450,000 user passwords leaked in Yahoo breach
Summary: A hacker group claims responsibility for attack on a Yahoo service, exposing more than 450,000 plain text login credentials.
Former Web portal Yahoo has apparently suffered a data breach, resulting in more than 450,000 plain text login credentials pilfered by a group claiming responsibility for the attack.
Ars Technica reported on Thursday that a hacker group, known as D33Ds Company, said in a post it had penetrated the Yahoo subdomain using what is known as a union-based SQL injection. This intrusion technique targets poorly secured Web applications that do not properly scrutinise text entered into search boxes and other user input fields.
The Yahoo service in question appears to be Yahoo Voice--also known as Associated Content, before the media company acquired it in 2010--according to security blog TrustedSec.
Yahoo breach updates:
- Yahoo confirms 400,000 accounts hacked, less than 5% valid
- The top 10 passwords from the Yahoo hack: Is yours one of them?
Hackers had not removed the host name from the data, leading security experts to suggest dbb1.ac.bf1.yahoo.com being associated with the Yahoo Voices platform.
ZDNet tried accessing D33Ds' post but the server appears to be down at the time of writing. Torrents have already hit file- and magnet-link sharing sites, such as The Pirate Bay, making the password cache readily available.
Sister site CNET notes that many of the passwords have already been cracked. Crunching the numbers, more than 230 accounts had "password" as their password, for example.
By injecting database commands into them, attackers can trick backend servers into dumping huge amounts of sensitive information, the report said.
The hacker group posted what it claimed were plaintext credentials for some 453,492 Yahoo accounts. "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat," it said in its post.
"There have been many security holes exploited in Web servers belonging to Yahoo that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage."
It comes only a few weeks after LinkedIn, eHarmony, and Last.fm--which is owned by CBS, the same company that owns ZDNet--suffered breaches and led to a vast amount of unsalted passwords leaking online. The vast majority of passwords were cracked in a few hours.
A Yahoo spokesperson said: "We are currently investigating the claims of a compromise of Yahoo! user IDs," adding: "Users to "change their passwords on a regular basis," according to the BBC.
Updated at 2:20 p.m. BST: with additional details and clarifications.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
search list
Thanks.
Shame on Yahoo
Shame on yahoo lets hope they get off their asses and get some real security and database people employed the ones sittin on their asses and letting in all the pornbots to yahoo chat need to be fired.
AND- - - -
Course, this is just a retired Ole Man rambling!!!!
We've got altogether too many laws in the United States already
If you want a law, how about one that simply states that any company that has not taken all reasonable steps to prevent the theft of personal information shall pay a fine of some nominal number ($100 sounds good) per individual user name and be responsible for all continuing costs to any individuals who lost their data. Were such a law in place today, Yahoo would be facing a $45 million fine; you'd better believe they'd be making sure they were doing everything possible to prevent intrusions and data theft.
a little misplaced responsibility here. the thief should be punished for
it is the responsibility of government to protect the people from thieves.
assuming of course that the government is not harboring thieves itself.
it is nearly impossible to erect enough barriers to prevent theft.
let the perpetrator of the crime do the time.
:)
.
Really
Well, whether or not "the parties responsible" seem to have forgotten that the threat is to the users who have had their passwords cracked.
Let's see... I think a company has poor security. I will steal their stuff and publish their customer's logon credentials... see what a good boy am I.
Dear Ms Yap
So surprising....
Yahoo's got more inherent security flaws on multiple platforms ranging from it's e-mail service being particularly susceptible to phishing and address book attacks and spoofing. Yahoo has known about these problems for well over a decade--be it in Voice, IM itself, or their e-mail client, and they still act like they're ignorant these situations even exist.
After all, why change it? It's only their users who get hurt. . . .
And while I am very saddened for the victims (the users) and any harm or loss they might have suffered (knowing first hand the inherent sadness over the discontinuance of a service a person's invested time from THEIR lives into using due to a breach), I give kudos and props to D33Ds for publicly exposing these terrible flaws--and for doing so in a way that Yahoo should not (but probably will) ignore. I sincerely hope they were only exposing Yahoo for the sorry sack of low-budget services they are and do not plan to further harm the users.
It is also my hope that enraged power users (aka hackers) will fight for the rights of the common user. Kudos guys! For too long, users have gotten screwed by bad EULAs and TOSes written by companies who produce equally bad software, hardware, or applications/websites. This has to stop (Microsoft). We do not even own our own purchased products and aren't entitled to a simple DVD/W of our purchase anymore?
These companies are way too full of themselves.
wow, more misplaced anxiety over the criminal as hero here.
that group of perverts needs to be shut down before they hurt anyone else.
wrong upon wrong doesn't make anything right.
:)
.
The default password
My Password
people have
Cloud clients hurtle toward database Armageddon