Yahoo email hacker-for-hire charges $700 for services

A hacker claims to have found a zero-day flaw in Yahoo.com that allows attackers to hijack Yahoo Mail accounts and divert victims to malicious websites, a security researcher said this week.

 

But the Egyptian hacker who claimed discovery of the vulnerability is not giving away the secret for free and is instead demanding $700 (P28,714) for it, researcher Brian Krebs said.


"The exploit, being sold for $700 by an Egyptian hacker on an exclusive cybercrime forum, targets a 'cross-site scripting' (XSS) weakness in yahoo.com that lets attackers steal cookies from Yahoo! Webmail users. Such a flaw would let attackers send or read email from the victim’s account," Krebs said on his blog.

He said the hacker, who goes by the name "TheHell," offered the Yahoo stored xss that he/she said can "steal Yahoo email cookies and works on all browsers.”

Krebs said the hacker claimed the prices for such an exploit should normally fetch $1,100 to $1,500.

Yahoo response

According to Krebs, he has alerted Yahoo to the vulnerability, and Yahoo said it is responding to the issue.

He quoted Ramses Martinez, director of security at Yahoo, as saying the challenge is working out the exact yahoo.comURL that triggers the exploit.

“Fixing it is easy, most XSS are corrected by simple code change. Once we figure out the offending URL we can have new code deployed in a few hours at most,” Martinez said.

Krebs advised users of Yahoo services to be "especially cautious about clicking links in emails from strangers or in messages that you were not expecting."

On the other hand, Krebs said that if Yahoo would pay researchers to report flaws, this particular vulnerability might be worth $1,337.

Luring the victim

A separate article on the blog of security vendor Sophos said an attacker would need to fool a victim into clicking on a maliciously crafted link.

Once a victim opens that link, a logger records his/her cookies, and the victim is redirected back to the Yahoo email page.

"The attacker can then redirect the victim's browsing session at will," Sophos said. — TJD, GMA News