Slashdot Mirror
Yahoo! Closes Security Hole That Led To Breach
An anonymous reader writes "Yahoo! has patched the security hole that allowed hackers to access some 450,000 email addresses and passwords associated with Yahoo! Contributor Network and ultimately publish them last week. In the meantime, the group responsible for the hack of the official forum site of technology company NVIDIA has also dumped some user 800 records taken during the breach."
Anyone however believes in 100% security will always be a victim of a hack. Always store personal information knowing that somebody can get to it.
http://OnlineURLDirectory.com http://GunsAmmoForum.com
So now that it's patched Yahoo users should change their passwords again. Presumably if your account was on "the list" and you changed your password after the first disclosure, your credentials could have been compromised again - prior to the security hole being closed.
While this may sound obvious, I bet many folks don't realize the distinction between a disclosure announcement and correction of the problem. Many people probably assume that when a massive password disclosure is made, that the problem has already been fixed. In this case apparently not.
How so?
The only reason they are in the news is because they were hacked, not because anyone thought they were relevant.
Don't know something? Look it up. Still don't know? Then ask.
i think that was the point AC was making.
insensitive clod overlords obligatory xkcd car analogy russian reversals whoosh pedant fanbois ftfy in 3...2...1..PROFIT
The security flaw was the storage of the passwords rather than passwords hash.
Did they fix that?
It's why I just share them in the first place.
You may have read in press reports that Yahoo! recently confirmed an older file containing approximately 450,000 email addresses and passwords—provided by writers who had joined Associated Content prior to May 2010—was publicly posted on the Internet. This file was a standalone file that was not used to grant access to Yahoo! systems and services. This message is being sent to an email address in this compromised file.
We are taking important steps to address this issue and have now fixed the vulnerability that led to the disclosure of the data and enhanced our underlying security controls. As a non-Yahoo! account holder, we apologize that we cannot provide you a direct means to secure your account. We strongly recommend that you employ the security mechanisms recommended by your email service provider to secure your account.
Additionally, given the high frequency of consumers using the same login information on services across the Internet, we strongly advise users to:
Change their passwords for any account they hold every few months,
Use a different password for each service or website, and
Create passwords using a mixture of characters, symbols, and numbers.
We also suggest that you proactively monitor the activity on any account you have created online. Specifically, be on the lookout for spam originating from your email, and check your sign-in activity from time to time. If you see anything suspicious—like your account was accessed in Romania when you were home in Chicago—you should change your password immediately.
We take security very seriously at Yahoo! and invest heavily in protective measures to ensure the security of our users and their data across all our products. In addition, we will continue to take significant measures to protect our users and their data.
We sincerely apologize for this matter. Yahoo! Inc.
The hack was to Yahoo Voice, which hasn't been operated by Yahoo for 4 years now.
450,000 accounts on Yahoo Voice actually astonishes me. I've never met anyone who has ever used that service, including my friends that currently work at Yahoo.
Yahoo! itself is still relevant. People still use delicio.us, flickr, and Yahoo! groups a lot. Their sports pages are far less bloated than ESPN's, so I use them every day.
Free unix account: freeshell.org
A better way of putting it:
Always store personal information knowing that if I or anyone else can recover it either alone by helping each other, someone unfriendly can get to it.
There are ways of destroying my ability to access data that are 100% effective in making sure nobody else can get to it either, ever. They may, however, involve killing anyone who ever had access to the data and destroying their brains.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
of the "450k" the question is how many aren't bots?
It's probably harder to find legitimate users than it is to find bots overall with all of yahoo's services. They never seem to care about the spam/abuse in general.
450,000, with "n" of them people who signed up just to try it out.
The value of "n" is left as speculation for the reader.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
ya, it looks like the yahoo android app has some problem with it.
http://www.zdnet.com/new-yahoo-app-vulnerability-explains-android-spam-7000000964/
At the same time, there has been an nvidia forum breach, so anyone who used a shared username/pwd pair on those services might be vulnerable.
The headline is on par with "Bear observed defecating in forest."
If Yahoo had left the hole wide open, THAT would have been news.
A buddy at work and I also had the same thing happen (received SPAM from a known account). For mine the originating server was in Russia and his was in the Far East somewheres. In both cases the account owner is not aware of a breach, their passwords still work, etc. I think Yahoo! has a problem they haven't disclosed.
WHOOOSH!