Security researchers at BitDefender are warning users about a new Yahoo! Messenger vulnerability that allows an attacker to change victims’ status updates.
According to the security firm, the situation has been exploited in the wild to target version 11.x of the Messenger client. The vulnerability allows attackers to take advantage of the level of trust status messages have and potentially serve users with malicious links, blogged Bogdan Botezatu, senior communications specialist at BitDefender.
“Chances are that, once displayed, they will be clicked by most contacts who see them,” he wrote.
“One scenario: the victim’s status message is swapped with an attention-getting text that points to a page hosting a zero-day exploit targeting the IE browser, the locally installed Java or Flash environments or even a PDF bug, to mention only a few,” he continued. “Whenever a contact clicks on the victim’s status message, chances are they get infected without even knowing it.”
The vulnerability could also be used as part of an affiliate marketing scheme designed to push Web traffic to certain sites – all while the victim remains blissfully unaware their status has been hijacked, he wrote.
“The status message change occurs when an attacker simulates sending a file to a user,” Botezatu noted. “This action manipulates the $InlineAction parameter (responsible for the way the Messenger form displays the accept or deny the transfer) in order to load an iFrame which, when loaded, swaps the status message for the attacker’s custom text. This status may also include a dubious link. This iFrame is sent as a regular message and comes from another Yahoo Instant Messenger user, even if the user is not in the victim’s contact list.”
BitDefender has provided Yahoo with documentation about the exploit as well as proof-of-concept code for fixing the issue, he added. In the meantime, users can set Yahoo Messenger to ignore anyone not in their Yahoo contacts, though this will not address any attacks coming from contacts.
