A potentially serious security flaw found in Web-based e-mail services
offered by Microsoft and Yahoo could put millions of PCs at risk of takeover, an Internet
security research firm warned Tuesday.
Israel-based security consultants GreyMagic issued the advisory
with a chilling warning that attackers could inject malicious code by simply
sending an e-mail to an unsuspecting Hotmail or Yahoo user.
The vulnerability only affects Hotmail and Yahoo running on Microsoft’s
Internet Explorer (IE) browser.
“When the victim attempts to read this email, the code executes and may
result in severe
consequences,” the company said. Successful exploit could lead to theft of
a user’s login and password, disclosure of the content of any e-mail in the
mailbox and disclosure of all contacts within the address book.
Additionally, GreyMagic said the attacker could manipulate the system to
automatically send e-mails from the mailbox and to exploit vulnerabilities in IE to access the user’s file system and eventually take over his or her machine.
The company said Microsoft reacted to its warning with a fix for the
flaw. However, GreyMagic said all attempts to contact Yahoo’s security
department failed, meaning that Yahoo’s users are still vulnerable. Efforts
by internetnews.com to contact Yahoo at press time were
unsuccessful.
GreyMagic said that many other Web-based e-mail services may be
vulnerable to the flaw, since it is a completely new way to embed script.
The company released a proof-of-concept demonstration with its advisory,
noting that the vulnerability makes use of an IE technology called HTML+TIME
(based on SMIL), which is meant to add timing and media synchronization
support to HTML pages.
One of the features of HTML+TIME is the ability to manipulate any
attribute on an element via special control elements. For example, GreyMagic
explained, the element exposes the attributes “attributeName”
and “to”, which make it possible to inject ANY HTML content to the document
when “attributeName” is set to “innerHTML”, and “to” is set to any HTML the
attacker would like to execute, including script.
RELATED NEWS AND ANALYSIS
-
Ethics and Artificial Intelligence: Driving Greater Equality
FEATURE | By James Maguire,
December 16, 2020
-
AI vs. Machine Learning vs. Deep Learning
FEATURE | By Cynthia Harvey,
December 11, 2020
-
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
-
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
-
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
-
Top 10 AIOps Companies
FEATURE | By Samuel Greengard,
November 05, 2020
-
What is Text Analysis?
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
-
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
-
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
-
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
-
Top 10 Chatbot Platforms
FEATURE | By Cynthia Harvey,
October 07, 2020
-
Finding a Career Path in AI
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
-
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
-
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
-
Top 10 Machine Learning Companies 2021
FEATURE | By Cynthia Harvey,
September 22, 2020
-
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
-
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
-
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
-
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
-
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020