Application: Yahoo! Messenger 5.6 & Trillian (All Versions) Vendors: http://messenger.yahoo.com/ Platforms: Windows Bug: User Credential Disclosure Vulnerability Risk: Medium Exploitation: Local - (or remote by sniffing) Date: 1 Apr 2004 Author: Rafel Ivgi, The-Insider e-mail: [EMAIL PROTECTED] web: http://theinsider.deep-ice.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1) Introduction 2) Bugs 3) The Code
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
=============== 1) Introduction ===============
Yahoo! Messenger one of the worlds most common, secure and easy to use instant messangers. You can stay connected to Yahoo! Messenger on your mobile phone and message your mobile friends from your PC. More info Super Webcam Enjoy high-quality, broadband video messaging with your friends! More info New Emoticons Express yourself in whole new ways without writing a word! See them all IMVironments More IMVironments than ever before. (PC only)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
====== 2) Bug ======
While using Yahoo Messanger a user recieves mail to his yahoo inbox. Yahoo Messanger as well as Trillian pop-up a message box that allows the user to check his mail box.
Upon clicking this message box a temporary html file is dumped to windows temp folder. This html file contains the username and the PASSWORD of the users yahoo account, in PLAIN TEXT format.
In addition to that it sets up the "Remmeber me" option which saves the login cookie
which contains the login credentials - WITHOUT ASKING THE USER.
More over the connection opened uses standard HTTP protocol(which the username
and password can be sniffed) instead of using the secure SSL login which is supported
by yahoo.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
=========== 3) The Code ===========
This is Proof Of Concept Code(the "temp" file which is generated): ------------------- CUT HERE ------------------- <html> <head> <script> <!--
var username;
username='<username>';
var password;
password='<password>';
function submit () {
document.getElementById('login').value=username;
document.getElementById('passwd').value=password;
document.getElementById('login_form').submit();
};
//-->
</script>
</head>
<body onLoad='submit();'>
<form method=post action="https://login.yahoo.com/config/login"; autocomplete=off name=login_form id=login_form onsubmit="return alert(document.forms['login_form'].login.value)">
<input type="hidden" name=".tries" value="1"> <input type="hidden" name=".src" value="ym"> <input type="hidden" name=".md5" value=""> <input type="hidden" name=".hash" value=""> <input type="hidden" name=".js" value=""> <input type="hidden" name=".last" value="2"> <input type="hidden" name="promo" value=""> <input type="hidden" name=".intl" value="us"> <input type="hidden" name=".bypass" value=""> <input type="hidden" name=".partner" value=""> <input type="hidden" name=".v" value="0"> <input type="hidden" name=".yplus" value=""> <input type="hidden" name=".emailCode" value=""> <input type="hidden" name="plg" value=""> <input type="hidden" name="stepid" value=""> <input type="hidden" name=".ev" value=""> <input type="hidden" name="hasMsgr" value="0"> <input type="hidden" name=".chkP" value="Y"> <input type="hidden" name=".done" value="http://mail.yahoo.com";> <input type="hidden" id="login" name="login" size="17" value="">
<input type="hidden" name="passwd" id="passwd" size="17" maxlength="32">
<input type="hidden" name=".save" value="Sign In"> </form></body> </html> ------------------- CUT HERE -------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com
"Only the one who sees the invisible , Can do the Impossible."
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
