Oh, something almost comprehensible from a surprising source.
However, I think you need some ABC in corporate security.
Jeb Bush wrote:
The flaw allows you to read the victim's status message.
This means telephone numbers.... etc.... whatever the victim adds to
their status message is disclosed.
Oh, the horror.
In short, you can read your victims ignore list. This is very useful
to launch attacks with.
Usually when the victim removes you from their list and adds you to
their ignore list, their online status goes offline forever.
However, if attacker goes to
http://manage.members.yahoo.com/index_listprofiles.html and create a
secondry yahoo i.d on the same account and the attacker logs back into
yahoo messenger on the new second yahoo i.d on the same account, then
everyone who ignored you reappears as online with telephone numbers,
corporate links....corporate info thats in the employees status
message.
you can use this to
detect all your yahoo i.d's a person has ignore
read someones status message with confidential info
Why in the world would anyone put 'confidential' information in their status?
On an Internet wide service?
If any corporation anywhere allows their employees to use yahoo for corporate
use they soo deep in the yoghurt that this is the smallest of their issues.
this has been vulnerable for years and years
yahoo are well aware of it
And so is anyone engaged in corporate security.
Many companies use various 'messenger' software internally, but only on secure
corporate nets, against secure corporate servers.
Connecting to any form of external platform is 1, against corporate policy, 2,
denied by firewalls and proxies.
You can of course bypass that, but that is equal to industrial sabotage and
leads to 1, you're fired, 2, you're sued for damage.
There's tons of security issues with every online 'communtity' service.
But they're personal security issues, not a corporate security issue.
And as stated, if an issue like this would ever touch corporate security than
that corporation is soo deep in yoghurt that this would be the least of the
problems.
--
// hdw
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
