Comments on: Hacker's ad for a Yahoo email-stealing exploit, up for sale at $700

By: Hubert Figuière

Hubert Figuière — Mon, 26 Nov 2012 14:40:00 +0000

Remember, Yahoo! Mail is still not offered over https. Which mean that it is already vulnerable to basic traffic sniffing.

By: R_Young

R_Young — Mon, 26 Nov 2012 00:52:00 +0000

Perhaps you meant “shouldn’t”.

The following question is then “According to who?”
or whom. Whatever.

By: Boundegar

Boundegar — Sat, 24 Nov 2012 16:47:00 +0000

Is that what they told you in Wired?

By: plyx

plyx — Sat, 24 Nov 2012 14:23:00 +0000

Fuck this guy. Fuck all “hackers”. Real h4x0rz don’t steal from common folk.

By: Tankut Erinc

Tankut Erinc — Sat, 24 Nov 2012 13:18:00 +0000

it will be patched up as soon as yahoo puts together $700.
oh wait!

By: Charlie B

Charlie B — Sat, 24 Nov 2012 04:33:00 +0000

I’m glad this stuff is out in the open. If our corporate-owned governments had their way, we’d never know about these vulnerabilities.

By: Jake Rennie

Jake Rennie — Sat, 24 Nov 2012 00:40:00 +0000

$700 for one exploit? I’m in the wrong line of work.

By: bklynchris

bklynchris — Sat, 24 Nov 2012 00:26:00 +0000

…”cause I don’t want it to get patched soon!” add dickweed to irony, and what a bizarrely written sentence.

By: invictus

invictus — Sat, 24 Nov 2012 00:02:00 +0000

You’re guessing incorrectly. Stored xss can execute on load, with no input from the user. It all depends on where in served page the script is being injected.
See http://en.wikipedia.org/wiki/Cross-site_scripting#Persistent for a brief explanation.

By: danimagoo

danimagoo — Fri, 23 Nov 2012 23:45:00 +0000

“Will sell only to trusted people” … irony much?

By: Glippiglop

Glippiglop — Fri, 23 Nov 2012 23:23:00 +0000

Yes. This is the sort of trick that you would use in a phishing expedition, whereby the attacker might only expect 1% of the 1,000,000 people he emailed to click on the link. A career criminal could easily turn a profit from the initial investment.

It’s a good trick to employ as the attacker does not need to forge the login page of the affected site; in fact the browser will likely log the user straight into the account if a cookie is active from a previous session. This can be observed in the video.

By: Buddy Bradley

Buddy Bradley — Fri, 23 Nov 2012 22:38:00 +0000

I’m guessing this only works if the victim is dumb enough to click on a link in a spammy-looking email, right?