backtop

Print 27 comment(s) - last by leviathan05.. on Jul 16 at 4:34 PM
Hackers say data was posted as a warning

It's Sony Corp. (TYO:6758) all over again!  

Hackers with "D33ds Company" have posted 453,000 passwords from Yahoo! Inc.'s (YHOO) Voices -- a part of its news service.  Bafflingly, Yahoo administrators apparently opted for no encryption of the passwords, storing them in plain-text.

Hackers scooped up the passwords using SQL injection, according to TrustedSec.

The hackers write on their text dump:

We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat.  There have been many security holes exploited in Web servers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly.

They were at least kind enough not to publish details of how the penetrated Yahoo's servers.

compromised passwords
Some of the 453,000 compromised accounts. [Image Source: TrustedSec]

Yahoo insists that it's not that big a deal, saying that only 5 percent of the user passwords would pass as valid passwords on its other sites, hence most users day-to-day passswords were likely not compromised.

It does apologize, though, for the inconvenience, writing:

At Yahoo! we take security very seriously and invest heavily in protective measures to ensure the security of our users and their data across all our products.  We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised.

Multiple military and government email addresses were found among the users with leaked passwords.

Sources: d33ds co., TrustedSec, TechCrunch


Comments     Threshold


This article is over a month old, voting and posting comments is disabled
was I on the list ...
By Soulkeeper on 7/12/2012 11:31:45 PM , Rating: 3
Too bad they removed the link, would be nice to check if i'm in it.




RE: was I on the list ...
By YashBudini on 7/13/2012 7:45:40 AM , Rating: 2
Just delete it, Yahoo is the most unsecured email going.


RE: was I on the list ...
By Camikazi on 7/13/2012 9:07:29 AM , Rating: 3
That is why I use a yahoo account for my spam email :)


RE: was I on the list ...
By Omega215D on 7/13/2012 9:12:02 AM , Rating: 2
pretty much. Their portal has become a bloated mess and quite lag prone, not to mention spammers have been able to send their garbage to me without having posted my yahoo mail address. Ever.


RE: was I on the list ...
By Cypherdude1 on 7/13/2012 7:10:28 PM , Rating: 3
quote:
pretty much. Their portal has become a bloated mess and quite lag prone, not to mention spammers have been able to send their garbage to me without having posted my yahoo mail address. Ever.
I also use Yahoo! eMail for spam. Occasionally, Yahoo! does have service problems. However, for the most part, They work OK. It could be because I am using their "Classic" interface.
quote:
Too bad they removed the link, would be nice to check if i'm in it.
D33DS did NOT remove their link or file. They are simply overloaded. I got their file below. You must have both a .GZ and .TAR archive extractor to extract the file. D33DS archived their "yahoo-disclosure.txt" file inside both a .TAR archive and then inside a .GZ file. I recommend the free 7-ZIP utility.
=================================
Due to the high traffic on our server,
the file has been moved (mirrored+compressed).

[Mirrors - Offical]
http://74.208.161.170:81/yahoo-disclosure.tar.gz

If you would like to donate/help with our hosting https://d33ds.co/donations
=================================


RE: was I on the list ...
By heffeque on 7/14/2012 3:35:13 PM , Rating: 2
I'm posting here just to say... "MERCADONA"

LOL!

Best password ever. Mercadona will conquer the entire world!


RE: was I on the list ...
By CZroe on 7/15/2012 7:34:38 AM , Rating: 2
Read the article. It was Yahoo Voices. Not Yahoo Email.


RE: was I on the list ...
By theapparition on 7/13/2012 10:09:13 AM , Rating: 1
It would have been nice to check, I've already changed mine, but again, only use it for spam.

But I don't buy the hackers BS line about a wake up call to Yahoo. They could have grabbed the info and not posted it, but instead they want to potentially hurt other users. I have no problem with "security researchers" who can compromise a system and then let the company and public know. But by dumping proprietary info onto the internet, they're now aholes. Track them down and prosecute.


RE: was I on the list ...
By lolmuly on 7/13/2012 10:41:28 AM , Rating: 5
pfff, you think that any of these companies will listen to somebody sending them a polite little email informing them of their own incompetence? The only thing most big tech corporations respond to in the way of security is public embarrassment.

Bottom line is that Yahoo is the one who posted the passwords by storing them in plain text.


RE: was I on the list ...
By Jedi2155 on 7/13/2012 12:46:48 PM , Rating: 2
The link was still there when I checked it this morning at 2 AM. It was on a redirect with a tarball text file.

I checked to see if I was on it which I thankfully was not. In either case, I'm not sure if these emails are the primary yahoo account one's that you use everywhere, but only one very specific subset of their services.


RE: was I on the list ...
By manicfreak on 7/13/2012 2:48:32 PM , Rating: 2
I think you can use this site to check.
http://labs.sucuri.net/?yahooleak


RE: was I on the list ...
By Cypherdude1 on 7/13/2012 6:56:51 PM , Rating: 2
quote:
I think you can use this site to check. http://labs.sucuri.net/?yahooleak
Do not put your email there. They will IMHO probably put you on a spam list. Although, that's what I use my Yahoo account for.


“Then they pop up and say ‘Hello, surprise! Give us your money or we will shut you down!' Screw them. Seriously, screw them. You can quote me on that.” -- Newegg Chief Legal Officer Lee Cheng referencing patent trolls











botimage
Copyright 2013 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki