Yahoo! (Getty)

Security expert Brian Krebs dropped a bomb on Yahoo email users last week, though his warning was probably lost in the roar of stories about Black Friday fistfights. According to Mr. Krebs, an Egyptian hacker using the screen name TheHell is selling a Yahoo Mail exploit that could allow an attacker to take over and control a victim's email and browser activity. TheHell is only charging $700 for the information.

TheHell uploaded a video demonstration to prove he was serious. Mr. Krebs reproduced the video, which you can watch below.

According to Mr. Krebs, the hacker implied his $700 asking price was a bargain:

"I'm selling Yahoo stored xss that steal Yahoo emails cookies and works on ALL browsers," wrote the vendor of this exploit, using the hacker handle 'TheHell.' "And you don’t need to bypass IE or Chrome xss filter as it do that itself because it’s stored xss. Prices around for such exploit is $1,100 – $1,500, while I offer it here for $700. Will sell only to trusted people cuz I don't want it to be patched soon!"

Yahoo's security director, Ramses Martinez, told Mr. Krebs that fixing the exploit itself isn't too hard--the problem is finding the weak Yahoo URL that allows the hacker to take control.

"Once we figure out the offending URL," said Mr. Martinez, "we can have new code deployed in a few hours."

Mr. Krebs noted that Yahoo doesn't pay hackers who notify the company about vulnerabilities like this. Several other companies do, Mr. Krebs writes, "including Facebook, Google, Mozilla, CCBill and Piwik."

As for ensuring you don't fall prey to such a hack, always engage extreme caution when opening emails containing links, especially if they come from unfamiliar sources. Like guys who call themselves TheHell, for instance.

A photo Pax says is him demonstrating the hack to Yahoo officials at the Bucharest hackathon.

There's a second part to the story of a hacker who built a malicious worm at a Yahoo-sponsored hackathon in Bucharest that exploits a vulnerability in a Yahoo developer service. The hacker, who goes by Pax, was offended when the hackathon organizers cut short his time on stage due and failed to give him due respect for a clever (though malicious) hack, or thank him and his team partner for exposing a security hole. "They were/are complete assholes," he said on Twitter after someone commented that the officials' reaction had turned a white hat effort into a grudge.

So he found a second security hole in another version of the same service, wrote a second virus, and announced he is selling the code.

From the ad:

Selling Yahoo Self Spread XSS Worm

About the worm :

The worm self spreads via instant messaging and email.
The worm steals cookies from Yahoo users and uses them to authenticate itself in order to send spam to the contacts of the victim. The spammed contacts recive an 'interesting' URL. If they click it, their cookies will be stolen and send to the worm for instant or later use ( depending of config ). It supports proxies ( format check, avaiability check, type check ). The emails and IMs also bypass spam checkers.

He doesn't name a price, but specifies that the buyer must use Western Union and promise not to disclose the worm to Yahoo. "IF YOU ARE YAHOO, SUCK ME!" he wrote in the ad.

A Yahoo security researcher attempted to get more details about the new worm from Pax via Twitter, to no avail.

"We have learnt an important lesson about disclosure," Pax tweeted. "Don't disclose! Exploit!"