Security – Yamanner Worm Hits Yahoo Mail (Not!)

Dietrich Kappe, Tuesday, June 13, 2006 @ 11:15 pm

Update 3: Eric Pascarello has a brief blog entry describing the mechanisms by which the worm works. If you'd like to look at a defanged version of the code, it is here.

Update 2: I'll save you reading all the way to the bottom. This blog entry
over at the Washington Post seems to take the view that users of Yahoo
Mail Beta (the AJAX version) are in fact not vulnerable to the critter. The fix is apparently to migrate to Beta. Like I said, these reporters often scramble the facts.

---

Looks like we have our first AJAX-related security hole. From the InformationWeek article:

Yahoo Mail relied on a JavaScript function in connection with uploading
images from a message to their mail server. Yahoo Mail made limited use
of Ajax to spur interactions between the mail user and Yahoo's servers.
The Yamanner worm exploited one of the few JavaScript functions that
Yahoo Mail didn't already screen out, the ability to execute JavaScript
in connection with directions to upload an image from a user's mail
message. The worm substituted its own JavaScript commands where the
image-handling code was meant to go.

[...]

Yahoo Mail is displayed in the user's browser Window, and browsers are
designed to execute any JavaScript they find in an HTML page or
message. As Yamanner recipients opened their messages, there was no
outward sign for the user that anything was amiss. The Yamanner worm
didn't need an image to be included with a message to do its work. The
JavaScript executes in background, the browser performs no checks on
whether it is performing the expected function or not, and the worm
shows no telltale of its activity on the user's screen, except a
possible slowdown in other activities.

In addition to ordering the user's computer to query the Yahoo
mail server for the user's address book, generate a message and send
them out to each name in the address book, Yamanner also captured the
addresses and uploaded them to a still unidentified Web site. By doing
so, it was building an email list with many thousands of names that
could be sold to spammers, note Web security experts.

The reported flip-flops between "worm" and "virus" in the article. I know from personal experience that reporters can get these things a little mixed up, so I'll try not to take the breathless tone of the news article.

What exactly did this "worm" do? Not a whole lot of information out there yet. Was it simply that they uploaded a Javascript file instead of an image? Then the only way this was an AJAX vulnerability is that AJAX apps cut functionality into nice little chunks ("send message", "delete message", "view message", etc.) that can be accessed by the browser without the user knowing about it. So, nothing really new here, other than an example of cross site scripting. Stay tuned.

Update 1: Symantec has a security response here.

JS.Yamanner@m arrives on the compromised computer as a Yahoo! HTML
email containing JavaScript. If the email is opened within Yahoo! Mail,
it performs the following actions:

1. Exploits a vulnerability in the Yahoo! Mail service and executes a script.

2. Scans emails in the personal folders of the Yahoo! Mail
   account. The worm gathers email addresses that contain @yahoo.com and
   @yahoogroups.com domains.

   Note: The personal folders are email folders in the currently
   logged in Yahoo! Mail account. These include folders such as the Inbox,
   Sent, and any custom-named folders in the account.

3. Sends a copy of itself to the email addresses gathered. The email may have the following characteristics:

   From: Varies
   Subject: New Graphic Site
   Message Body: Note: forwarded message attached.

4. Redirects the Web browser from Yahoo! Mail to the following Web site:

   [http://]www.av3.net/index.htm

5. Sends the list of gathered email addresses to the above URL.

Related posts:

1. Yahoo Mail, Ajax and Your Server
2. Another Worm, This Time on Myspace
3. Web app security checklist (Braindump)
4. Yahoo UI components
5. GWT Security Talk

Comments (1)

Software Development

Comments: 1 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   This is not the first, though maybe the beginning of a growing trend, of Javascript worms.

   The “samy is my friend” myspace “worm” from last year also used XHR to spread. From a technical perspective, it might be fancier than the Yahoo! one given it called Myspace’s services to also post messages etc.

   Comment by Scott Schiller, Wednesday, June 14, 2006 @ 11:04 am

Leave a comment