Hacking

Yahoobleed – Yahoo retired ImageMagick library after flaw leaked private e-mail attachments and credentials

Yahoobleed – Yahoo retired the ImageMagick library after flaw leaked sensitive data, including credentials and e-mail attachments.

Supply chain risks are realized when a negative impact to one of your suppliers has a negative impact on your business. If you are a manufacturer, an outage to a component supplier could prevent you from manufacturing; if you are a retailer, a compromise of your air conditioning supplier could compromise your payment systems; and if you are Yahoo! a vulnerability in an image processing library could compromise sensitive Yahoo Mail details.
ImageMagick is a widely used program whose primary purpose is to “create, edit, compose or convert bitmap images.” It has been around since 1990 and with support for a wide range of interfaces including C++, Lisp, Perl, PHP, Python it has been integrated into countless programs, operating systems, and applications. Including some of the largest Internet websites — like Facebook and Yahoo!
Vulnerabilities have been identified in ImageMagick libraries over the years, but the past year has highlighted the impact such a library has when it is widely deployed. In May 2014, security researchers identified an ImageMagick that allowed “malformed images to force a Web server to execute code of an attacker’s choosing.” It was noted that many “social media and blogging sites” rely on ImageMagick and in October of 2016, Facebook paid a $40,000 bounty after learning they were one of those affected.
Yahoo! is the latest victim of the buggy ImageMagick code. Security Researcher Chris Evans identified two vulnerabilities in the Yahoo Mail system which he has named Yahoobleed #1 (YB1) and Yahoobleed #2 (YB2).

“In my previous post on Yahoobleed #1 (YB1), we saw how an uninitialized memory vulnerability could lead to disclosure of private images belonging to other users. The resulting leaked memory bytes were subject to JPEG compression, which is not a problem for image theft, but is somewhat lacking if we wanted to steal memory content other than images.states Chris Evans.

“In this post, we explore an alternative *bleed class vulnerability in Yahoo! thumbnailing servers. Let’s call it Yahoobleed #2 (YB2). We’ll get around the (still present) JPEG compression issue to exfiltrate raw memory bytes. With subsequent usage of the elite cyberhacking tool “strings”, we discover many wonders.

Yahoo! fixed YB2 at the same time as YB1, by retiring ImageMagick.”

When successfully exploited, by sending a Yahoo Mail user an 18-byte image file, these two vulnerabilities could give up Yahoo Mail users’ image attachments, browser cookies and authentication tokens. YB1 is a new vulnerability identified by Evan and the latest ImageMagick code already contains the necessary fix. The YB2 vulnerability was patched in 2015, but Yahoo Mail had not updated to a fixed version of the library.
The hard work of library developers doesn’t help if the application developers are unable to keep up with the latest patches. Perhaps it was this reason that led Yahoo! to take the ultimate ImageMagick fix and stop using the library altogether. Developers increasingly rely on a combination of frameworks and libraries to quickly create complex applications. But that means that they are increasingly vulnerable to software supply chain risks. Identifying, mitigating and responding to these risks will continue to be a challenge — maybe it is time to reduce the number of libraries?
As Chris Evans notes, “The combination of running an ImageMagick that is both old and also unrestricted in the enabled decoders is dangerous. The fix of retiring ImageMagick should take care of both those issues :)”
About the author:  Steve Biswanger has over 20 years experience in Information Security consulting, and is a frequent speaker on risk, ICS and IoT topics. He is currently Director of Information Security for Encana, a North American oil & gas company and sits on the Board of Directors for the (ISC)2 Alberta Chapter.

 

 

 

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Yahoo, ImageMagick)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

US Government officials targeted with texts and AI-generated deepfake voice messages impersonating senior U.S. officials

FBI warns ex-officials are targeted with deepfake texts and AI voice messages impersonating senior U.S.…

15 hours ago

Shields up US retailers. Scattered Spider threat actors can target them

Google warns that the cybercrime group Scattered Spider behind UK retailer attacks is now targeting…

18 hours ago

U.S. CISA adds Google Chromium, DrayTek routers, and SAP NetWeaver flaws to its Known Exploited Vulnerabilities catalog<gwmw style="display:none;"></gwmw>

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium, DrayTek routers, and SAP NetWeaver…

23 hours ago

Pwn2Own Berlin 2025 Day Two: researcher earned 150K hacking VMware ESXi

On day two of Pwn2Own Berlin 2025, participants earned $435,000 for demonstrating zero-day in SharePoint,…

1 day ago

New botnet HTTPBot targets gaming and tech industries with surgical attacks

New botnet HTTPBot is targeting China's gaming, tech, and education sectors, cybersecurity researchers warn. NSFOCUS …

2 days ago

Meta plans to train AI on EU user data from May 27 without consent

Meta plans to train AI on EU user data from May 27 without consent; privacy…

2 days ago