<http://schema.org/articleBody>
"A new exploit being sold for $700 may put tens of millions of Yahoo Mail users at risk.\nOnce victims click on a malicious email link, the exploit allows an attacker to steal and replace tracking cookies, while remotely controlling the victims' browsing sessions.\n\"After the victim clicks the link, he will be redirected to the email page again,\" a demonstration video for the hack explained. \"And you can redirect him to wherever you want.\"\nAccording to Yahoo, fixing the exploit won't be nearly as difficult as finding it. That's because it's an XSS flaw set off by a URL, a hole that can easily be patched, but hard to locate.\n\"Fixing it is easy,\" Ramses Martinez, Yahoo director of security, told computer security writer\u00A0Brian Krebs. \"Once we figure out the offending URL, we can have new code deployed in a few hours.\"\nThe exploit is being sold by an Egyptian hacker who goes by \"TheHell\" and who's taken measures to make sure the patch happens later, rather than sooner.\n\"While I offer it here for $700. Will sell only to trusted people cuz I don\u2019t want it to be\u00A0patched soon!\" TheHell wrote. What's more, \"you don't need to bypass IE or Chrome xss filter,\" he explained.\nKrebs pointed out that if Yahoo paid hackers to report bugs to the company rather than selling them to criminals, as some companies do, it might have been worth TheHell's while to turn it in. If the vulnerability had been Google's they would have purchased it for $1,337.\nWhen opening emails, users should approach links with skepticism and be especially wary of any links that come from unexpected or unknown sources.\nThe Open Web Security Project lists XSS flaws like this among its Top 10 Application Security Risks.\nPhoto courtesy of iStockPhoto, JasonDoiy"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2012/11/26/hack-yahoo-mail/>