- This topic has 17 replies, 11 voices, and was last updated 20 years, 6 months ago by
.
-
Posts
-
Well, this is a new one on me. Here’s what’s going on. A bunch of us are in a room, someone/thing comes in and throw something in the room which causes the room to start jumping up and down, and it’s as if a web page has been sent to the room, the web page is that one where it starts flashing and three smiley faces pop up, and it start screaming “You are an idiot”, but sure if you have ever seen this or not. But anyway, if you look in the user list there is a user with a name something like
What we did is took the code that came up in the room, and stuck it in our filter1 files, and that actually took care of the problem, believe it or not. However, yesterday along with the ”idiot” one there were two other ones. Both with web addys. One of them actually popped open your cd rom. So there are 25 people in the room who’s cd rom all popped open at the same time, and then there was another one which if you had your settings to automatically log you into messenger, if did just that, and then it took you to a room called A:1.All of these have now been put in our filter1 files which seems to be working (I thought they didn’t help too much, but I was wrong).
Anyway my question is, WHAT THE HECK IS THIS????
How is someone signing in as
To me it sounds like some sent all of you a link or something of that sort and downloaded something onto your PC’s and is able to control them…it sounds like a hack of some sort. I know you probably have your AV, Trojan and spyware up-to-date, so I doubt it’s that or you would have found it by now. It might be a new Yahoo! exploit was discovered. I’ll look into it more, I don’t chat like I used to so I’m kind of “out of the loop” when it comes to those things. I’ll let you know what I find out. 🙂
Oreo,
You are correct, all scans have been acheived and everything is up and running, and in working order. I’ve been chatting for many years on yahoo, and this is the absolute first that I’ve seen of this exploit. Yes I agree there is a web page embedded in our chat room, but it is actually loaded into the room so that everyone that is there See’s and hears the web site (which of course is annoying if you’ve ever been to it). You can go there by http://www.albinoblacksheep.com/flash/you.html which of course you can delete out of this post. I also have source code which is what we receive in the room after we finally are able to shut the thing off, and which we have pasted into our filter.
Thanks for any information you can obtain, just interested to find out HOW this is done. Keep in mine that we did a check in the room, and it has nothing to do with the version of messenger (some are on 5.5 1226, upto the current version), or whether or not you have ytunnel, etc.
Thanks again.
Looks like the fairly new and known about iframe exploit, but modified for Yahoo! Chat/Messenger.
No patch was avaiable from Microsoft the last I checked, which was one to two weeks ago. Yahoo! could easily patch the exploit from being used on its chat/messenger network by updating server-side filters.
EDIT:
Posted – 11/29/2004 : 8:38:48 PM
http://www.kb.cert.org/vuls/id/842160Woohoo! Still no patch released by Microsoft. MS most be holding off for the monthly patch release date or they are lamers and can’t fix it without rewriting other stuffs, which could take time for MS.
n3td3vSECOND EDIT
If its not related to that exploit, then its still a script injection vulnerability/exploit of some description for Yahoo!s XML on Chat/Messenger.
n3td3v
Last edited by – n3td3v on 11/29/2004 8:54:01 PMYou were already warned about this and I sent you an e-mail concerning this. STOP posting in succession. You know how to use the edit button, use it.
Netti,
This same thing happened to me…opening CD drives, <iframe in user list. It also launched the printer dialog box.
I was going to try the booter suggestion on this forum to edit your filter1.txt file. But mine is encoded. I’m in Messenger 6. Is there anyway to edit the encoded file?
I’d like to know what solution you or Oreo or anyone find. Thanks.
This is definitly not spam, but is definitly an exploit. I don’t think the user logged in Yahoo! Messenger as “<iframe src="http://www…" or anything.
Remember, you can put anything as your nickname and it will show up in the room as it until people click your nickname to expose your real ID. I bet whoever is doing this, created a new “boot” program, where they can login Yahoo! ID’s with nicknames that are the exploit coding, that embeds the HTML page into the chatroom and screws everyones computers up.
There are indeed VB Scripts in webpages that can open your CD rom and such. The pages they load probably do things like that. As for protecting yourself on the new encoded filter? Dunno, since I barely go into chat rooms anymore. (I hate booters and “internet gangs”).
In fact, that’s probably the best advice from me. Just don’t go into chat rooms for a while until Yahoo! patches it (They take forever to patch simple exploits).
Its nothing to do with Yahoo!, but they could have filtered the offending exploit code.
