not sure about that... Hotmail is essentially one b

      • Attribute that speediness to the techs who are on the ball and paying attention to vulnerabilities. You can't say that good techs are only limited to proprietary business models or open source. In the end, it boils down to the quality of people who are on the job.

        You say this company is clearly focused on security; well, it should be, after all the trouble Microsoft has been through recently (all those exploits for windows that were, needless to say, pretty major).

        Whatever people may say, Microsoft has

      • Mmmm "5 Insightful"?

        Respsonding to a comment currently rated by /. readers at +5 which points out how fast MS fixed a problem with a response that complains the world is unfair to MS. And to cap it all you get rewarded with a +5. Oh the bias. Bloody Linux zealots.

        C'mon Bill, you don't need this subversive PR, tell us what you really think [slashdot.org].

      • I see no evidence of Microsoft doing any such thing.

        I DO see evidence of certain TECHS at Microsoft making tiny tweaks to their filters. But MICROSOFT as a whole remains the same stubborn, unresponsible slug they always have been. They're not any more focused on security than the RIAA is on protecting the rights of its artists. They just want to look like they are.

      • You won't hear much about it because it's Microsoft.

        That's a job for the MS publicity department. We're (in a way) the open source publicity department, so it's not our problem.

        See how Microsoft worked with a (foreign) company and fixed the problem

        Microsoft is a big company. The Hotmail team has been doing a great job for a while now, the macdev team produces a version of Office for OSX that is considered by many to be superior to the Windows version, the hardware division puts their name on decent m
    • I used to work for Yahoo! (but I am not attempting to represent them here).

      Yahoo! will fix the problem, if it is indeed a problem that is as represented here on slashdot (hah). They'll fix it and won't make much of a stink about it because its a bug in IE that they will have to write around.

      Besides, as far as I'm concerned its not really an issue with Yahoo! mail or Hotmail anyway, its an issue with IE5, since the problem is only exploitable through IE5.

      my summary: yawn. this is just reason #632 to not

  • Works only in IE5, though (Score:4, Insightful)

    by Noryungi ( 70322 ) on Wednesday March 24, 2004 @09:37PM (#8663121) Homepage Journal
    Yep. Thank Mozilla for Firefox.

    Seriously, folks -- I have said it before and I'll said it again -- do not use Microsoft products when it comes to the Internet.

    If you care, even minimally, about security, then Firefox and Thunderbird should be installed by default on your Windows machine instead of Internet Explorer and Outlook.

    This was the case in one of the companies I worked for, and they had almost zero virus problems in two years.
    • I am so tired of hearing this crap. I use Outlook 2000, IE 6, IIS 5, and I use an MN-700 Wireless Router/Firewall. I have had only one "hacker" incident because I left my FTP site open to anonymous connections once. Big deal, I shut if off and voila, no more problem. My system runs 24/7 without a hitch. To boot, I'm a graphic designer, not an IT whiz.

  • Attacking my Hotmail Account (Score:5, Funny)

    by Kjuib ( 584451 ) on Wednesday March 24, 2004 @09:38PM (#8663130) Homepage Journal
    If they are going to attack my Hotmail Account they are up for a fight! Pr0n and Viagra have a firm hold, and it is going to take a lot to beat them to my Inbox.

  • alternatives (Score:3, Informative)

    by preric ( 689159 ) on Wednesday March 24, 2004 @09:38PM (#8663136)
    hmm... should this have been 'news'? most people (well, at least on here) know of sites like Hushmail [hushmail.com] which offer much better (and still free) security for web-based email. Hotmail and Yahoo are... well, about as secure as windows :)

    • Re:alternatives (Score:2, Informative)

      by Anonymous Coward
      as you can see from their demo page [greymagic.com] it's not limited to yahoo.

      people are always picking on the big guys.
  • more things to fix for the joe six-pack user
  • They are obviously diligently searching for the clowns who keep sending me requests from "Yahoo" and "Citibank" to put in my account information, on websites hosted in Russia and Korea.

  • Sticking with "Old Faithful" is asking for trouble (Score:4, Informative)

    by spyrochaete ( 707033 ) on Wednesday March 24, 2004 @09:45PM (#8663193) Homepage Journal
    Respect to MS for fixing the problem only 2 days later.

    It's not the first and won't be the last IE exploit! Be prepared! Don't buy into the monoculture - use "second tier" software whenever possible. Mozilla Firefox [mozilla.org] is a fantastic free web browser with many security features and simple toggles. Eprompter [eprompter.com] is an excellent, simple, and free POP3\Hotmail\webmail client that lets you delete messages server-side before you open\view them.

    Most important of all, keep up-to-date with Slashdot and other news services to stay aware of new vulnerabilities!

  • Not only IE5 (Score:5, Informative)

    by Anonymous Coward on Wednesday March 24, 2004 @09:47PM (#8663207)
    The reporter has it wrong.

    ALL versions of IE *since* 5 contain this feature, which means that if there's a flaw in the filtering mechanism of the web-based email provider, script will run.

    Yep, IE5, IE5.5 and IE6.

  • interesting tidbit from the article (Score:4, Interesting)

    by Cyberllama ( 113628 ) on Wednesday March 24, 2004 @09:53PM (#8663242)
    GreyMagic started work on this issue with Microsoft on 11-Mar-2004. They have quickly confirmed our findings and were able to produce a fix less than two days later. As a result, Hotmail is no longer vulnerable to this method of exploitation.

    Wow...I'm actually sort of impressed that Microsoft fixed a vulnerabillity in their product that was pointed out to them in email, rather than ignoring it until it blew up in their face. . .
  • At the bottom of the article
    "GreyMagic started work on this issue with Microsoft on 11-Mar-2004. They have quickly confirmed our findings and were able to produce a fix less than two days later. As a result, Hotmail is no longer vulnerable to this method of exploitation.
    All attempts to contact Yahoo unfortunately failed. Mail was sent to security and secure at yahoo.com and at yahoo-inc.com, no replies were received to date."
    Now thats weird. Microsoft fixing something before its truely made public!:)

  • Open Source Projects vulnerable? (Score:3, Insightful)

    by jaylee7877 ( 665673 ) on Wednesday March 24, 2004 @09:57PM (#8663275) Homepage
    According to the details I've seen on the exploit, it's not just Hotmail and Yahoo that are vulnerable but most webmail interfaces. Has anyone tested this against Horde [horde.org] and SquirrelMail [squirrelmail.org]?
  • A lot of people are saying "big deal, I don't use IE." Neither do I, nor do I use yahoo or hotmail for anything personal. But some of my friends only have a hotmail/yahoo account and use IE either because it's their only choice (at work), or they're too lazy to install, configure and learn to use a new browser.

    Now the article says this security flaw allows "Content disclosure of any email in the mailbox." This means that if you have sent anything personal to any mailbox on yahoo or hotmail, this info might be vulnerable, even if you personally don't use IE. The recipient might use IE and get their inbox read by others.

  • Where is the flaw? (Score:2, Interesting)

    by asmellysock ( 649878 )
    If it lets scripts run on a client, why is this considered a flaw in hotmail/yahoo rather than a flaw in IE? I tried reading the article, but I am not that familiar with HTML and scripting.
    • The problem is not that the script is getting executed in your browser but that it is a script from an email getting sent and executed by your browser. Most mail clients by default have scripting disabled because a malicious email can do some nasty things like steal your address book or confirm your email account is active to a spammer. It's the Webmail server's job to prevent scripts from being executed, not the browsers.

  • Who is to blame, hmm? (Score:4, Insightful)

    by baafie ( 765151 ) on Wednesday March 24, 2004 @10:01PM (#8663303)
    If this flaw works only in IE5, then it is not a flaw in yahoo/hotmail, but just another IE exploit.

    • Re:Who is to blame, hmm? (Score:3, Interesting)

      by ad0gg ( 594412 )
      Its filter bypass bug in hotmail and yahoo, its not exploiting anything. If you allow people to write content to your webpage, you better filter the for html,javacsript etc especially with javascript where I could programatically go through all the elements on webpage and send it back to me be it mozilla or ie.

      I still want to know how they would get username/password with javascript. Only way I could think of is to write my own fake loggin screen.

  • I probably should point out... (Score:4, Interesting)

    by Klatoo55 ( 726789 ) on Wednesday March 24, 2004 @10:08PM (#8663361) Homepage
    That Yahoo and Hotmail are pretty much the most used/spammed services out there, and therefore will have their security holes pinponted sooner than lesser-known services. Doesn't mean that the lesser knowns are more secure, just blissfully ignorant. Something to ponder...

  • So what? (Score:3, Informative)

    by torinth ( 216077 ) on Wednesday March 24, 2004 @11:00PM (#8663598) Homepage
    This isn't a security flaw of any meaning. This is a way to slip past the content filter on Yahoo! and Hotmail. Big fricking deal. Any script you manage to slip by the filters using this script could be found on any web page. There is no system vulnerability involved here. All "injected" scripts are subject to the same sandboxes and vulnerabilities that code you put up on your web page is. Nothing more, nothing less. Yahoo! doesn't need to jump on this because the damn thing is just an inconvenience, not a security threat.

    • That's quite an "inconvenience" (Score:2, Informative)

      by Anonymous Coward
      Why is it so hard to understand that when script can run in a web-based email it can do whatever the USER can do and more?

      That means your entire mailbox can be read and sent to a remote server.

      That means emails can be sent from the mailbox.

      That means your address book can be accessed.

      Running script in general might be an inconvenience, but in this context, it's a big-ass security vulnerability.

      If you know of any other such filtering flaws that aren't patched, feel free to point them out. But I assure y

  • What about IMP and squirrelmail? (Score:5, Interesting)

    by whoever57 ( 658626 ) on Wednesday March 24, 2004 @11:06PM (#8663652) Journal
    Do they also need fixes?

  • Hotmail Down on March 12 (Score:2, Interesting)

    by Pinky3 ( 22411 )
    Remember that Hotmail was down on Friday March 12. [slashdot.org]

    This is the time when Microsoft was working on the fix. Could the two events be related?
  • The problem is a flaw in IE and web sites get the blame? It should be IE that doesnt read malicious content because how hard is it to just set up an evil web site and link to it in an email?

    Viola, problem not solved!

  • The flaw is in IE, not Yahoo / Hotmail (Score:3, Informative)

    by chrysalis ( 50680 ) on Thursday March 25, 2004 @04:00PM (#8671183) Homepage
    The flaw relies on a proprietary extension of Internet Explorer.

    This extension has nothing to do with HTML specifications as documented by the W3C.

    Yahoo! did nothing bad. The Yahoo! filtering system works. Yahoo is not supposed to deal with every browser specific non-standard extension.

    If I release a patch for Mozilla that implements a tag that format your hard disk, should we immediately blame every webmail on the planet because there's a vulnerability here?

    No. And the fact that IE is widely used shouldn't mean that it should be a special case and that every program out there should care about its silly specific extensions.

Slashdot Top Deals

"An ounce of prevention is worth a ton of code." -- an anonymous programmer

Close