you all might have come across the serious 0-day vulnerabilities found in Yahoo, Hotmail and AOL,
exposed around a week ago, that allowed to reset the passwords of the
legitimate account owners without them noticing it. This almost
endangered the bulk of email account holders from being hacked. Though
this has been fixed within a short notice, lets check out the possible
ways that hackers could have intruded the accounts.
Assuming the attacker is in action, he goes to mail.yahoo.com and clicks to ‘I can’t access my account‘ below the submit button as:
The moment after clicking, the attacker gets directed to the following page:
Clicking ‘Next‘, Yahoo asks for the Email ID and the captcha verification page:
Start the Tamper Data Firefox Add-on, click on ‘Start Tampering’ and click ‘Next‘ on the Yahoo captcha page. The attacker now sees the pop-up window as:
Change the stage data you see in the input box from ‘fe110‘ to ‘fe200‘ and click ‘OK‘ and ‘Submit‘. The security questions part gets skipped and you see the password reset page asking for the new password details as:
Clicks ‘Next‘ when done, ‘continue tampering‘ and ‘Submit‘ until he gets the Password successfully changed prompt. ALl done! The attacker can now login to the victim’s account using the new password and re-activate it as easily.
AOL and Hotmail can be exploited the same way with few variations. You can take a look at the walk-through and demo
Assuming the attacker is in action, he goes to mail.yahoo.com and clicks to ‘I can’t access my account‘ below the submit button as:
The moment after clicking, the attacker gets directed to the following page:
Clicking ‘Next‘, Yahoo asks for the Email ID and the captcha verification page:
Start the Tamper Data Firefox Add-on, click on ‘Start Tampering’ and click ‘Next‘ on the Yahoo captcha page. The attacker now sees the pop-up window as:
Change the stage data you see in the input box from ‘fe110‘ to ‘fe200‘ and click ‘OK‘ and ‘Submit‘. The security questions part gets skipped and you see the password reset page asking for the new password details as:
Clicks ‘Next‘ when done, ‘continue tampering‘ and ‘Submit‘ until he gets the Password successfully changed prompt. ALl done! The attacker can now login to the victim’s account using the new password and re-activate it as easily.
AOL and Hotmail can be exploited the same way with few variations. You can take a look at the walk-through and demo
Post a Comment