full-disclosure - Is yahoo.com serving malware? [Was: More High Profile Sites IFRAME Injected]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 17 Mar 2008 17:25:57 -0700
From: "Blatant Lier" <blatantlier@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Is yahoo.com serving malware? [Was: More High
	Profile Sites IFRAME Injected]

On Wed, Mar 12, 2008 at 7:51 AM, Dancho Danchev
<dancho.danchev@...il.com> wrote:
>
> lib.ncsu.edu; fulldownloads.us; cso.ie; dblife.cs.wisc.edu;
> www-history.mcs.st-andrews.ac.uk; ehawaii.gov; timeanddate.com;
> boisestate.edu; aoa.gov; gustavus.edu; archive.org;
> gsbapps.stanford.edu; bushtorrent.com; ccie.com; uvm.edu; thehipp.org;
> mnsu.edu; camajorityreport.com; medicare.gov; usamriid.army.mil
>
> http://ddanchev.blogspot.com/2008/03/more-high-profile-sites-iframe-injected.html
>

It would look as if yahoo.com is serving malware. I got this little fellow:

http://media.adrevolver.com/{---remove
this---}adrevolver/trace?sip=103&cpy=1205797527644342&bt=AAAEEIGsMo0L
[note that the link has been purposefully broken with "{---remove this---}"]

while hitting yahoo at 4:45pm EDT. As of this time it is still there.

Considering that yahoo.com is one of the top destination these days, I
believe we can expect this attack to be fairly successful.

BL

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/