Anyway, that doesn’t matter now…
Microsoft funnily enough have released a patch. I wonder if my post to Full-Disclosure had any influence over the release date 😉
Get the patch here: http://windowsupdate.microsoft.com
I think that the user set his nicname to be the “<iframe…" which is how they gave the appearance of being logged in with that name.
Maybe Yahoo is still filtering it if you send it as a post, but neglected to filter it if it was a username/nicname. yTunnel really does not give much protection so I am not surprised it did not help. Users of several chat clients (I can’t speak for all of them) would not have been affected.
The patch will only help those who update. Many computer users are woefully behind on their updates but maybe this will inspire them to stay updated.
Ok so far my research has indicated two different things to me. One is that this is an Internet Exployer exploit which could be fixed with SP2 updated. Someone else said, that it is actually a ytunnel exploit, that if people have ytunnel, they do not get these <iframes. I have also discoverd there is a list of approximately 10-15 of these exploits. i.e. opening your cd rom drive, starting your printer, putting websites in the room to loop over and over, and telnet. I'm still researching this, and it is apparently a very old exploit, that at one time was fixed by yahoo, but apparently yahoo forgot to keep it fixed.
As far as I can tell it is just annoying more then harmful. I’ve put the <iframe <marquee and <font wildcard in my iggy bin for ytunnel, and have added the code to my filter1. we'll see if any of it helps.
Thanks for the info Netti. I know my students used to tell me that stuff about printers and CD-rom drives…but you’d think people at Yahoo! would be able to keep those exploits patched up. Just goes to show when you fix one thing something else gets opened up. Keep up updated about what ever else you find out. I will look more into this with what you’ve given us here. Thanks again! 🙂
Theres too much to read just gonna post my reply…. Don’t be an idiot <<that website gives you a trojan do not click it.. As far as someone putting the **** in the room..I have seen more then that pop up on my screen. Go the the **S*T*O*N*E*R*S** room in music and user rooms. Sit in there a while you will see everything they do with making **** pop up on ya computer..They can even make a icon of a folder page in chat. Its kinda like back then when ya could post pictures in the room and all kinds of things except this is differnet. Mostly if people are doing this in the room get out of them cause you could be keylogged and get a **** load of trojans and viruses.
EDIT: Text formatting removed. Please use formatting and colors only for emphasis. It makes it much easier to read. Please do not post links irrelevant to the topic at hand.
Quote:quote:Originally posted by I_Am_PornStarTheres too much to read just gonna post my reply…. <<that website gives you a trojan do not click it.. As far as someone putting the **** in the room..I have seen more then that pop up on my screen. Go the the **S*T*O*N*E*R*S** room in music and user rooms. Sit in there a while you will see everything they do with making **** pop up on ya computer..They can even make a icon of a folder page in chat. Its kinda like back then when ya could post pictures in the room and all kinds of things except this is differnet. Mostly if people are doing this in the room get out of them cause you could be keylogged and get a **** load of trojans and viruses.
I went to the room with my ethereal bot expecting something worthwhile and exciting, all I see is a room full of legitimate room users, with no hackers or script kiddies in attendence. Oh well, thanks for the info anyway.
Hi ,
This is a ytunnel exploit and is very dangerous, you can be directed to any website on the net , including ones with malicious html scripts , hence the cd roms opening. This could result in a attacker running a malicious script and installing a virus/trojan or some other nasty on your computer. I know already that all the above users where using ytunnel because it only affects ytunnel.
Solutions: Use the official yahoo client or another third party client , but this is the exact reason I use official clients only and not third party clients.
Quote:quote:Originally posted by Notifying_peepsHi ,
This is a ytunnel exploit and is very dangerous, you can be directed to any website on the net , including ones with malicious html scripts , hence the cd roms opening. This could result in a attacker running a malicious script and installing a virus/trojan or some other nasty on your computer. I know already that all the above users where using ytunnel because it only affects ytunnel.
Solutions: Use the official yahoo client or another third party client , but this is the exact reason I use official clients only and not third party clients.
Send me proof to my e-mail address: n3td3v at yahoo com, so I can eliminate Yahoo! products and systems from being vulnerable to it.
Then after, if it is just y-tunnel pro thats vulnerable, then i’ll make every attempt to contact the developer, so the vulnerability can be patched, and no longer be a threat to Yahoo! users who use Y-tunnel on Yahoo! services.
FYI – The solution, or protection from this exploit can be found in another topic of this forum.
https://bigblueball.com/forums/topic.asp?TOPIC_ID=16678
Good luck all.
- You must be logged in to reply to this topic.