Users of Yahoo’s mail service are warned that a vulnerability in the service could be allowing hackers to easily access their accounts and steal their information.
Director of application security research at Breach Security Corp, Ryan Barnett, said that the problem starts with a web application that is designed to automate the login process for the service. Unfortunately the application does not adhere to the same security checks that the login page itself uses creating what Barnett describes as “some sort of water tunnel that the bad guys are walking right through.”
Hackers are using the application to carry out brute force attacks on user accounts, which is not being registered and blocked as most pages would do so.
Backend applications are a key factor in the increasing success of account hijacking cases targeting social networks and portal sites. Once hacked, the accounts can be used to send out spam and malware, or hackers may also choose to use the account details to try to access banking accounts, as many people use the same or similar passwords on multiple accounts.
Yahoo is said to be investigating.
Windows administrators, mark your calendar for the drop dead date to get those old servers upgraded. Microsoft has outlined July 13, 2010 as the date Windows 2000 will no longer be supported by Microsoft. There are already a variety of security threats in the wild where Microsoft has said they will not be releasing updates to protect Windows 2000 because they say it is not feasible. After next July, no support or new updates (except for online self-help) will be available.
Noted Apple security analyst Charlie Miller, author of The Mac Hackers Handbook and two-time winner of the Pwn2Own hacking contest has said, in an interview with 
Canon told the press today that they will be extending the partnership with Adobe with a new software agreement designed to boost security and usability of the company’s products.
