Yahoo! meme is an advanced twitter clone service. This service doesn’t have (yet) so many users but it’s a matter of time untill Yahoo! will pump traffic to meme.yahoo.com. And this can lead to a PR and security disaster. Why I said that? Let’s think for a moment.

1. Yahoo! is full with xss vulnerabilities.
2. Yahoo! meme is a subdomain of yahoo.com.
3. Yahoo! meme subdomain use the same cookies from yahoo.com (Y and T). BAD IDEEA!

So, Yahoo! xss + Yahoo! meme = xss worm in a potential huge microblogging service. All of this are possible with just a click on the wrong link from a regular user.

We can expect to see large amount of attacks on Yahoo! meme. It doesn’t matter if those attacks are targeting users to increase traffic on other sites, to steal Yahoo! cookies or for malware spreading. It’s a fact that very soon we will see the biggest xss attack targeting Yahoo! users.

Bonus: you can use “invite friends” option for mail bombing.

Related Posts

• November 24, 2009 -- Rezultatele poll-ului despre Hi5
• October 22, 2009 -- Another security problem in usa.kaspersky.com?
• September 30, 2009 -- Xss in BitDefender.com.mx
• September 30, 2009 -- Xss in BitDefender.ro, .es, .fr and co.uk
• May 24, 2009 -- When DDoS is not just for DDoSing (2)