fbpx

Blogs

  • Home
    Home This is where you can find all the blog posts throughout the site.
  • Categories
    Categories Displays a list of categories from this blog.
  • Tags
    Tags Displays a list of tags that have been used in the blog.
  • Bloggers
    Bloggers Search for your favorite blogger from this site.
  • Archives
    Archives Contains a list of blog posts that were created previously.
  • Login
    Login Login form
24
Sep

Rumor Mill: Yahoo Breach Affected Hundreds of Millions

Posted by on in Search Engines
  • Hits: 652

Yahoo has disclosed that a massive data breach resulted in the exposure of at least 500 million users' accounts.

Don't leap to conclusions on the basis of a new report that suggests Yahoo is preparing to warn the world that it was hacked and lost hundreds of millions of users' account credentials.

"Yahoo is poised to confirm a massive data breach of its service"

The data breach report, from technology news site Recode, claims that "Yahoo is poised to confirm a massive data breach of its service" that exposed credentials for hundreds of millions of users.

It says the supposed breach is the same one that came to light in early August, when a hacker known as Peace - a.k.a. Peace_of_mind - began advertising 200 million alleged Yahoo credentials for sale on a darknet marketplace called The Real Deal, as technology news siteMotherboard first reported. Peace told the site that the data likely dated from 2012, had already been traded privately for some time, and was now available for 3 bitcoins, worth about $1,800.

Peace was also the seller behind the stolen LinkedIn, Fling, MySpace and Tumblr credentials, many dating from years ago, as part of what's been a wave of historical mega-breachesbelatedly coming to light as the information has been offered for sale via the cybercrime underground.

But some security experts have urged against reading too much into the new report. "I'm skeptical that they're going to say there's been a breach," Sean Sullivan, a security specialist for Finnish security firm F-Secure, tells me. "They might be like: there's a huge cache of verified accounts with verified passwords," he says, meaning that the information may have been obtained via a breach, but not necessarily a breach involving Yahoo.

"The asking price was miniscule, so clearly it's not something they had to pay to exfiltrate," Sullivan says. Hence one possibility, he says, is that the supposed Yahoo data breach is the result of attackers taking email and password combinations from other hacked sites - such as Adobe or Dropbox - and finding ones that worked on Yahoo's site. Sullivan said it would have been easy for attackers to harvest the information, create a script to test it against Yahoo, and then sell it to others.

Rampant Password Reuse

The ease and prevalence of that practice has led some technology firms to scrape public data dumps and proactively test whether the information contains reused passwords that could be used to log into any of the accounts registered with their service. In 2013, Facebook, for one, began reviewing public data dumps and forcing users to reset their passwords if they'd been reused.

Following the report that Peace was offering about 200 million old Yahoo passwords for sale, Yahoo said that it was "aware of a claim" and investigating.

Perhaps not coincidentally, Sullivan notes that since this past summer, he's begun seeing frequent reminders from Yahoo whenever he logs in, encouraging him to change his password. "It's just been my personal experience of Yahoo encouraging the heck out of, 'Hey, update your password," which in my case is complex and unique, and thus I've been waiting to see evidence of if I should, and also just because in my case there's nothing in my [Yahoo] account that's mission critical."

Another possibility is that as part of the $4.8 billion sale of Yahoo's core business to Verizon, it plans to issue a financial disclosure saying that legally speaking, it could face future legal action as the result of compromised credentials.

Sullivan says such a statement would likely read: "We don't know if there was a breach, but our lawyers say we are liable to cover the cost," which might see the company offering to provide identity theft monitoring.

Or another possibility is that a short seller is attempting to manipulate Verizon or Yahoo's stock price.

Halcyon Days

The warning that hundreds of millions of Yahoo accounts may have been compromised is a reminder of how much Yahoo's star has fallen. Initially, the site positioned itself in large part as a portal to the rest of the internet as well as a search engine. But as the portal paradigm faded and Google became the search engine giant, Yahoo suffered.

As Dublin-based information security consultant Brian Honan notes via Twitter, news of the breach may now lead to a spike in the use of Yahoo, if only for lapsed users to remind themselves of what they used to use the service for.

Source : http://www.bankinfosecurity.com/

Rate this blog entry:
0
Tag:

Comments

airs logo

Association of Internet Research Specialists is the world's leading community for the Internet Research Specialist and provide a Unified Platform that delivers, Education, Training and Certification for Online Research.

Get Exclusive Research Tips in Your Inbox

Receive Great tips via email, enter your email to Subscribe.

Follow Us on Social Media