Nearly half a million Yahoo passwords leaked following hack
Posted on 12 July 2012.
Some 450,000 email addresses and associated unencrypted passwords have been dumped online by the hacking collective "D33Ds Company" following the compromise of a Yahoo subdomain.


The attackers said that they managed to access the subdomain by leveraging a union-based SQL injection attack, which made the site return more information that it should have.

"We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat," they concluded. "There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage."

Still, the dbb1.ac.bf1.yahoo.com hostname which was included in the dump seems to point to the fact that the password database belongs to the Yahoo! Voice service.

According to ars technica, the dump also includes over 2,700 database table or column names and 298 MySQL variables retrieved during the attack.

Yahoo has yet to comment on the situation.

In the meantime, ESET researcher Anders Nilsson did a quick analysis of the leaked passwords. Unsurprisingly, the most popular ones are "123456" and "password".

It is still unknown whether the passwords were retrieved in the clear text format or were decrypted by the attackers afterwards.

UPDATE: Yahoo has officially confirmed that the leaked emails come from its servers.

"We confirm that an older file from Yahoo! Contributor Network (previously Associated Content) containing approximately 400,000 Yahoo! and other company users names and passwords was stolen yesterday, July 11," they shared with Tech Crunch.

"Of these, less than 5% of the Yahoo! accounts had valid passwords. We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised."

UPDATE #2: Yahoo! closes security hole that led to huge password breach.






Spotlight

The evolution of backup and disaster recovery

Posted on 25 July 2014.  |  Amanda Strassle, IT Senior Director of Data Center Service Delivery at Seagate Technology, talks about enterprise backup issues, illustrates how the cloud shaping an IT department's approach to backup and disaster recovery, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Jul 28th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //