Watch Live: Congressional Hearing on IRS Scandal

Live Now on TheBlaze Radio: ‘The Buck Sexton Show’

Technology

If You Have a Yahoo! Email Account and Value Your Privacy, You Will Want to Read This

Nov. 27, 2012 9:00am

A hacker is capitalizing on a Yahoo! flaw that could allow email accounts to become compromised and could trick users into clicking on malicious websites. But criminal hackers will have to pay to obtain details about how to conduct this hack. The cost: $700.

Brian Krebs on his blog Krebs on Security reported last week that an Egyptian hacker was offering this deal on an “exclusive cybercrime forum” called Darkode. The hack itself steals cookies, which Krebs explains leads hackers into their target’s account where they can send or read emails.  Here’s how the hacker going by “The Hell” advertised his exploit, according to Krebs:

“I’m selling Yahoo stored xss that steal Yahoo emails cookies and works on ALL browsers. And you don’t need to bypass IE or Chrome xss filter as it do that itself because it’s stored xss. Prices around for such exploit is $1,100 – $1,500, while I offer it here for $700. Will sell only to trusted people cuz I don’t want it to be patched soon!”

Hacker Selling Yahoo! Email Exploit for $700 on Cybercrime Forum

Screenshot from the hacker’s video demo of the exploit. (Image: YouTube screenshot)

Krebs explains more about how the hack works:

In a typical XSS attack, an attacker sends a malicious link to an unsuspecting user; if the user clicks the link, the script is executed, and can access cookies, session tokens or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

“The Hell” also posted a video to show how it works, which Krebs reproduced and posted on YouTube:

Krebs writes that he contacted Yahoo! to alert them of the problem and was told the vulnerability will be relatively easy to fix.

“Fixing it is easy, most XSS are corrected by simple code change,” Ramses Martinez, director of Yahoo! security, said to Krebs. “Once we figure out the offending URL we can have new code deployed in a few hours at most.”

Until that URL is identified, Krebs noted that the vulnerability serves to remind users to be careful when clicking on links from strangers or that are in odd messages.

Read more details about the exploit in Krebs post here.

(H/T: SlashGear)

In CONTROL, Glenn Beck presents a passionate, fact-based case for guns that reveals why gun control isn’t really about controlling guns at all; it’s about controlling us. Find out more HERE.

Comments (58)

1 2
  • Insert Clever Username Here
    Posted on November 27, 2012 at 5:27pm

    it’s called clickjacking, and it’s been around almost as long as clicking. sad that people are so technologically illiterate that rudimentary script kiddie tricks are considered “hacking”.

    Report this comment

    Insert Clever Username Here  
    • gosutag
      Posted on November 27, 2012 at 6:14pm

      What don’t understand is that once you get even a step away from a GUI common folk become extremely confused. . .Mind you, scripting isn’t even a step away from the GUI. Maybe it’s getting worse?

      Report this comment

      gosutag  
    • C. Schwehr
      Posted on November 27, 2012 at 7:43pm

      I get crap like that fairly often….just don’t click on anything that you don’t recognize and you’ll be safe.

      Report this comment

      C. Schwehr  
  • gapch12
    Posted on November 27, 2012 at 4:32pm

    People who click onto links from within e-mail from someone they do not know, deserves to be hacked.

    Report this comment

    gapch12  
    • GatorBob
      Posted on November 27, 2012 at 5:21pm

      Your statement is preposterous, inconsiderate, elitist and typical of someone that has learned a little about something, in this case e mail,

      There are beginners and elderly that e mail is a great comfort to, and keeps them in contact with friends and family. Those people will learn things like not opening unknown e mail, but I doubt seriously that you knew the first time you used e mail that you knew to not open unknown e mail.

      People like you that are insecure and anxious to try and make themselves look smarter than they actually are, make negative statements like you made …….to do so is ignorant and childish.

      Report this comment

      GatorBob  
    • gosutag
      Posted on November 27, 2012 at 6:15pm

      @GATORBOB: Thank you for the much needed dose of sanity.

      Report this comment

      gosutag  
  • KevINtampa
    Posted on November 27, 2012 at 3:57pm

    The way this article end made me chuckle a bit. Can anyone guess why?

    “Until that URL is identified, Krebs noted that the vulnerability serves to remind users to be careful when clicking on links from strangers or that are in odd messages.

    Read more details about the exploit in Krebs post [here].”

    Report this comment

    KevINtampa  
    • Noah_fing-whey
      Posted on November 27, 2012 at 6:31pm

      It asks the really stupid Internet users that Gator Snob is so worried about to click on a link. LOL

      Gator Bob needs to give out his email address so people can forward questionable emails to him for review. The world is a dangerous place. If you go wondering around in the dark in a strange neighborhood you should expect problems. Clicking on a link from a stranger is the same as asking a stranger to hold your purse while you go into the toilet stall. You deserve what you get.

      Report this comment

      Noah_fing-whey  
  • loneindividual
    Posted on November 27, 2012 at 3:40pm

    Having a conversation with the person who hacked you is fun.

    They are full of information. Once they realize your politics, they leave you alone….most of the time.

    Report this comment

    loneindividual  
    • Lt_Scrounge
      Posted on November 27, 2012 at 7:20pm

      I think that if I got hold of the twits who caused my system to crash, I don’t think that they’d find it all that entertaining. Painful might be the manner in which they would describe my method of introducing them to a medieval reenactor’s idea of “hacking” involving a battle axe.

      Report this comment

      Lt_Scrounge  
  • Delores at CH WV
    Posted on November 27, 2012 at 3:11pm

    Well, he probably didn’t have to hack as our government is probably selling the email addresses on the world’s black market. There is no government agency that has any honor or cares about American Privacy. As the World turns . . . our new nightmare life churns towards the end because of the UN.

    Report this comment

    Delores at CH WV  
  • dnha14
    Posted on November 27, 2012 at 1:57pm

    This is why my Yahoo address is given to people who I don’t want to have my e-mail address.

    Report this comment

    dnha14  
  • mrmikejohnson
    Posted on November 27, 2012 at 1:17pm

    There are still people who click on links from unknown senders? I thought people figured out that was a bad idea around 1998.

    Report this comment

    mrmikejohnson  
  • independentvoteril
    Posted on November 27, 2012 at 12:59pm

    Yahoo is one of the WORST at keeping hackers from stealing.. this is epically true when it comes to your contact list.. I wiped mine out long ago and got a hotmail one for family and friends..only thing I use my Yahoo account for is to sign up at comment boards….

    Report this comment

    independentvoteril  
  • archangel72
    Posted on November 27, 2012 at 11:40am

    I use Thunderbird email by Mozilla. It’s great and it’s simple. I use StartPage.com and Duck Duck Go as my search engine and Mozilla Firefox as my browser. Much more secure and there are tons of add ons for privacy.

    Report this comment

    archangel72  
  • americathebankrupt
    Posted on November 27, 2012 at 11:10am

    Go to internet options in your browser.Click on security,Advanced,Allow session cookies,Block third party cookies.

    Report this comment

    americathebankrupt  
    • archangel72
      Posted on November 27, 2012 at 11:38am

      I actually use Thunderbird email from Mozilla. Also, I search using “Startpage.com” as my primary search engine. DuckDuck Go is also another search engine that doesn’t track you.

      Report this comment

      archangel72  
  • AquaBuddha
    Posted on November 27, 2012 at 10:42am

    Yahoo blows anyway. I have my email there and I really hope they go bankrupt. They are just another leftwing appliance.

    Report this comment

    AquaBuddha  
    • JRook
      Posted on November 27, 2012 at 10:56am

      If you value your privacy you will pay attention to the 22+ third party tracking cookies that are loaded by this site. Now why would a third party marketing company pay a site to load tracking cookies. As GB says often, don’t take my work for it, figure it out yourself. Particularly what it says about the company and individuals who operate the site.

      Report this comment

      JRook  
    • M13
      Posted on November 27, 2012 at 1:42pm

      Once again jrook shows us what an idiot and a liar he is.

      Report this comment

      M13  
    • Atrum Angelis
      Posted on November 27, 2012 at 2:49pm

      M13: While I have no idea of JROOK’s other comments which would make him a liar, there are in fact about two dozen trackers on this site. I get a warning every time I visit the site saying X amount of trackers blocked by my addon in Firefox. Most sites now a days have at least a dozen or so.

      Report this comment

      Atrum Angelis  
    • 4theThinMan
      Posted on November 27, 2012 at 3:45pm

      So, stupid, why do you have your email there?

      Report this comment

      4theThinMan  
  • teawithjill
    Posted on November 27, 2012 at 10:34am

    Maybe the Blaze should set up an e-mail service I would pay for protecting my privacy, and be with a great bunch of people??

    Report this comment

    teawithjill  
  • MrKnowItAll
    Posted on November 27, 2012 at 10:27am

    So Much COMMON SENSE coming to Light. YET! So many still don’t get it. I feel they never will……”Nothing In LIFE is FREE!”

    Report this comment

    MrKnowItAll  
  • TruckerClockWhoWantsIT
    Posted on November 27, 2012 at 10:24am

    All Hackers should be Hung by their Gunny Sack.

    Report this comment

    TruckerClockWhoWantsIT  
  • PingPongPing
    Posted on November 27, 2012 at 10:16am

    good lord. I guess i better activate the email account that my internet provider is giving me.

    Report this comment

    PingPongPing  
  • EARTHWALKER
    Posted on November 27, 2012 at 10:12am

    Ifound a good email and they have free or pay email at hushmail

    Report this comment

    EARTHWALKER  
  • sizzlinsexybeckster
    Posted on November 27, 2012 at 10:07am

    ….. No, no, no…. this is not only about spam! They also keep track of the websites you visit – such as this one and they can find out your username here and see what you are typing to use it against you in any corrupt way they can… they can even take away your children if you say something so simple as “I like beer.” They will pretend you are an alcoholic and a wife beater even if you don’t even have a wife. These people in government we are having to deal with are monsters, liars, and just plain creepy. They keep copies of what you say and will distort your words – anything – for their reasons to perhaps “save you” and sent you to “fat camp” or shove you into the Fema camps, you know, “for your protection” or whatever the hell crap they feel like making up just for their own sadistic thrills. DO NOT use yahoo, hotmail (all free emails) ALSO… DO NOT… use those emails such as AOL or anything your internet server provides you with… I’ve already heard stories about AOL and that’s not a free service, well, perhaps “free” if you pay for their internet connection. AOL sells your personal crap as well. Yes those emails get scanned. Why can’t someone from the military “accidentally” blow up the huge storage facilities where they store our personal crap. I believe that would be the start of our own human rights revolution to be treated with respect. Hey… I’ll chip in a dollar…

    Report this comment

    sizzlinsexybeckster  
  • searcher619
    Posted on November 27, 2012 at 10:00am

    Meh… Yahoo is one of my junk email accounts. No way would I use a free email as a primary.

    Report this comment

    searcher619  
  • sizzlinsexybeckster
    Posted on November 27, 2012 at 9:56am

    I have since cancelled all my yahoo accounts and advise people to sign up for Reagan.com where you are considered a person and not just cattle and they respect your privacy, don’t sell anything or be nosy idiots… well, they do sell jelly beans at their store if you want to buy some (cute!), but never sift through your account. I highly suggest to delete all your free emails YESTERDAY and sign up there because you and your privacy are much more than worth it. Other people are really careless and don’t think they have anything of importance to be stolen but they are wrong. You may also be able to get an email address at GoDaddy.com however the Reagan site uses GoDaddy….. and there’s that bonus of jelly beans! Except I always suggest just speaking to people in person and avoiding all this electrical crap. Speaking of electrical… I believe the ovens in the FEMA camps do NOT require electricity – guess they have done their homework with their timing, you know, after the electric goes out for their ” ‘estimate’ of 3 years” they will try to round us up during this time to burn, no electric so there will be no news outlet to report from – unless theBLAZE PURCHASES one of those radio stations on those ‘emergency radios’ you buy from Lehmans or Walmart…. hint, hint. Otherwise when we tune in we’ll only hear lies like they did back in Hitler’s day.

    Report this comment

    sizzlinsexybeckster  
  • ArmedAndReallyPissed
    Posted on November 27, 2012 at 9:52am

    Anytime these friggin hackers get caught, they should get life in prison without the chance of parole. Thanks for the advice about reagan.com email. Will look into it.

    Report this comment

    ArmedAndReallyPissed  
    • Old Ogre
      Posted on November 27, 2012 at 10:37am

      Then you will be paying them for their crimes for life… I am starting to think prisoners have it good compared to many Americans right now, well except for the being someones bitch thing!!

      Report this comment

      Old Ogre  
    • armyofnibiru
      Posted on November 27, 2012 at 12:22pm

      problem is they go right into the white house and are used as weapons against U.S.

      Report this comment

      armyofnibiru  
    • 4theThinMan
      Posted on November 27, 2012 at 3:51pm

      line them up and shoot them right between the eyes. As long as you pussyfoot around with criminals – they are in business. DEATH stops crime.

      Report this comment

      4theThinMan  
  • mom4times
    Posted on November 27, 2012 at 9:45am

    @NHWINTER I only wish I could afford reagan.com right now….maybe next year

    Report this comment

    mom4times  
  • DivisionByZero
    Posted on November 27, 2012 at 9:31am

    Yahoo mail, gmail, and hotmail are all anti privacy. It may be a good time to dump these clowns and find a reputable email provider. Preferably a local provider that offers encrypted email and a good privacy policy. Finally, don’t put private or sensative info in an email. It is effectively recorded “forever”, and available to anyone with a supoena and an agenda.

    Report this comment

    DivisionByZero  
  • B-45
    Posted on November 27, 2012 at 9:16am

    I am sure this will be fixed soon, but by the same token, perhaps now would be a good time for everyone to find alternative e-mail sources, and ditch Yahoo and their hard-left rhetoric drivel.

    Report this comment

    B-45  
  • GrayPanther
    Posted on November 27, 2012 at 9:14am

    OMG! I have over 1,400 scam e mails in my yahoo account due to a Walmart $1,000 shopping spree offered on my Walmart receipt. Only solution; open another account with another provider like Google.

    Report this comment

    GrayPanther  
    • NHwinter
      Posted on November 27, 2012 at 9:24am

      I recommend reagan.com, no spam, no advertisements, completely protected. It is only $40 a year I had yahoo and got so much spam and obnoxious email that I cancelled that account. Google is in the pocket of Obama.

      Report this comment

      NHwinter  
    • ExpertShot
      Posted on November 27, 2012 at 9:38am

      I’m with NHWINTER on this, I went with the reagan e-mail & absolutely no spam, it’s well worth the money. I still have my yahoo but only as an e-mail to sign into various sites, such as this. All my sensitive information goes to reagan.

      Report this comment

      ExpertShot  
    • csbaby
      Posted on November 27, 2012 at 9:42am

      Use the internet provider email, the one you get with who you pay – .att.net, cox.net, etc

      Report this comment

      csbaby  
    • NOT A CRAZY
      Posted on November 27, 2012 at 9:48am

      There are easy solutions to get rid of spam on Yahoo. First whenever you get a spam email do not open any links in that email. Identify it as spam and it will be sent to a spam folder. It doesn’t take very long to get to the point were you no longer (very rare) get spam emails in your main Inbox. You should also be careful about not generating spam in the first place. Every single time you enter your email in a database for someone to contact you, you have potentially start a spam trail. I have an extra email account that I use for oddball stuff that I need an email for but that I am leary of. I utilize that email if it is something I don’t want repeated contacts with. Google is in B.O.’s pocket.

      Report this comment

      NOT A CRAZY  
    • llotus
      Posted on November 27, 2012 at 2:27pm

      Graypanther….I have learned to never go to a site for anything pushed by a store. Even sears pennys etc. The walmart one has to be an outright scam. Pushed by the clerks at checkout. Reagan is good. Lotus.

      Report this comment

      llotus  
  • mom4times
    Posted on November 27, 2012 at 9:08am

    oh great…….been hacked enough as it is from them

    Report this comment

    mom4times  
    • EARTHWALKER
      Posted on November 27, 2012 at 10:11am

      I found a good email that is free or they have pay ones to it is called hushmail

      Report this comment

      EARTHWALKER  
    • Schteveo
      Posted on November 27, 2012 at 7:27pm

      As a retired computer type who still does work on the side, here’s your best bet on staying safe from scammers, hackers and phishermen.

      NEVER, ever, EV – ER, never open ANY e-mail unless you recognize the SENDER!

      Opening e-mails from unknown senders is a great way to get your computer infected, or hacked, by thieves and people who just want to be malicious. Opening e-mails from unknown senders is like opening the door on your house at 3AM, after looking through the peephole, seeing a guy wearing a ski mask and thinking, “…I wonder who that is?” Then deciding, ” Hey, it might be Ed McMahon, so I better open the door and see if I WON the $$$$!!”

      Let’s face it, you’re not going to win the Bolivian National Lottery if you don’t even know WHERE Bolivia is, there is no lost relative with $50M in a Nigerian Bank that you can get for sending them $$$ for ‘fees’, and MicroSoft is NOT in business to be giving away $$$ to you for reading or sending e-mails. There are no more REAL get quick opportunities in your e-mail, than there are in your snail mail, so DON’T open anything promising you instant riches! And finally, there are sites that are especially bad for loading junk and cookies too. nroP and game sites are some of the worst offenders! Especially ones that advertise as “FREE!!”.

      P.S.
      to all the people who paid us to reload their computers last year, after being told NOT to do all that stuff above, but who did anyway, our mortgage company thanks

      Report this comment

      Schteveo  
1 2

Sign In To Post Comments! Sign In

Sign Up For Our Newsletter!

Glenn Beck Radio

Listen to Glenn Beck 24/7 Listen Now
Restoring Love