(September 18, 2009)
Attackers are exploiting a known vulnerability in Yahoo's network to
launch brute force attacks against users' Yahoo mail accounts. The
attackers are using hijacked mail accounts to send spam. The main Yahoo
login page has mechanisms in place that protect accounts from brute
force attacks, but the recent attacks have been exploiting a web
application that automates the authentication process and does not have
the attack protection in place.
http://www.theregister.co.uk/2009/09..._mail_attacks/
http://www.scmagazineus.com/Rampant-...rticle/149373/
http://searchsecurity.techtarget.com...68227,00.html#
[Editor's Note (Ullrich): The attackers are taking advantage of an all
too common flaw. The web application will block repeat login attempts
using CAPTCHAS, while the web service does not implement similar
protections.]
Add to del.icio.us 
Can you digg it?
Linear Mode
